1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
|
/********************************************************/
/* ntapi: Native API core library */
/* Copyright (C) 2013--2017 Z. Gilboa */
/* Released under GPLv2 and GPLv3; see COPYING.NTAPI. */
/********************************************************/
#ifndef ___NTAPI_HASH_TABLE_H_
#define ___NTAPI_HASH_TABLE_H_
#include <psxtypes/psxtypes.h>
#define __NTAPI_HASH_TABLE \
{0x000f6dee, (150)}, /* CsrPortHandle */ \
{0x00b3a87b, (30)}, /* ZwMapUserPhysicalPages */ \
{0x011c4489, (95)}, /* ZwPulseEvent */ \
{0x02513506, (39)}, /* ZwAreMappedFilesTheSame */ \
{0x034a4430, (63)}, /* RtlCreateProcessParameters */ \
{0x03bb7a3c, (187)}, /* ZwRestoreKey */ \
{0x04e21f45, (75)}, /* ZwCreateToken */ \
{0x04f94dc4, (190)}, /* ZwUnloadKey */ \
{0x06125322, (216)}, /* ZwAccessCheckByTypeResultListAndAuditAlarmByHandle */ \
{0x06b550e3, (146)}, /* ZwWriteRequestData */ \
{0x0708114b, (50)}, /* ZwTestAlert */ \
{0x08087626, (34)}, /* ZwOpenSection */ \
{0x0815d651, (230)}, /* ZwSetInformationDebugObject */ \
{0x08b1918f, (45)}, /* ZwSuspendThread */ \
{0x097e0efd, (154)}, /* ZwOpenFile */ \
{0x0a7a10d0, (88)}, /* ZwOpenTimer */ \
{0x0a83f5d6, (191)}, /* ZwQueryOpenSubKeys */ \
{0x0bd77556, (218)}, /* ZwSetThreadExecutionState */ \
{0x0c5cf449, (168)}, /* ZwQueryEaFile */ \
{0x0d638bd2, (74)}, /* ZwSetInformationJobObject */ \
{0x0e629eed, (102)}, /* ZwQuerySemaphore */ \
{0x11fcbb7c, (23)}, /* ZwReadVirtualMemory */ \
{0x121f1e7e, (225)}, /* ZwCreateDebugObject */ \
{0x124a301e, (16)}, /* ZwSetSystemEnvironmentValue */ \
{0x12ec66eb, (235)}, /* ZwQueryDefaultLocale */ \
{0x1742c5c9, (162)}, /* ZwWriteFileGather */ \
{0x177157e3, (42)}, /* ZwTerminateThread */ \
{0x1af41c1a, (22)}, /* ZwProtectVirtualMemory */ \
{0x1c0197e6, (241)}, /* ZwAllocateUuids */ \
{0x1c7a90a1, (5)}, /* ZwQuerySecurityObject */ \
{0x1cf668c5, (194)}, /* ZwQueryKey */ \
{0x21b850be, (258)}, /* _snprintf */ \
{0x2259fc62, (2)}, /* ZwDuplicateObject */ \
{0x24e09c64, (18)}, /* ZwSystemDebugControl */ \
{0x255bf138, (142)}, /* ZwReplyWaitReplyPort */ \
{0x25684721, (76)}, /* ZwOpenProcessToken */ \
{0x25d91d90, (71)}, /* ZwTerminateJobObject */ \
{0x26e1170e, (193)}, /* ZwSetInformationKey */ \
{0x27dd46c3, (29)}, /* ZwFreeUserPhysicalPages */ \
{0x2812eb3c, (240)}, /* ZwAllocateLocallyUniqueId */ \
{0x28574a3f, (77)}, /* ZwOpenThreadToken */ \
{0x29b5ea3d, (140)}, /* ZwRequestWaitReplyPort */ \
{0x2a6ac6fb, (26)}, /* ZwUnlockVirtualMemory */ \
{0x2aad9aed, (83)}, /* ZwSetInformationToken */ \
{0x2b2356f7, (52)}, /* ZwAlertResumeThread */ \
