#ifndef _NTDDK_
#define _NTDDK_

#define NT_INCLUDED
#define _NTDEF_
#define _CTYPE_DISABLE_MACROS

#pragma warning(disable : 4200)

#undef STATUS_WAIT_0
#undef STATUS_ABANDONED_WAIT_0
#undef STATUS_USER_APC
#undef STATUS_TIMEOUT
#undef STATUS_PENDING
#undef DBG_CONTINUE
#undef STATUS_SEGMENT_NOTIFICATION
#undef DBG_TERMINATE_THREAD
#undef DBG_TERMINATE_PROCESS
#undef DBG_CONTROL_C
#undef DBG_CONTROL_BREAK
#undef STATUS_GUARD_PAGE_VIOLATION
#undef STATUS_DATATYPE_MISALIGNMENT
#undef STATUS_BREAKPOINT
#undef STATUS_SINGLE_STEP
#undef DBG_EXCEPTION_NOT_HANDLED
#undef STATUS_ACCESS_VIOLATION
#undef STATUS_IN_PAGE_ERROR
#undef STATUS_INVALID_HANDLE
#undef STATUS_NO_MEMORY
#undef STATUS_ILLEGAL_INSTRUCTION
#undef STATUS_NONCONTINUABLE_EXCEPTION
#undef STATUS_INVALID_DISPOSITION
#undef STATUS_ARRAY_BOUNDS_EXCEEDED
#undef STATUS_FLOAT_DENORMAL_OPERAND
#undef STATUS_FLOAT_DIVIDE_BY_ZERO
#undef STATUS_FLOAT_INEXACT_RESULT
#undef STATUS_FLOAT_INVALID_OPERATION
#undef STATUS_FLOAT_OVERFLOW
#undef STATUS_FLOAT_STACK_CHECK
#undef STATUS_FLOAT_UNDERFLOW
#undef STATUS_INTEGER_DIVIDE_BY_ZERO
#undef STATUS_INTEGER_OVERFLOW
#undef STATUS_PRIVILEGED_INSTRUCTION
#undef STATUS_STACK_OVERFLOW
#undef STATUS_CONTROL_C_EXIT
#undef STATUS_FLOAT_MULTIPLE_FAULTS
#undef STATUS_FLOAT_MULTIPLE_TRAPS
#undef STATUS_ILLEGAL_VLM_REFERENCE
#undef STATUS_REG_NAT_CONSUMPTION
#undef DBG_EXCEPTION_HANDLED

#include <ntstatus.h>

#if (_MSC_VER >= 800) || defined(_STDCALL_SUPPORTED)
#define NTAPI __stdcall
#else
#define _cdecl
#define NTAPI
#endif

#ifdef __cplusplus
extern "C" {
#endif

#define MAXIMUM_FILENAME_LENGTH			256
#define PORT_MAXIMUM_MESSAGE_LENGTH		256
#define INITIAL_PRIVILEGE_COUNT			3

#define FSCTL_GET_VOLUME_INFORMATION	0x90064

// constants for RtlDetermineDosPathNameType_U
#define DOS_PATHTYPE_UNC				0x00000001	// \\COMPUTER1
#define DOS_PATHTYPE_ROOTDRIVE			0x00000002	// C:\ 
#define DOS_PATHTYPE_STREAM				0x00000003	// X:X or C:
#define DOS_PATHTYPE_NT					0x00000004	// \\??\\C:
#define DOS_PATHTYPE_NAME				0x00000005	// C
#define DOS_PATHTYPE_DEVICE				0x00000006	// \\.\C:
#define DOS_PATHTYPE_LOCALUNCROOT		0x00000007	// \\.

// Define the various device characteristics flags
#define FILE_REMOVABLE_MEDIA            0x00000001
#define FILE_READ_ONLY_DEVICE           0x00000002
#define FILE_FLOPPY_DISKETTE            0x00000004
#define FILE_WRITE_ONCE_MEDIA           0x00000008
#define FILE_REMOTE_DEVICE              0x00000010
#define FILE_DEVICE_IS_MOUNTED          0x00000020
#define FILE_VIRTUAL_VOLUME             0x00000040
#define FILE_AUTOGENERATED_DEVICE_NAME  0x00000080
#define FILE_DEVICE_SECURE_OPEN			0x00000100

#define FILE_SUPERSEDE							0x00000000
#define FILE_OPEN								0x00000001
#define FILE_CREATE								0x00000002
#define FILE_OPEN_IF							0x00000003
#define FILE_OVERWRITE							0x00000004
#define FILE_OVERWRITE_IF						0x00000005
#define FILE_MAXIMUM_DISPOSITION				0x00000005

#define FILE_DIRECTORY_FILE                     0x00000001
#define FILE_WRITE_THROUGH                      0x00000002
#define FILE_SEQUENTIAL_ONLY                    0x00000004
#define FILE_NO_INTERMEDIATE_BUFFERING          0x00000008

#define FILE_SYNCHRONOUS_IO_ALERT               0x00000010
#define FILE_SYNCHRONOUS_IO_NONALERT            0x00000020
#define FILE_NON_DIRECTORY_FILE                 0x00000040
#define FILE_CREATE_TREE_CONNECTION             0x00000080

#define FILE_COMPLETE_IF_OPLOCKED               0x00000100
#define FILE_NO_EA_KNOWLEDGE                    0x00000200
#define FILE_OPEN_FOR_RECOVERY                  0x00000400
#define FILE_RANDOM_ACCESS                      0x00000800

#define FILE_DELETE_ON_CLOSE                    0x00001000
#define FILE_OPEN_BY_FILE_ID                    0x00002000
#define FILE_OPEN_FOR_BACKUP_INTENT             0x00004000
#define FILE_NO_COMPRESSION                     0x00008000

#define FILE_RESERVE_OPFILTER                   0x00100000
#define FILE_OPEN_REPARSE_POINT                 0x00200000
#define FILE_OPEN_NO_RECALL                     0x00400000
#define FILE_OPEN_FOR_FREE_SPACE_QUERY          0x00800000

#define FILE_COPY_STRUCTURED_STORAGE            0x00000041
#define FILE_STRUCTURED_STORAGE                 0x00000441

#define FILE_VALID_OPTION_FLAGS                 0x00ffffff
#define FILE_VALID_PIPE_OPTION_FLAGS            0x00000032
#define FILE_VALID_MAILSLOT_OPTION_FLAGS        0x00000032
#define FILE_VALID_SET_FLAGS                    0x00000036

// THREAD STATES
#define THREAD_STATE_INITIALIZED		0
#define THREAD_STATE_READY				1
#define THREAD_STATE_RUNNING			2
#define THREAD_STATE_STANDBY			3
#define THREAD_STATE_TERMINATED			4
#define THREAD_STATE_WAIT				5
#define THREAD_STATE_TRANSITION			6
#define THREAD_STATE_UNKNOWN			7

// OBJECT TYPE CODES
#define OB_TYPE_TYPE					1
#define OB_TYPE_DIRECTORY				2
#define OB_TYPE_SYMBOLIC_LINK			3
#define OB_TYPE_TOKEN					4
#define OB_TYPE_PROCESS					5
#define OB_TYPE_THREAD					6
#define OB_TYPE_EVENT					7
#define OB_TYPE_EVENT_PAIR				8
#define OB_TYPE_MUTANT					9
#define OB_TYPE_SEMAPHORE				10
#define OB_TYPE_TIMER					11
#define OB_TYPE_PROFILE					12
#define OB_TYPE_WINDOW_STATION			13
#define OB_TYPE_DESKTOP					14
#define OB_TYPE_SECTION					15
#define OB_TYPE_KEY						16
#define OB_TYPE_PORT					17
#define OB_TYPE_ADAPTER					18
#define OB_TYPE_CONTROLLER				19
#define OB_TYPE_DEVICE					20
#define OB_TYPE_DRIVER					21
#define OB_TYPE_IO_COMPLETION			22
#define OB_TYPE_FILE					23

#define OBJ_INHERIT						0x00000002
#define OBJ_PERMANENT					0x00000010
#define OBJ_EXCLUSIVE					0x00000020
#define OBJ_CASE_INSENSITIVE			0x00000040
#define OBJ_OPENIF						0x00000080
#define OBJ_OPENLINK					0x00000100
#define OBJ_VALID_ATTRIBUTES			0x000001F2


// Object Manager Directory Specific Access Rights.
#define DIRECTORY_QUERY					0x0001
#define DIRECTORY_TRAVERSE				0x0002
#define DIRECTORY_CREATE_OBJECT			0x0004
#define DIRECTORY_CREATE_SUBDIRECTORY	0x0008
#define DIRECTORY_ALL_ACCESS			(STANDARD_RIGHTS_REQUIRED | 0xF)

// Object Manager Symbolic Link Specific Access Rights.
#define SYMBOLIC_LINK_QUERY				0x0001
#define SYMBOLIC_LINK_ALL_ACCESS		(STANDARD_RIGHTS_REQUIRED | 0x1)

#define NT_SUCCESS(Status)				((LONG)(Status) >= 0)
#define NT_ERROR(Status)				((ULONG)(Status) >> 30 == 3)

#define DEVICE_TYPE						DWORD

// values for RtlAdjustPrivilege
#define SE_MIN_WELL_KNOWN_PRIVILEGE       (2L)
#define SE_CREATE_TOKEN_PRIVILEGE         (2L)
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE   (3L)
#define SE_LOCK_MEMORY_PRIVILEGE          (4L)
#define SE_INCREASE_QUOTA_PRIVILEGE       (5L)
#define SE_UNSOLICITED_INPUT_PRIVILEGE    (6L) // obsolete and unused
#define SE_MACHINE_ACCOUNT_PRIVILEGE      (6L)
#define SE_TCB_PRIVILEGE                  (7L)
#define SE_SECURITY_PRIVILEGE             (8L)
#define SE_TAKE_OWNERSHIP_PRIVILEGE       (9L)
#define SE_LOAD_DRIVER_PRIVILEGE          (10L)
#define SE_SYSTEM_PROFILE_PRIVILEGE       (11L)
#define SE_SYSTEMTIME_PRIVILEGE           (12L)
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE  (13L)
#define SE_INC_BASE_PRIORITY_PRIVILEGE    (14L)
#define SE_CREATE_PAGEFILE_PRIVILEGE      (15L)
#define SE_CREATE_PERMANENT_PRIVILEGE     (16L)
#define SE_BACKUP_PRIVILEGE               (17L)
#define SE_RESTORE_PRIVILEGE              (18L)
#define SE_SHUTDOWN_PRIVILEGE             (19L)
#define SE_DEBUG_PRIVILEGE                (20L)
#define SE_AUDIT_PRIVILEGE                (21L)
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE   (22L)
#define SE_CHANGE_NOTIFY_PRIVILEGE        (23L)
#define SE_REMOTE_SHUTDOWN_PRIVILEGE      (24L)
#define SE_MAX_WELL_KNOWN_PRIVILEGE       (SE_REMOTE_SHUTDOWN_PRIVILEGE)

#define InitializeObjectAttributes( p, n, a, r, s ) {   \
    (p)->uLength = sizeof( OBJECT_ATTRIBUTES );          \
    (p)->hRootDirectory = r;                             \
    (p)->uAttributes = a;                                \
    (p)->pObjectName = n;                                \
    (p)->pSecurityDescriptor = s;                        \
    (p)->pSecurityQualityOfService = NULL;               \
}


typedef LONG		NTSTATUS;
/*lint -e624 */  // Don't complain about different typedefs.
				 // winnt
typedef NTSTATUS	*PNTSTATUS;
/*lint +e624 */  // Resume checking for different typedefs.

typedef NTSTATUS	(NTAPI *NTSYSCALL)();
typedef NTSYSCALL	*PNTSYSCALL;

typedef ULONG		KAFFINITY;
typedef KAFFINITY	*PKAFFINITY;
typedef LONG		KPRIORITY;

typedef BYTE		KPROCESSOR_MODE;

typedef VOID		*POBJECT;

typedef VOID		(*PKNORMAL_ROUTINE) (
						IN PVOID NormalContext,
						IN PVOID SystemArgument1,
						IN PVOID SystemArgument2
					);

typedef struct _STRING {
    USHORT Length;
    USHORT MaximumLength;
#ifdef MIDL_PASS
    [size_is(MaximumLength), length_is(Length) ]
#endif // MIDL_PASS
    PCHAR Buffer;
} STRING, *PSTRING;


typedef STRING ANSI_STRING;
typedef PSTRING PANSI_STRING;

typedef STRING OEM_STRING;
typedef PSTRING POEM_STRING;


typedef struct _UNICODE_STRING 
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _HARDWARE_PTE
{
    ULONG Valid             : 1;
    ULONG Write             : 1;
    ULONG Owner             : 1;
    ULONG WriteThrough      : 1;
    ULONG CacheDisable      : 1;
    ULONG Accessed          : 1;
    ULONG Dirty             : 1;
    ULONG LargePage         : 1;
    ULONG Global            : 1;
    ULONG CopyOnWrite       : 1;
    ULONG Prototype         : 1;
    ULONG reserved          : 1;
    ULONG PageFrameNumber   : 20;
} HARDWARE_PTE, *PHARDWARE_PTE;

typedef struct _OBJECT_ATTRIBUTES
{
	ULONG			uLength;
	HANDLE			hRootDirectory;
	PUNICODE_STRING	pObjectName;
	ULONG			uAttributes;
	PVOID			pSecurityDescriptor;
	PVOID			pSecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef struct _CLIENT_ID
{
	HANDLE	UniqueProcess;
	HANDLE	UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

typedef struct _PEB_FREE_BLOCK
{
   struct _PEB_FREE_BLOCK	*Next;
   ULONG					Size;
} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;

typedef struct _CURDIR
{
   UNICODE_STRING	DosPath;
   HANDLE			Handle;
} CURDIR, *PCURDIR;

typedef struct _RTL_DRIVE_LETTER_CURDIR
{
	WORD	Flags;
	WORD	Length;
	DWORD	TimeStamp;
	STRING	DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;

#define	PROCESS_PARAMETERS_NORMALIZED	1	// pointers in are absolute (not self-relative)

typedef struct _PROCESS_PARAMETERS
{
    ULONG					MaximumLength;
    ULONG					Length;
    ULONG					Flags;				// PROCESS_PARAMETERS_NORMALIZED
    ULONG					DebugFlags;
    HANDLE					ConsoleHandle;
    ULONG					ConsoleFlags;
    HANDLE					StandardInput;
    HANDLE					StandardOutput;
    HANDLE					StandardError;
    CURDIR					CurrentDirectory;
    UNICODE_STRING			DllPath;
    UNICODE_STRING			ImagePathName;
    UNICODE_STRING			CommandLine;
    PWSTR					Environment;
    ULONG					StartingX;
    ULONG					StartingY;
    ULONG					CountX;
    ULONG					CountY;
    ULONG					CountCharsX;
    ULONG					CountCharsY;
    ULONG					FillAttribute;
    ULONG					WindowFlags;
    ULONG					ShowWindowFlags;
    UNICODE_STRING			WindowTitle;
    UNICODE_STRING			Desktop;
    UNICODE_STRING			ShellInfo;
    UNICODE_STRING			RuntimeInfo;
	RTL_DRIVE_LETTER_CURDIR	CurrentDirectores[32];
} PROCESS_PARAMETERS, *PPROCESS_PARAMETERS;

typedef struct _RTL_BITMAP
{
	DWORD	SizeOfBitMap;
	PDWORD	Buffer;
} RTL_BITMAP, *PRTL_BITMAP, **PPRTL_BITMAP;