{0x2c0f001a, (238)}, /* ZwSetDefaultUILanguage */ \
{0x2f22b634, (96)}, /* ZwResetEvent */ \
{0x30309daa, (170)}, /* ZwCreateNamedPipeFile */ \
{0x3064d37b, (68)}, /* RtlQueryProcessDebugInformation */ \
{0x30911e3f, (196)}, /* ZwNotifyChangeKey */ \
{0x32ad44f5, (73)}, /* ZwQueryInformationJobObject */ \
{0x33a33c40, (163)}, /* ZwLockFile */ \
{0x357f8a82, (36)}, /* ZwExtendSection */ \
{0x3753c2c8, (198)}, /* ZwDeleteValueKey */ \
{0x379a6717, (93)}, /* ZwOpenEvent */ \
{0x391b8d79, (157)}, /* ZwCancelIoFile */ \
{0x3928a4cc, (20)}, /* ZwFreeVirtualMemory */ \
{0x39bea937, (89)}, /* ZwCancelTimer */ \
{0x3abffc38, (247)}, /* ZwFlushWriteBuffer */ \
{0x3b1f8d85, (124)}, /* ZwQueryTimerResolution */ \
{0x3cd73491, (226)}, /* ZwDebugActiveProcess */ \
{0x3d4aceeb, (256)}, /* memset */ \
{0x3e1d331d, (44)}, /* ZwSetInformationThread */ \
{0x3f62370b, (204)}, /* ZwPrivilegeCheck */ \
{0x416c4024, (118)}, /* ZwSetLowWaitHighEventPair */ \
{0x43c1745d, (92)}, /* ZwCreateEvent */ \
{0x43d65de2, (239)}, /* ZwQueryInstallUILanguage */ \
{0x45d7086f, (108)}, /* ZwOpenIoCompletion */ \
{0x465977c0, (129)}, /* ZwQueryIntervalProfile */ \
{0x47b3fd39, (8)}, /* ZwOpenDirectoryObject */ \
{0x47dd6896, (171)}, /* ZwCreateMailslotFile */ \
{0x49d62b40, (254)}, /* LdrLoadDll */ \
{0x4a638203, (91)}, /* ZwQueryTimer */ \
{0x4c51093e, (189)}, /* ZwLoadKey2 */ \
{0x4cb0ea34, (206)}, /* ZwPrivilegedServiceAuditAlarm */ \
{0x4cc741f4, (222)}, /* ZwPowerInformation */ \
{0x4d0aa736, (207)}, /* ZwAccessCheck */ \
{0x4d361035, (181)}, /* ZwCreateKey */ \
{0x4de0faef, (10)}, /* ZwCreateSymbolicLinkObject */ \
{0x4e049b9b, (72)}, /* ZwAssignProcessToJobObject */ \
{0x4ed4c833, (0)}, /* ZwQueryObject */ \
{0x4efff89a, (166)}, /* ZwFsControlFile */ \
{0x4fe5a956, (49)}, /* ZwQueueApcThread */ \
{0x50f7777d, (84)}, /* ZwWaitForSingleObject */ \
{0x513877ab, (61)}, /* ZwSetInformationProcess */ \
{0x51d5c98d, (137)}, /* ZwAcceptConnectPort */ \
{0x51ddffce, (250)}, /* ZwDisplayString */ \
{0x51fbe1c4, (165)}, /* ZwDeviceIoControlFile */ \
{0x52334a05, (213)}, /* ZwDeleteObjectAuditAlarm */ \
{0x5288a7cf, (46)}, /* ZwResumeThread */ \
{0x54a89e87, (131)}, /* ZwStopProfile */ \
{0x56ada303, (185)}, /* ZwSaveKey */ \
{0x573e11b1, (231)}, /* ZwQueryDebugFilterState */ \
{0x57dd87c6, (114)}, /* ZwWaitLowEventPair */ \
{0x5879157d, (249)}, /* ZwSetDefaultHardErrorPort */ \
{0x58b766a7, (200)}, /* ZwQueryValueKey */ \
{0x59d0cf7f, (9)}, /* ZwQueryDirectoryObject */ \
{0x5a201018, (180)}, /* ZwSetInformationFile */ \
{0x5b24a650, (155)}, /* ZwDeleteFile */ \
{0x5cc5b0cc, (149)}, /* CsrClientCallServer */ \