#define LDR_STATIC_LINK				0x0000002
#define LDR_IMAGE_DLL				0x0000004
#define LDR_LOAD_IN_PROGRESS		0x0001000
#define LDR_UNLOAD_IN_PROGRESS		0x0002000
#define LDR_ENTRY_PROCESSED			0x0004000
#define LDR_ENTRY_INSERTED			0x0008000
#define LDR_CURRENT_LOAD			0x0010000
#define LDR_FAILED_BUILTIN_LOAD		0x0020000
#define LDR_DONT_CALL_FOR_THREADS	0x0040000
#define LDR_PROCESS_ATTACH_CALLED	0x0080000
#define LDR_DEBUG_SYMBOLS_LOADED	0x0100000
#define LDR_IMAGE_NOT_AT_BASE		0x0200000
#define LDR_WX86_IGNORE_MACHINETYPE	0x0400000

typedef struct _LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY		InLoadOrderModuleList;
    LIST_ENTRY		InMemoryOrderModuleList;
    LIST_ENTRY		InInitializationOrderModuleList;
    PVOID			DllBase;
    PVOID			EntryPoint;
    ULONG			SizeOfImage;	// in bytes
    UNICODE_STRING	FullDllName;
    UNICODE_STRING	BaseDllName;
    ULONG			Flags;			// LDR_*
    USHORT			LoadCount;
    USHORT			TlsIndex;
    LIST_ENTRY		HashLinks;
    PVOID			SectionPointer;
    ULONG			CheckSum;
    ULONG			TimeDateStamp;
//    PVOID			LoadedImports;					// seems they are exist only on XP !!!
//    PVOID			EntryPointActivationContext;	// -same-
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _PEB_LDR_DATA
{
	ULONG		Length;
	BOOLEAN		Initialized;
	PVOID		SsHandle;
	LIST_ENTRY	InLoadOrderModuleList; // ref. to PLDR_DATA_TABLE_ENTRY->InLoadOrderModuleList
	LIST_ENTRY	InMemoryOrderModuleList; // ref. to PLDR_DATA_TABLE_ENTRY->InMemoryOrderModuleList
	LIST_ENTRY	InInitializationOrderModuleList; // ref. to PLDR_DATA_TABLE_ENTRY->InInitializationOrderModuleList
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef VOID NTSYSAPI (*PPEBLOCKROUTINE)(PVOID);

typedef struct _SYSTEM_STRINGS
{
	UNICODE_STRING	SystemRoot;       // C:\WINNT
	UNICODE_STRING	System32Root;     // C:\WINNT\System32
	UNICODE_STRING	BaseNamedObjects; // \BaseNamedObjects
}SYSTEM_STRINGS,*PSYSTEM_STRINGS;

typedef struct _TEXT_INFO
{
	PVOID			Reserved;
	PSYSTEM_STRINGS	SystemStrings;
}TEXT_INFO, *PTEXT_INFO;

typedef struct _PEB
{
	UCHAR				InheritedAddressSpace;				// 0
	UCHAR				ReadImageFileExecOptions;			// 1
	UCHAR				BeingDebugged;						// 2
	BYTE				b003;								// 3
	PVOID				Mutant;								// 4
	PVOID				ImageBaseAddress;					// 8
	PPEB_LDR_DATA		Ldr;								// C
	PPROCESS_PARAMETERS	ProcessParameters;					// 10
	PVOID				SubSystemData;						// 14  
	PVOID				ProcessHeap;						// 18
	KSPIN_LOCK			FastPebLock;						// 1C
	PPEBLOCKROUTINE		FastPebLockRoutine;					// 20
	PPEBLOCKROUTINE		FastPebUnlockRoutine;				// 24
	ULONG				EnvironmentUpdateCount;				// 28
	PVOID				*KernelCallbackTable;				// 2C
	PVOID				EventLogSection;					// 30
	PVOID				EventLog;							// 34
	PPEB_FREE_BLOCK		FreeList;							// 38
	ULONG				TlsExpansionCounter;				// 3C
	PRTL_BITMAP			TlsBitmap;							// 40
	ULONG				TlsBitmapData[0x2];					// 44
	PVOID				ReadOnlySharedMemoryBase;			// 4C
	PVOID				ReadOnlySharedMemoryHeap;			// 50
	PTEXT_INFO			ReadOnlyStaticServerData;			// 54
	PVOID				InitAnsiCodePageData;				// 58
	PVOID				InitOemCodePageData;				// 5C
	PVOID				InitUnicodeCaseTableData;			// 60
	ULONG				KeNumberProcessors;					// 64
	ULONG				NtGlobalFlag;						// 68
	DWORD				d6C;								// 6C
	LARGE_INTEGER		MmCriticalSectionTimeout;			// 70
	ULONG				MmHeapSegmentReserve;				// 78
	ULONG				MmHeapSegmentCommit;				// 7C
	ULONG				MmHeapDeCommitTotalFreeThreshold;	// 80
	ULONG				MmHeapDeCommitFreeBlockThreshold;	// 84
	ULONG				NumberOfHeaps;						// 88
	ULONG				AvailableHeaps;						// 8C
	PHANDLE				ProcessHeapsListBuffer;				// 90
	PVOID				GdiSharedHandleTable;				// 94
	PVOID				ProcessStarterHelper;				// 98
	PVOID				GdiDCAttributeList;					// 9C
	KSPIN_LOCK			LoaderLock;							// A0
	ULONG				NtMajorVersion;						// A4
	ULONG				NtMinorVersion;						// A8
	USHORT				NtBuildNumber;						// AC
	USHORT				NtCSDVersion;						// AE
	ULONG				PlatformId;							// B0
	ULONG				Subsystem;							// B4
	ULONG				MajorSubsystemVersion;				// B8
	ULONG				MinorSubsystemVersion;				// BC
	KAFFINITY			AffinityMask;						// C0
	ULONG				GdiHandleBuffer[0x22];				// C4
	ULONG				PostProcessInitRoutine;				// 14C
	ULONG				TlsExpansionBitmap;					// 150
	UCHAR				TlsExpansionBitmapBits[0x80];		// 154
	ULONG				SessionId;							// 1D4
	ULARGE_INTEGER		AppCompatFlags;						// 1D8
	PWORD				CSDVersion;							// 1E0
/*	PVOID				AppCompatInfo;						// 1E4
	UNICODE_STRING		usCSDVersion;
	PVOID				ActivationContextData;
    PVOID				ProcessAssemblyStorageMap;
    PVOID				SystemDefaultActivationContextData;
    PVOID				SystemAssemblyStorageMap;
    ULONG				MinimumStackCommit; */
} PEB, *PPEB;

typedef struct _TEB
{
	NT_TIB			Tib;                         
	PVOID			EnvironmentPointer;           
	CLIENT_ID		Cid;                      
	PVOID			ActiveRpcInfo;                
	PVOID			ThreadLocalStoragePointer;    
	PPEB			Peb;                           
	ULONG			LastErrorValue;               
	ULONG			CountOfOwnedCriticalSections; 
	PVOID			CsrClientThread;              
	PVOID			Win32ThreadInfo;              
	ULONG			Win32ClientInfo[0x1F];        
	PVOID			WOW32Reserved;                
	ULONG			CurrentLocale;                
	ULONG			FpSoftwareStatusRegister;     
	PVOID			SystemReserved1[0x36];        
	PVOID			Spare1;                       
	LONG			ExceptionCode;                 
	ULONG			SpareBytes1[0x28];            
	PVOID			SystemReserved2[0xA];         
	ULONG			gdiRgn;                       
	ULONG			gdiPen;                       
	ULONG			gdiBrush;                     
	CLIENT_ID		RealClientId;             
	PVOID			GdiCachedProcessHandle;       
	ULONG			GdiClientPID;                 
	ULONG			GdiClientTID;                 
	PVOID			GdiThreadLocaleInfo;          
	PVOID			UserReserved[5];              
	PVOID			glDispatchTable[0x118];       
	ULONG			glReserved1[0x1A];            
	PVOID			glReserved2;                  
	PVOID			glSectionInfo;                
	PVOID			glSection;                    
	PVOID			glTable;                      
	PVOID			glCurrentRC;                  
	PVOID			glContext;                    
	NTSTATUS		LastStatusValue;           
	UNICODE_STRING	StaticUnicodeString; 
	WCHAR			StaticUnicodeBuffer[0x105];   
	PVOID			DeallocationStack;            
	PVOID			TlsSlots[0x40];               
	LIST_ENTRY		TlsLinks;                
	PVOID			Vdm;                          
	PVOID			ReservedForNtRpc;             
	PVOID			DbgSsReserved[0x2];           
	ULONG			HardErrorDisabled;            
	PVOID			Instrumentation[0x10];        
	PVOID			WinSockData;                  
	ULONG			GdiBatchCount;                
	ULONG			Spare2;                       
	ULONG			Spare3;                       
	ULONG			Spare4;                       
	PVOID			ReservedForOle;               
	ULONG			WaitingOnLoaderLock;          
	PVOID			StackCommit;                  
	PVOID			StackCommitMax;               
	PVOID			StackReserve;                 
} TEB, *PTEB;

typedef enum _POOL_TYPE
{
	NonPagedPool,
	PagedPool,
	NonPagedPoolMustSucceed,
	DontUseThisType,
	NonPagedPoolCacheAligned,
	PagedPoolCacheAligned,
	NonPagedPoolCacheAlignedMustS,
	MaxPoolType
} POOL_TYPE, *PPOOL_TYPE;

typedef enum _KWAIT_REASON
{
	Executive,
	FreePage,
	PageIn,
	PoolAllocation,
	DelayExecution,
	Suspended,
	UserRequest,
	WrExecutive,
	WrFreePage,
	WrPageIn,
	WrPoolAllocation,
	WrDelayExecution,
	WrSuspended,
	WrUserRequest,
	WrEventPair,
	WrQueue,
	WrLpcReceive,
	WrLpcReply,
	WrVirtualMemory,
	WrPageOut,
	WrRendezvous,
	Spare2,
	Spare3,
	Spare4,
	Spare5,
	Spare6,
	WrKernel,
	MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;

typedef struct _DISPATCHER_HEADER
{
	BYTE		uType;			//DO_TYPE_*
	BYTE		uAbsolute;
	BYTE		uSize;			// number of DWORDs
	BYTE		uInserted;
	LONG		lSignalState;
	LIST_ENTRY	WaitListHead;
} DISPATCHER_HEADER, *PDISPATCHER_HEADER;

typedef struct _KPROCESS
{
	DISPATCHER_HEADER	Header;           // DO_TYPE_PROCESS (0x1A)
	LIST_ENTRY			le10;
	DWORD				d18;
	DWORD				d1C;
	DWORD				d20;
	DWORD				d24;
	DWORD				d28;
	DWORD				d2C;
	DWORD				d30;
	DWORD				d34;
	DWORD				dKernelTime;      // ticks
	DWORD				dUserTime;        // ticks
	LIST_ENTRY			le40;
	LIST_ENTRY			OutSwapList;
	LIST_ENTRY			ThreadListHead;   // KTHREAD.ThreadList
	DWORD				d58;
	KAFFINITY			AffinityMask;
	WORD				w60;
	BYTE				bBasePriority;
	BYTE				b63;
	WORD				w64;
	BYTE				b66;
	BOOLEAN				fPriorityBoost;
} KPROCESS, *PKPROCESS;

typedef struct _PORT_MESSAGE
{
	USHORT		DataSize;
	USHORT		MessageSize;
	USHORT		MessageType;
	USHORT		VirtualRangesOffset;
	CLIENT_ID	ClientId;
	ULONG		MessageId;
	ULONG		SectionSize;
//	UCHAR		Data[];
} PORT_MESSAGE, *PPORT_MESSAGE;

typedef struct _SERVICE_DESCRIPTOR_TABLE
{
	PNTSYSCALL	ServiceTable;    // array of entrypoints
	PULONG		puCounterTable;    // array of counters
	ULONG		uTableSize;       // number of table entries
	PBYTE		pbArgumentTable;   // array of byte counts
} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;

typedef struct _KSEMAPHORE
{
	DISPATCHER_HEADER	Header;
	LONG				lLimit;
} KSEMAPHORE, *PKSEMAPHORE;

typedef struct _KTHREAD
{
	DISPATCHER_HEADER			Header;       // DO_TYPE_THREAD (0x6C)
	LIST_ENTRY					le010;
	DWORD						d018;
	DWORD						d01C;
	PTEB						pTeb;
	DWORD						d024;
	DWORD						d028;
	BYTE						b02C;
	BYTE						bThreadState; // THREAD_STATE_*
	WORD						w02E;
	WORD						w030;
	BYTE						b032;
	BYTE						bPriority;
	LIST_ENTRY					le034;
	LIST_ENTRY					le03C;
	PKPROCESS					pProcess;
	DWORD						d048;
	DWORD						dContextSwitches;
	DWORD						d050;
	WORD						w054;
	BYTE						b056;
	BYTE						bWaitReason;
	DWORD						d058;
	PLIST_ENTRY					ple05C;
	PLIST_ENTRY					ple060;
	DWORD						d064;
	BYTE						bBasePriority;
	BYTE						b069;
	WORD						w06A;
	DWORD						d06C;
	DWORD						d070;
	DWORD						d074;
	DWORD						d078;
	DWORD						d07C;
	DWORD						d080;
	DWORD						d084;
	DWORD						d088;
	DWORD						d08C;
	DWORD						d090;
	DWORD						d094;
	DWORD						d098;
	DWORD						d09C;
	DWORD						d0A0;
	DWORD						d0A4;
	DWORD						d0A8;
	DWORD						d0AC;
	DWORD						d0B0;
	DWORD						d0B4;
	DWORD						d0B8;
	DWORD						d0BC;
	DWORD						d0C0;
	DWORD						d0C4;
	DWORD						d0C8;
	DWORD						d0CC;
	DWORD						d0D0;
	DWORD						d0D4;
	DWORD						d0D8;
	PSERVICE_DESCRIPTOR_TABLE	pServiceDescriptorTable;
	DWORD						d0E0;
	DWORD						d0E4;
	DWORD						d0E8;
	DWORD						d0EC;
	LIST_ENTRY					le0F0;
	DWORD						d0F8;
	DWORD						d0FC;
	DWORD						d100;
	DWORD						d104;
	DWORD						d108;
	DWORD						d10C;
	DWORD						d110;
	DWORD						d114;
	DWORD						d118;
	BYTE						b11C;
	BYTE						b11D;
	WORD						w11E;
	DWORD						d120;
	DWORD						d124;
	DWORD						d128;
	DWORD						d12C;
	DWORD						d130;
	WORD						w134;
	BYTE						b136;
	KPROCESSOR_MODE				ProcessorMode;
	DWORD						dKernelTime;  // ticks
	DWORD						dUserTime;    // ticks
	DWORD						d140;
	DWORD						d144;
	DWORD						d148;
	DWORD						d14C;
	DWORD						d150;
	DWORD						d154;
	DWORD						d158;
	DWORD						d15C;
	DWORD						d160;
	DWORD						d164;
	DWORD						d168;
	DWORD						d16C;
	DWORD						d170;
	PROC						SuspendNop;
	DWORD						d178;
	DWORD						d17C;
	DWORD						d180;
	DWORD						d184;
	DWORD						d188;
	DWORD						d18C;
	KSEMAPHORE					SuspendSemaphore;
	LIST_ENTRY					ThreadList; // KPROCESS.ThreadListHead
	DWORD						d1AC;
} KTHREAD, *PKTHREAD;

typedef struct _ETHREAD
{
	KTHREAD			Tcb;
	LARGE_INTEGER	liCreateTime;
	LARGE_INTEGER	liExitTime;
	NTSTATUS		ExitStatus;
	LIST_ENTRY		PostBlockList;
	LIST_ENTRY		TerminationPortList;
	ULONG			uActiveTimerListLock;
	LIST_ENTRY		ActiveTimerListHead;
	CLIENT_ID		Cid;
	KSEMAPHORE		LpcReplySemaphore;
	ULONG			uLpcReplyMessage;
	LARGE_INTEGER	liLpcReplyMessageId;
	ULONG			uImpersonationInfo;
	LIST_ENTRY		IrpList;
	LIST_ENTRY		TopLevelIrp;
	ULONG			uReadClusterSize;
	BOOLEAN			fForwardClusterOnly;
	BOOLEAN			fDisablePageFaultClustering;
	BOOLEAN			fDeadThread;
	BOOLEAN			fHasTerminated;
	ULONG			uEventPair;
	ULONG			uGrantedAccess;
	ULONG			uThreadsProcess;
	PVOID			pStartAddress;
	PVOID			Win32StartAddress;
	BOOLEAN			fLpcExitThreadCalled;
	BOOLEAN			fHardErrorsAreDisabled;
	WORD			wUknown1;
	DWORD			dwUknown2;
} ETHREAD, *PETHREAD;