{0x5ccb443b, (253)}, /* ZwVdmControl */ \
{0x5d5b0c74, (15)}, /* ZwQuerySystemEnvironmentValue */ \
{0x5dcf9e33, (205)}, /* ZwPrivilegeObjectAuditAlarm */ \
{0x5f3fb511, (164)}, /* ZwUnlockFile */ \
{0x60ebf65f, (120)}, /* ZwQuerySystemTime */ \
{0x63033516, (252)}, /* ZwSetLdtEntries */ \
{0x63cc9e64, (66)}, /* RtlCreateQueryDebugBuffer */ \
{0x64a2ceb5, (56)}, /* ZwCreateProcess */ \
{0x654da6fd, (143)}, /* ZwReplyWaitReceivePort */ \
{0x6570064e, (251)}, /* ZwCreatePagingFile */ \
{0x65b5374b, (14)}, /* ZwSetSystemInformation */ \
{0x6a2d88fc, (126)}, /* ZwYieldExecution */ \
{0x6c1b25c0, (97)}, /* ZwClearEvent */ \
{0x6db16208, (246)}, /* ZwQueryInformationAtom */ \
{0x6e0c0f9d, (65)}, /* RtlNormalizeProcessParams */ \
{0x6f11895e, (217)}, /* ZwIsSystemResumeAutomatic */ \
{0x7160272d, (144)}, /* ZwReplyWaitReceivePortEx */ \
{0x72f83a29, (67)}, /* RtlDestroyQueryDebugBuffer */ \
{0x73349dea, (160)}, /* ZwWriteFile */ \
{0x75e01428, (111)}, /* ZwQueryIoCompletion */ \
{0x75e970e4, (115)}, /* ZwSetLowEventPair */ \
{0x7683000f, (38)}, /* ZwUnmapViewOfSection */ \
{0x76d9a68b, (159)}, /* ZwReadFile */ \
{0x7783f5c4, (98)}, /* ZwQueryEvent */ \
{0x78327b0d, (173)}, /* ZwSetVolumeInformationFile */ \
{0x78a28538, (80)}, /* ZwAdjustPrivilegesToken */ \
{0x7b9f9b64, (182)}, /* ZwOpenKey */ \
{0x7c868d67, (260)}, /* _vsnprintf */ \
{0x7ccd8968, (138)}, /* ZwCompleteConnectPort */ \
{0x7dfb3677, (169)}, /* ZwSetEaFile */ \
{0x7e21039a, (87)}, /* ZwCreateTimer */ \
{0x7e92a7a6, (259)}, /* vsprintf */ \
{0x7ec723c2, (122)}, /* ZwQueryPerformanceCounter */ \
{0x7f99ab33, (145)}, /* ZwReadRequestData */ \
{0x8053fc81, (228)}, /* ZwWaitForDebugEvent */ \
{0x81b18dcd, (21)}, /* ZwQueryVirtualMemory */ \
{0x842e9cbb, (43)}, /* ZwQueryInformationThread */ \
{0x84d52359, (112)}, /* ZwCreateEventPair */ \
{0x84e3898f, (183)}, /* ZwDeleteKey */ \
{0x850106f7, (7)}, /* ZwCreateDirectoryObject */ \
{0x8548dfbd, (106)}, /* ZwQueryMutant */ \
{0x85f069ec, (197)}, /* ZwNotifyChangeMultipleKeys */ \
{0x87763935, (257)}, /* sprintf */ \
{0x87fd0a60, (24)}, /* ZwWriteVirtualMemory */ \
{0x8a1989d8, (136)}, /* ZwListenPort */ \
{0x8afaa2ca, (31)}, /* ZwGetWriteWatch */ \
{0x8b3aacc6, (174)}, /* ZwQueryQuotaInformationFile */ \
{0x8bf01eb2, (135)}, /* ZwSecureConnectPort */ \
{0x8c4a9ca2, (100)}, /* ZwOpenSemaphore */ \
{0x8cb632f5, (17)}, /* ZwShutdownSystem */ \
{0x8d31519d, (58)}, /* ZwOpenProcess */ \
{0x8d5b0647, (53)}, /* ZwRegisterThreadTerminatePort */ \
{0x8df4b3ed, (158)}, /* ZwCancelIoFileEx */ \
{0x8e80b080, (119)}, /* ZwSetHighWaitLowEventPair */ \