typedef PETHREAD	ERESOURCE_THREAD,
					*PERESOURCE_THREAD;

typedef struct _KEVENT
{
	DISPATCHER_HEADER	Header;
} KEVENT, *PKEVENT;

typedef struct _ERESOURCE_OLD
{
	LIST_ENTRY			SystemResourcesList;
	PERESOURCE_THREAD	OwnerThreads;
	PBYTE				pbOwnerCounts;
	WORD				wTableSize;
	WORD				wActiveCount;
	WORD				wFlag;
	WORD				wTableRover;
	BYTE				bInitialOwnerCounts[4];
	ERESOURCE_THREAD	InitialOwnerThreads[4];
	DWORD				dwUknown1;
	ULONG				uContentionCount;
	WORD				wNumberOfExclusiveWaiters;
	WORD				wNumberOfSharedWaiters;
	KSEMAPHORE			SharedWaiters;
	KEVENT				ExclusiveWaiters;
	KSPIN_LOCK			SpinLock;
	ULONG				uCreatorBackTraceIndex;
	WORD				wDepth;
	WORD				wUknown2;
	PVOID				pOwnerBackTrace[4];
} ERESOURCE_OLD, *PERESOURCE_OLD;

typedef struct _OWNER_ENTRY
{
	ERESOURCE_THREAD	OwnerThread;
	SHORT				sOwnerCount;
	WORD				wTableSize;
} OWNER_ENTRY, *POWNER_ENTRY;

typedef struct _ERESOURCE_LITE
{
	LIST_ENTRY		SystemResourcesList;
	POWNER_ENTRY	OwnerTable;
	SHORT			sActiveCount;
	WORD			wFlag;
	PKSEMAPHORE		SharedWaiters;
	PKEVENT			ExclusiveWaiters;
	OWNER_ENTRY		OwnerThreads[2];
	ULONG			uContentionCount;
	WORD			wNumberOfSharedWaiters;
	WORD			wNumberOfExclusiveWaiters;
	union
	{

		PVOID		pAddress;
		ULONG		uCreatorBackTraceIndex;
	};
	KSPIN_LOCK		SpinLock;
} ERESOURCE_LITE, *PERESOURCE_LITE;

typedef ERESOURCE_LITE	ERESOURCE,
						*PERESOURCE;

typedef struct _IO_STATUS_BLOCK
{
	NTSTATUS	Status;
	ULONG		uInformation;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

/* Defined in Winnt.h
typedef struct _QUOTA_LIMITS {
    SIZE_T PagedPoolLimit;
    SIZE_T NonPagedPoolLimit;
    SIZE_T MinimumWorkingSetSize;
    SIZE_T MaximumWorkingSetSize;
    SIZE_T PagefileLimit;
    LARGE_INTEGER TimeLimit;
} QUOTA_LIMITS, *PQUOTA_LIMITS;
*/

typedef struct _IOCOUNTERS
{
	ULONG			uReadOperationCount;
	ULONG			uWriteOperationCount;
	ULONG			uOtherOperationCount;
	LARGE_INTEGER	liReadTransferCount;
	LARGE_INTEGER	liWriteTransferCount;
	LARGE_INTEGER	liOtherTransferCount;
} IOCOUNTERS, *PIOCOUNTERS;

typedef struct _VM_COUNTERS
{
	ULONG	uPeakVirtualSize;
	ULONG	uVirtualSize;
	ULONG	uPageFaultCount;
	ULONG	uPeakWorkingSetSize;
	ULONG	uWorkingSetSize;
	ULONG	uQuotaPeakPagedPoolUsage;
	ULONG	uQuotaPagedPoolUsage;
	ULONG	uQuotaPeakNonPagedPoolUsage;
	ULONG	uQuotaNonPagedPoolUsage;
	ULONG	uPagefileUsage;
	ULONG	uPeakPagefileUsage;
} VM_COUNTERS, *PVM_COUNTERS;

typedef struct _KERNEL_USER_TIMES
{
	LARGE_INTEGER liCreateTime;
	LARGE_INTEGER liExitTime;
	LARGE_INTEGER liKernelTime;
	LARGE_INTEGER liUserTime;
} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;

typedef struct _BASE_PRIORITY_INFORMATION
{
	KPRIORITY	BasePriority;
} BASE_PRIORITY_INFORMATION, *PBASE_PRIORITY_INFORMATION;

typedef struct _AFFINITY_MASK
{
	KAFFINITY	AffinityMask;
} AFFINITY_MASK, *PAFFINITY_MASK;

typedef struct _TIME_FIELDS
{
	WORD	wYear;
	WORD	wMonth;
	WORD	wDay;
	WORD	wHour;
	WORD	wMinute;
	WORD	wSecond;
	WORD	wMilliseconds;
	WORD	wWeekday;
} TIME_FIELDS, *PTIME_FIELDS;

typedef void (*PIO_APC_ROUTINE)	(PVOID				ApcContext,
                                 PIO_STATUS_BLOCK	IoStatusBlock,
                                 ULONG				Reserved);

#if(_WIN32_WINNT < 0x0400)

typedef struct _NTFS_VOLUME_DATA_BUFFER
{
	LARGE_INTEGER	liSerialNumber;
	LARGE_INTEGER	liNumberOfSectors;
	LARGE_INTEGER	liTotalClusters;
	LARGE_INTEGER	liFreeClusters;
	LARGE_INTEGER	liReserved;
	ULONG			uBytesPerSector;
	ULONG			uBytesPerCluster;
	ULONG			uBytesPerMFTRecord;
	ULONG			uClustersPerMFTRecord;
	LARGE_INTEGER	liMFTLength;
	LARGE_INTEGER	liMFTStart;
	LARGE_INTEGER	liMFTMirrorStart;
	LARGE_INTEGER	liMFTZoneStart;
	LARGE_INTEGER	liMFTZoneEnd;
} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;

#endif

typedef struct _OBJDIR_INFORMATION
{
	UNICODE_STRING	ObjectName;
	UNICODE_STRING	ObjectTypeName; // e.g. Directory, Device ...
	UCHAR			Data[1];        // variable length
} OBJDIR_INFORMATION, *POBJDIR_INFORMATION;

// Define the file system information class values
typedef enum _FSINFOCLASS {
    FileFsVolumeInformation       = 1,
    FileFsLabelInformation,      // 2
    FileFsSizeInformation,       // 3
    FileFsDeviceInformation,     // 4
    FileFsAttributeInformation,  // 5
    FileFsControlInformation,    // 6
    FileFsFullSizeInformation,   // 7
    FileFsObjectIdInformation,   // 8
    FileFsMaximumInformation
} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;

typedef struct _FILE_FS_VOLUME_INFORMATION {
    LARGE_INTEGER VolumeCreationTime;
    ULONG VolumeSerialNumber;
    ULONG VolumeLabelLength;
    BOOLEAN SupportsObjects;
    WCHAR VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

typedef struct _FILE_FS_LABEL_INFORMATION {
    ULONG VolumeLabelLength;
    WCHAR VolumeLabel[1];
} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;

typedef struct _FILE_FS_SIZE_INFORMATION {
    LARGE_INTEGER TotalAllocationUnits;
    LARGE_INTEGER AvailableAllocationUnits;
    ULONG SectorsPerAllocationUnit;
    ULONG BytesPerSector;
} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;

typedef struct _FILE_FS_DEVICE_INFORMATION {
    DEVICE_TYPE DeviceType;
    ULONG Characteristics;
} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;

typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
    ULONG FileSystemAttributes;
    LONG MaximumComponentNameLength;
    ULONG FileSystemNameLength;
    WCHAR FileSystemName[1];
} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;

typedef struct _FILE_FS_CONTROL_INFORMATION {
    LARGE_INTEGER FreeSpaceStartFiltering;
    LARGE_INTEGER FreeSpaceThreshold;
    LARGE_INTEGER FreeSpaceStopFiltering;
    LARGE_INTEGER DefaultQuotaThreshold;
    LARGE_INTEGER DefaultQuotaLimit;
    ULONG FileSystemControlFlags;
} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;

typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
    LARGE_INTEGER TotalQuotaAllocationUnits;
    LARGE_INTEGER AvailableQuotaAllocationUnits;
    LARGE_INTEGER AvailableAllocationUnits;
    ULONG SectorsPerAllocationUnit;
    ULONG BytesPerSector;
} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;

typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
    GUID VolumeObjectId;
    ULONG VolumeObjectIdExtendedInfo[12];
} FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;

typedef enum _SYSTEMINFOCLASS
{
	SystemBasicInformation,             // 0x002C
	SystemProcessorInformation,         // 0x000C
	SystemPerformanceInformation,       // 0x0138
	SystemTimeInformation,              // 0x0020
	SystemPathInformation,              // not implemented
	SystemProcessInformation,           // 0x00C8+ per process
	SystemCallInformation,              // 0x0018 + (n * 0x0004)
	SystemConfigurationInformation,     // 0x0018
	SystemProcessorCounters,            // 0x0030 per cpu
	SystemGlobalFlag,                   // 0x0004 (fails if size != 4)
	SystemCallTimeInformation,          // not implemented
	SystemModuleInformation,            // 0x0004 + (n * 0x011C)
	SystemLockInformation,              // 0x0004 + (n * 0x0024)
	SystemStackTraceInformation,        // not implemented
	SystemPagedPoolInformation,         // checked build only
	SystemNonPagedPoolInformation,      // checked build only
	SystemHandleInformation,            // 0x0004  + (n * 0x0010)
	SystemObjectTypeInformation,        // 0x0038+ + (n * 0x0030+)
	SystemPageFileInformation,          // 0x0018+ per page file
	SystemVdmInstemulInformation,       // 0x0088
	SystemVdmBopInformation,            // invalid info class
	SystemCacheInformation,             // 0x0024
	SystemPoolTagInformation,           // 0x0004 + (n * 0x001C)
	SystemInterruptInformation,         // 0x0000, or 0x0018 per cpu
	SystemDpcInformation,               // 0x0014
	SystemFullMemoryInformation,        // checked build only
	SystemLoadDriver,                   // 0x0018, set mode only
	SystemUnloadDriver,                 // 0x0004, set mode only
	SystemTimeAdjustmentInformation,    // 0x000C, 0x0008 writeable
	SystemSummaryMemoryInformation,     // checked build only
	SystemNextEventIdInformation,       // checked build only
	SystemEventIdsInformation,          // checked build only
	SystemCrashDumpInformation,         // 0x0004
	SystemExceptionInformation,         // 0x0010
	SystemCrashDumpStateInformation,    // 0x0004
	SystemDebuggerInformation,          // 0x0002
	SystemContextSwitchInformation,     // 0x0030
	SystemRegistryQuotaInformation,     // 0x000C
	SystemAddDriver,                    // 0x0008, set mode only
	SystemPrioritySeparationInformation,// 0x0004, set mode only
	SystemPlugPlayBusInformation,       // not implemented
	SystemDockInformation,              // not implemented
	SystemPowerInfo,             // 0x0060 (XP only!)
	SystemProcessorSpeedInformation,    // 0x000C (XP only!)
	SystemTimeZoneInformation,          // 0x00AC
	SystemLookasideInformation,         // n * 0x0020
	SystemSetTimeSlipEvent,
    SystemCreateSession,				// set mode only
    SystemDeleteSession,				// set mode only
    SystemInvalidInfoClass1,			// invalid info class
    SystemRangeStartInformation,		// 0x0004 (fails if size != 4)
    SystemVerifierInformation,
    SystemAddVerifier,
    SystemSessionProcessesInformation,	// checked build only
	MaxSystemInfoClass
} SYSTEMINFOCLASS, *PSYSTEMINFOCLASS;

typedef struct _SYSTEM_BASIC_INFORMATION
{
    DWORD		dwUnknown1;               // 0
    ULONG		uKeMaximumIncrement;      // x86: 0x0002625A or 0x00018730
    ULONG		uPageSize;                // bytes
    ULONG		uMmNumberOfPhysicalPages;
    ULONG		uMmLowestPhysicalPage;
    ULONG		uMmHighestPhysicalPage;
    ULONG		uAllocationGranularity;   // bytes
    PVOID		pLowestUserAddress;
    PVOID		pMmHighestUserAddress;
    KAFFINITY	uKeActiveProcessors;
    BYTE		bKeNumberProcessors;
    BYTE		bUnknown2;
    WORD		wUnknown3;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_INFORMATION
{
	WORD	wKeProcessorArchitecture; // PROCESSOR_ARCHITECTURE_* (PROCESSOR_ARCHITECTURE_INTEL)
	WORD	wKeProcessorLevel;        // PROCESSOR_* (PROCESSOR_INTEL_PENTIUM)
	WORD	wKeProcessorRevision;     // Pentium: H=model, L=stepping
	WORD	wUnknown1;                // 0
	ULONG	uKeFeatureBits;
} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;

typedef struct _MM_INFO_COUNTERS
{
	ULONG	uPageFaults;
	ULONG	uWriteCopyFaults;
	ULONG	uTransistionFaults;
	ULONG	uCacheTransitionCount;
	ULONG	uDemandZeroFaults;
	ULONG	uPagesRead;
	ULONG	uPageReadIos;
	ULONG	uCacheReadCount;
	ULONG	uCacheIoCount;
	ULONG	uPagefilePagesWritten;
	ULONG	uPagefilePageWriteIos;
	ULONG	uMappedFilePagesWritten;
	ULONG	uMappedFilePageWriteIos;
} MM_INFO_COUNTERS, *PMM_INFO_COUNTERS;

typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
	LARGE_INTEGER		liIdleTime;             // 100 nsec units
	LARGE_INTEGER		liIoReadTransferCount;
	LARGE_INTEGER		liIoWriteTransferCount;
	LARGE_INTEGER		liIoOtherTransferCount;
	ULONG				uIoReadOperationCount;
	ULONG				uIoWriteOperationCount;
	ULONG				uIoOtherOperationCount;
	ULONG				uMmAvailablePages;
	ULONG				uMmTotalCommittedPages;
	ULONG				uMmTotalCommitLimit;   // pages
	ULONG				uMmPeakCommitLimit;    // pages
	MM_INFO_COUNTERS	MmInfoCounters;
	ULONG				uPoolPaged;            // pages
	ULONG				uPoolNonPaged;         // pages
	ULONG				uPagedPoolAllocs;
	ULONG				uPagedPoolFrees;
	ULONG				uNonPagedPoolAllocs;
	ULONG				uNonPagedPoolFrees;
	ULONG				uMmTotalFreeSystemPages;
	ULONG				uMmSystemCodePage;
	ULONG				uMmTotalSystemDriverPages;
	ULONG				uMmTotalSystemCodePages;
	ULONG				uSmallNonPagedLookasideListAllocateHits;
	ULONG				uSmallPagedLookasideListAllocateHits;
	DWORD				dwUnknown1;
	ULONG				uMmSystemCachePage;
	ULONG				uMmPagedPoolPage;
	ULONG				uMmSystemDriverPage;
	ULONG				uCcFastReadNoWait;
	ULONG				uCcFastReadWait;
	ULONG				uCcFastReadResourceMiss;
	ULONG				uCcFastReadNotPossible;
	ULONG				uCcFastMdlReadNoWait;
	ULONG				uCcFastMdlReadWait;
	ULONG				uCcFastMdlReadResourceMiss;
	ULONG				uCcFastMdlReadNotPossible;
	ULONG				uCcMapDataNoWait;
	ULONG				uCcMapDataWait;
	ULONG				uCcMapDataNoWaitMiss;
	ULONG				uCcMapDataWaitMiss;
	ULONG				uCcPinMappedDataCount;
	ULONG				uCcPinReadNoWait;
	ULONG				uCcPinReadWait;
	ULONG				uCcPinReadNoWaitMiss;
	ULONG				uCcPinReadWaitMiss;
	ULONG				uCcCopyReadNoWait;
	ULONG				uCcCopyReadWait;
	ULONG				uCcCopyReadNoWaitMiss;
	ULONG				uCcCopyReadWaitMiss;
	ULONG				uCcMdlReadNoWait;
	ULONG				uCcMdlReadWait;
	ULONG				uCcMdlReadNoWaitMiss;
	ULONG				uCcMdlReadWaitMiss;
	ULONG				uCcReadAheadIos;
	ULONG				uCcLazyWriteIos;
	ULONG				uCcLazyWritePages;
	ULONG				uCcDataFlushes;
	ULONG				uCcDataPages;
	ULONG				uTotalContextSwitches; // total across cpus
	ULONG				uFirstLevelTbFills;
	ULONG				uSecondLevelTbFills;
	ULONG				uSystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;