{0x8eb2c33b, (121)}, /* ZwSetSystemTime */ \
{0x8fe01ce6, (4)}, /* ZwClose */ \
{0x8ffaebe4, (70)}, /* ZwOpenJobObject */ \
{0x90bf911c, (177)}, /* ZwQueryFullAttributesFile */ \
{0x920b0183, (116)}, /* ZwWaitHighEventPair */ \
{0x9331fae3, (25)}, /* ZwLockVirtualMemory */ \
{0x9384c236, (103)}, /* ZwCreateMutant */ \
{0x93cf5771, (232)}, /* ZwSetDebugFilterState */ \
{0x93e64266, (130)}, /* ZwStartProfile */ \
{0x949f76b6, (19)}, /* ZwAllocateVirtualMemory */ \
{0x956ba548, (11)}, /* ZwOpenSymbolicLinkObject */ \
{0x9636e6ce, (227)}, /* ZwRemoveProcessDebug */ \
{0x963cafbc, (237)}, /* ZwQueryDefaultUILanguage */ \
{0x9731aded, (178)}, /* ZwQueryDirectoryFile */ \
{0x978855cd, (37)}, /* ZwMapViewOfSection */ \
{0x98058c5c, (86)}, /* ZwWaitForMultipleObjects */ \
{0x997388d8, (245)}, /* ZwDeleteAtom */ \
{0x9bf04a73, (172)}, /* ZwQueryVolumeInformationFile */ \
{0x9c805856, (167)}, /* ZwNotifyChangeDirectoryFile */ \
{0x9d9c64db, (186)}, /* ZwSaveMergedKeys */ \
{0x9fb42181, (79)}, /* ZwFilterToken */ \
{0x9fce5072, (57)}, /* ZwCreateUserProcess */ \
{0xa09dea3c, (192)}, /* ZwReplaceKey */ \
{0xa313f9b0, (220)}, /* ZwSetSystemPowerState */ \
{0xa34a43e1, (48)}, /* ZwSetContextThread */ \
{0xa51616fd, (156)}, /* ZwFlushBuffersFile */ \
{0xa589ce00, (234)}, /* ZwContinue */ \
{0xa5b2c609, (117)}, /* ZwSetHighEventPair */ \
{0xa8720028, (153)}, /* ZwCreateFile */ \
{0xa93301f4, (110)}, /* ZwRemoveIoCompletion */ \
{0xa9e5e651, (199)}, /* ZwSetValueKey */ \
{0xabc87b74, (32)}, /* ZwResetWriteWatch */ \
{0xac5765bd, (211)}, /* ZwOpenObjectAuditAlarm */ \
{0xac77c9d4, (47)}, /* ZwGetContextThread */ \
{0xaccf3eee, (214)}, /* ZwAccessCheckByTypeAndAuditAlarm */ \
{0xacdddfe2, (176)}, /* ZwQueryAttributesFile */ \
{0xafe64c80, (179)}, /* ZwQueryInformationFile */ \
{0xb28fcd19, (1)}, /* ZwSetInformationObject */ \
{0xb2adc219, (209)}, /* ZwAccessCheckByType */ \
{0xb32b8a16, (41)}, /* ZwOpenThread */ \
{0xb39f2b58, (128)}, /* ZwSetIntervalProfile */ \
{0xb3a5ef4c, (64)}, /* RtlDestroyProcessParameters */ \
{0xb3d90f63, (60)}, /* ZwQueryInformationProcess */ \
{0xb3f8b8ba, (184)}, /* ZwFlushKey */ \
{0xb468e7d0, (233)}, /* ZwRaiseException */ \
{0xb4f463e1, (175)}, /* ZwSetQuotaInformationFile */ \
{0xb5ce95b0, (109)}, /* ZwSetIoCompletion */ \
{0xb677bd15, (219)}, /* ZwGetDevicePowerState */ \
{0xb891d19c, (141)}, /* ZwReplyPort */ \
{0xba08cfed, (221)}, /* ZwInitiatePowerAction */ \
{0xba5bdfc3, (242)}, /* ZwSetUuidSeed */ \
{0xba812651, (229)}, /* ZwDebugContinue */ \
{0xbc310050, (133)}, /* ZwCreateWaitablePort */ \
{0xbde7d8d1, (151)}, /* ZwLoadDriver */ \