typedef struct _SYSTEM_TIME_INFORMATION
{
	LARGE_INTEGER	liKeBootTime;			// relative to 01-01-1601
	LARGE_INTEGER	liKeSystemTime;			// relative to 01-01-1601
	LARGE_INTEGER	liExpTimeZoneBias;		// utc time = local time + bias
	ULONG			uExpCurrentTimeZoneId;	// TIME_ZONE_ID_* (TIME_ZONE_ID_UNKNOWN, etc.)
	DWORD			dwUnknown1;
} SYSTEM_TIME_INFORMATION, *PSYSTEM_TIME_INFORMATION;

typedef enum
{
    StateInitialized,
    StateReady,
    StateRunning,
    StateStandby,
    StateTerminated,
    StateWait,
    StateTransition,
    StateUnknown
} THREAD_STATE;

typedef struct _SYSTEM_THREAD
{
	LARGE_INTEGER	liKernelTime;       // 100 nsec units
	LARGE_INTEGER	liUserTime;         // 100 nsec units
	LARGE_INTEGER	liCreateTime;       // relative to 01-01-1601
	ULONG			WaitTime;			// ticks
	PVOID			pStartAddress;		// EIP
	CLIENT_ID		Cid;				// process/thread ids
	KPRIORITY		Priority;
	KPRIORITY		BasePriority;
	ULONG			ContextSwitches;
	THREAD_STATE	ThreadState;
	KWAIT_REASON	WaitReason;
//	DWORD			dwUnknown2;			// maybe it not exists !!!
} SYSTEM_THREAD, *PSYSTEM_THREAD;

typedef struct _SYSTEM_PROCESS_INFORMATION
{
	ULONG			uNext;           // relative offset
	ULONG			uThreadCount;
	LARGE_INTEGER	liUnknown1;
	LARGE_INTEGER	liUnknown2;
	LARGE_INTEGER	liUnknown3;
	LARGE_INTEGER	liCreateTime;     // relative to 01-01-1601
	LARGE_INTEGER	liUserTime;       // 100 nsec units
	LARGE_INTEGER	liKernelTime;     // 100 nsec units
	UNICODE_STRING	usName;
	KPRIORITY		BasePriority;
	ULONG			uUniqueProcessId;
	ULONG			uInheritedFromUniqueProcessId;
	ULONG			uHandleCount;
	ULONG			uSessionId;      // W2K Only!
	DWORD			dwUnknown5;
	VM_COUNTERS		VmCounters;
	ULONG			uCommitCharge;   // bytes
	SYSTEM_THREAD	aST[];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

typedef struct _IO_COUNTERSEX
{
    LARGE_INTEGER	ReadOperationCount;
    LARGE_INTEGER	WriteOperationCount;
    LARGE_INTEGER	OtherOperationCount;
    LARGE_INTEGER	ReadTransferCount;
    LARGE_INTEGER	WriteTransferCount;
    LARGE_INTEGER	OtherTransferCount;
} IO_COUNTERSEX, *PIO_COUNTERSEX;

typedef struct _SYSTEM_PROCESS_INFORMATION_2000
{
	ULONG			uNext;           // relative offset
	ULONG			uThreadCount;
	LARGE_INTEGER	liUnknown1;
	LARGE_INTEGER	liUnknown2;
	LARGE_INTEGER	liUnknown3;
	LARGE_INTEGER	liCreateTime;     // relative to 01-01-1601
	LARGE_INTEGER	liUserTime;       // 100 nsec units
	LARGE_INTEGER	liKernelTime;     // 100 nsec units
	UNICODE_STRING	usName;
	KPRIORITY		BasePriority;
	ULONG			uUniqueProcessId;
	ULONG			uInheritedFromUniqueProcessId;
	ULONG			uHandleCount;
	ULONG			uSessionId;      // W2K Only!
	DWORD			dwUnknown5;
	VM_COUNTERS		VmCounters;
	ULONG			uCommitCharge;   // bytes
	IO_COUNTERSEX	IoCounters;
	SYSTEM_THREAD	aST[];
} SYSTEM_PROCESS_INFORMATION_2000, *PSYSTEM_PROCESS_INFORMATION_2000;

typedef struct _SYSTEM_CALL_INFORMATION
{
	ULONG	Length;
	ULONG	NumberOfTables;
//	ULONG	NumberOfEntries[NumberOfTables]
//	ULONG	CallCounts[NumberOfTables][NumberOfEntries];
} SYSTEM_CALL_INFORMATION, *PSYSTEM_CALL_INFORMATION;

typedef struct _SYSTEM_CONFIGURATION_INFORMATION
{
	ULONG	uDiskCount;
	ULONG	uFloppyCount;
	ULONG	uCDRomCount;
	ULONG	uTapeCount;
	ULONG	uSerialCount;         // com port with mouse not included
	ULONG	uParallelCount;
} SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_COUNTERS
{
	LARGE_INTEGER	liProcessorTime;       // 100 nsec units
	LARGE_INTEGER	liKernelTime;          // 100 nsec units
	LARGE_INTEGER	liUserTime;            // 100 nsec units
	LARGE_INTEGER	liDpcTime;             // 100 nsec units
	LARGE_INTEGER	liInterruptTime;       // 100 nsec units
	ULONG			uInterruptCount;
	DWORD			dwUnknown1;
} SYSTEM_PROCESSOR_COUNTERS, *PSYSTEM_PROCESSOR_COUNTERS;

typedef struct _SYSTEM_GLOBAL_FLAG
{
	ULONG	NtGlobalFlag;        // see Q147314, Q102985, Q105677
} SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG;

typedef struct _SYSTEM_CALL_TIME_INFORMATION
{
	ULONG			Length;
	ULONG			TotalCalls;
	LARGE_INTEGER	TimeOfCalls[1];
} SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION;

typedef struct _SYSTEM_MODULE
{
    ULONG	Reserved[2];
    ULONG	Base;
    ULONG	Size;
    ULONG	Flags;
    USHORT	Index;
    USHORT	Unknown;
    USHORT	LoadCount;
    USHORT	ModuleNameOffset;
    CHAR	ImageName[256];
} SYSTEM_MODULE, *PSYSTEM_MODULE;

typedef struct _SYSTEM_MODULE_INFORMATION
{
	ULONG			uCount;
	SYSTEM_MODULE	aSM[];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _SYSTEM_LOCK
{
	union
	{
		PERESOURCE_OLD	pEResourceOld;  // old ERESOURCE format
		PERESOURCE_LITE	pEResourceLite; // new "lite" format
		PERESOURCE		pEResource;     // current format
	};
	WORD	wUnknown1;                  // 1
	WORD	wUnknown2;                  // 0
	ULONG	ExclusiveOwnerThreadId;
	ULONG	uActiveCount;
	ULONG	uContentionCount;
	DWORD	dwUnknown3;
	DWORD	dwUnknown4;
	ULONG	uNumberOfSharedWaiters;
	ULONG	uNumberOfExclusiveWaiters;
} SYSTEM_LOCK, *PSYSTEM_LOCK;

typedef struct _SYSTEM_LOCK_INFORMATION
{
	ULONG		uCount;
	SYSTEM_LOCK	aSL[];
} SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION;

typedef struct _SYSTEM_HANDLE
{
	ULONG		uIdProcess;
	UCHAR		ObjectType;    // OB_TYPE_* (OB_TYPE_TYPE, etc.)
	UCHAR		Flags;         // HANDLE_FLAG_* (HANDLE_FLAG_INHERIT, etc.)
	USHORT		Handle;
	POBJECT		pObject;
	ACCESS_MASK	GrantedAccess;
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
	ULONG			uCount;
	SYSTEM_HANDLE	aSH[];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
{
	ULONG			NextEntryOffset;	// absolute offset
	ULONG			ObjectCount;
	ULONG			HandleCount;
	ULONG			TypeIndex;			// OB_TYPE_* (OB_TYPE_TYPE, etc.)
	ULONG			InvalidAttributes;	// OBJ_* (OBJ_INHERIT, etc.)
	GENERIC_MAPPING	GenericMapping;
	ACCESS_MASK		ValidAccessMask;
	POOL_TYPE		PoolType;
	BOOLEAN			SecurityRequired;
	BOOLEAN			WaitableObject;
	UNICODE_STRING	TypeName;
} SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;