{0xbe9990b9, (134)}, /* ZwConnectPort */ \
{0xc0040fd0, (90)}, /* ZwSetTimer */ \
{0xc00fc05c, (248)}, /* ZwRaiseHardError */ \
{0xc4bd0fda, (99)}, /* ZwCreateSemaphore */ \
{0xc524def2, (148)}, /* ZwImpersonateClientOfPort */ \
{0xc6a277e0, (244)}, /* ZwFindAtom */ \
{0xc6de9ce3, (139)}, /* ZwRequestPort */ \
{0xc707f028, (27)}, /* ZwFlushVirtualMemory */ \
{0xc70d789c, (69)}, /* ZwCreateJobObject */ \
{0xc71b989a, (78)}, /* ZwDuplicateToken */ \
{0xc7835b75, (195)}, /* ZwEnumerateKey */ \
{0xc7d8afa4, (85)}, /* ZwSignalAndWaitForSingleObject */ \
{0xc94ea8a6, (81)}, /* ZwAdjustGroupsToken */ \
{0xc9f42a5d, (243)}, /* ZwAddAtom */ \
{0xca250552, (210)}, /* ZwAccessCheckByTypeResultList */ \
{0xcaf1f803, (152)}, /* ZwUnloadDriver */ \
{0xcb3c8251, (223)}, /* ZwPlugPlayControl */ \
{0xcc22b021, (113)}, /* ZwOpenEventPair */ \
{0xcdb98ed4, (59)}, /* ZwTerminateProcess */ \
{0xced9d11d, (123)}, /* ZwSetTimerResolution */ \
{0xd4191071, (127)}, /* ZwCreateProfile */ \
{0xd48a2bbc, (40)}, /* ZwCreateThread */ \
{0xd517401d, (54)}, /* ZwImpersonateThread */ \
{0xd5a16cee, (51)}, /* ZwAlertThread */ \
{0xd628c8f6, (236)}, /* ZwSetDefaultLocale */ \
{0xd7fef93d, (201)}, /* ZwEnumerateValueKey */ \
{0xda57df71, (255)}, /* LdrUnloadDll */ \
{0xdaa7575e, (215)}, /* ZwAccessCheckByTypeResultListAndAuditAlarm */ \
{0xde07d08f, (224)}, /* ZwGetPlugPlayEvent */ \
{0xde5468ed, (202)}, /* ZwQueryMultipleValueKey */ \
{0xdf8698ed, (13)}, /* ZwQuerySystemInformation */ \
{0xdf86b31f, (6)}, /* ZwSetSecurityObject */ \
{0xe0c1d02e, (55)}, /* ZwImpersonateAnonymousToken */ \
{0xe1562f17, (3)}, /* ZwMakeTemporaryObject */ \
{0xe19be90e, (33)}, /* ZwCreateSection */ \
{0xe23ef886, (161)}, /* ZwReadFileScatter */ \
{0xe2ff4b82, (188)}, /* ZwLoadKey */ \
{0xe3521fd4, (101)}, /* ZwReleaseSemaphore */ \
{0xe3624a9b, (212)}, /* ZwCloseObjectAuditAlarm */ \
{0xe3ae76c7, (132)}, /* ZwCreatePort */ \
{0xe43a3a6f, (147)}, /* ZwQueryInformationPort */ \
{0xe624ac47, (12)}, /* ZwQuerySymbolicLinkObject */ \
{0xe6a6cc2d, (208)}, /* ZwAccessCheckAndAuditAlarm */ \
{0xe8d1aec4, (105)}, /* ZwReleaseMutant */ \
{0xeb69e74d, (62)}, /* ZwFlushInstructionCache */ \
{0xed4a67c1, (28)}, /* ZwAllocateUserPhysicalPages */ \
{0xed5deedd, (107)}, /* ZwCreateIoCompletion */ \
{0xedac7230, (203)}, /* ZwInitializeRegistry */ \
{0xee535edc, (35)}, /* ZwQuerySection */ \
{0xee5cdc2d, (82)}, /* ZwQueryInformationToken */ \
{0xf3d1faa7, (125)}, /* ZwDelayExecution */ \
{0xf425639c, (104)}, /* ZwOpenMutant */ \
{0xfde47817, (94)}, /* ZwSetEvent */ \
#define __NT_IMPORTED_SYMBOLS_ARRAY_SIZE 261
#endif
|