// follows after SYSTEM_OBJECTTYPE_INFORMATION.TypeName
typedef struct _SYSTEM_OBJECT_INFORMATION
{
	ULONG					NextEntryOffset;		// absolute offset
	POBJECT					Object;
	ULONG					CreatorProcessId;
	USHORT					CreatorBackTraceIndex;
	USHORT					Flags;					// see "Native API Reference" page 24
	LONG					PointerCount;
	LONG					HandleCount;
	ULONG					PagedPoolCharge;
	ULONG					NonPagedPoolCharge;
	ULONG					ExclusiveProcessId;
	PSECURITY_DESCRIPTOR	SecurityDescriptor;
	UNICODE_STRING			ObjectName;
} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;

typedef struct _SYSTEM_PAGE_FILE_INFORMATION
{
	ULONG			NextEntryOffset;	// relative offset
	ULONG			CurrentSize;		// pages
	ULONG			TotalUsed;			// pages
	ULONG			PeakUsed;			// pages
	UNICODE_STRING	FileName;
} SYSTEM_PAGE_FILE_INFORMATION, *PSYSTEM_PAGE_FILE_INFORMATION;

typedef struct _SYSTEM_VDM_INSTEMUL_INFO
{
	BOOL	fExVdmSegmentNotPresent;
	ULONG	uOpcode0FV86;
	ULONG	uOpcodeESPrefixV86;
	ULONG	uOpcodeCSPrefixV86;
	ULONG	uOpcodeSSPrefixV86;
	ULONG	uOpcodeDSPrefixV86;
	ULONG	uOpcodeFSPrefixV86;
	ULONG	uOpcodeGSPrefixV86;
	ULONG	uOpcodeOPER32PrefixV86;
	ULONG	uOpcodeADDR32PrefixV86;
	ULONG	uOpcodeINSBV86;
	ULONG	uOpcodeINSWV86;
	ULONG	uOpcodeOUTSBV86;
	ULONG	uOpcodeOUTSWV86;
	ULONG	uOpcodePUSHFV86;
	ULONG	uOpcodePOPFV86;
	ULONG	uOpcodeINTnnV86;
	ULONG	uOpcodeINTOV86;
	ULONG	uOpcodeIRETV86;
	ULONG	uOpcodeINBimmV86;
	ULONG	uOpcodeINWimmV86;
	ULONG	uOpcodeOUTBimmV86;
	ULONG	uOpcodeOUTWimmV86;
	ULONG	uOpcodeINBV86;
	ULONG	uOpcodeINWV86;
	ULONG	uOpcodeOUTBV86;
	ULONG	uOpcodeOUTWV86;
	ULONG	uOpcodeLOCKPrefixV86;
	ULONG	uOpcodeREPNEPrefixV86;
	ULONG	uOpcodeREPPrefixV86;
	ULONG	uOpcodeHLTV86;
	ULONG	uOpcodeCLIV86;
	ULONG	uOpcodeSTIV86;
	ULONG	uVdmBopCount;
} SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;

typedef struct _SYSTEM_CACHE_INFORMATION
{
    ULONG uFileCache;           // bytes
	ULONG uFileCachePeak;       // bytes
    ULONG PageFaultCount;
    ULONG MinimumWorkingSet;
    ULONG MaximumWorkingSet;
    ULONG TransitionSharedPages;
    ULONG TransitionSharedPagesPeak;
    ULONG Reserved[2];
} SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;

typedef struct _SYSTEM_POOL_ENTRY
{
	BOOLEAN	Allocated;
	BOOLEAN	Spare0;
	USHORT	AllocatorBackTraceIndex;
	ULONG	Size;
	union
	{
		UCHAR	Tag[4];
		ULONG	TagUlong;
		PVOID	ProcessChargedQuota;
	};
} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;

typedef struct _SYSTEM_POOL_INFORMATION
{
	ULONG				TotalSize;
	PVOID				FirstEntry;
	USHORT				EntryOverhead;
	BOOLEAN				PoolTagPresent;
	BOOLEAN				Spare0;
	ULONG				NumberOfEntries;
	SYSTEM_POOL_ENTRY	Entries[1];
} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;

typedef struct _SYSTEM_POOL_TAG
{
	union
	{
		UCHAR	Tag[4];
		ULONG	TagUlong;
    };
	ULONG	PagedPoolAllocs;
	ULONG	PagedPoolFrees;
	ULONG	PagedPoolUsage;
	ULONG	NonPagedPoolAllocs;
	ULONG	NonPagedPoolFrees;
	ULONG	NonPagedPoolUsage;
} SYSTEM_POOL_TAG, *PSYSTEM_POOL_TAG;

typedef struct _SYSTEM_POOL_TAG_INFORMATION
{
	ULONG			uCount;
	SYSTEM_POOL_TAG	aSPT[];
} SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION;

typedef struct _SYSTEM_INTERRUPT_INFORMATION
{
	ULONG	ContextSwitches;
	ULONG	DpcCount;
	ULONG	DpcRate;
	ULONG	TimeIncrement;
	ULONG	DpcBypassCount;
	ULONG	ApcBypassCount;
} SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;

typedef struct _SYSTEM_DPC_INFORMATION
{
	DWORD	dwUnknown1;
	ULONG	MaximumDpcQueueDepth;
	ULONG	MinimumDpcRate;
	ULONG	AdjustDpcThreshold;
	ULONG	IdealDpcRate;
} SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION;

typedef struct _SYSTEM_MEMORY_INFO
{
	PUCHAR	StringOffset;
	USHORT	ValidCount;
	USHORT	TransitionCount;
	USHORT	ModifiedCount;
	USHORT	PageTableCount;
} SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;

typedef struct _SYSTEM_MEMORY_INFORMATION
{
	ULONG				InfoSize;
	ULONG				StringStart;
	SYSTEM_MEMORY_INFO	Memory[1];
} SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;

typedef struct _SYSTEM_LOAD_DRIVER
{
	UNICODE_STRING			DriverName;			// input
	PVOID					BaseAddress;		// output
	PVOID					SectionPointer;		// output
	PVOID					EntryPoint;			// output
	PIMAGE_EXPORT_DIRECTORY	ExportDirectory;	// output
} SYSTEM_LOAD_DRIVER, *PSYSTEM_LOAD_DRIVER;

typedef struct _SYSTEM_UNLOAD_DRIVER
{
	PVOID	SectionPointer;
} SYSTEM_UNLOAD_DRIVER, *PSYSTEM_UNLOAD_DRIVER;

typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT
{
	ULONG	TimeAdjustment;
	ULONG	MaximumIncrement;
	BOOLEAN	TimeSynchronization;
} SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT;

typedef struct _SYSTEM_SET_TIME_ADJUSTMENT
{
	ULONG	TimeAdjustment;
	BOOLEAN	TimeSynchronization;
} SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT;

typedef struct _SYSTEM_CRASH_DUMP_INFORMATION
{
	HANDLE	CrashDumpSectionHandle;
} SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION;

typedef struct _SYSTEM_CRASH_DUMP_INFORMATION_2000
{
	HANDLE	CrashDumpSectionHandle;
	HANDLE	Unknown;				// Windows 2000 only
} SYSTEM_CRASH_DUMP_INFORMATION_2000, *PSYSTEM_CRASH_DUMP_INFORMATION_2000;

typedef struct _SYSTEM_EXCEPTION_INFORMATION
{
	ULONG	AlignmentFixupCount;
	ULONG	ExceptionDispatchCount;
	ULONG	FloatingEmulationCount;
	ULONG	ByteWordEmulationCount;
} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;

typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION
{
	ULONG	ValidCrashDump;
} SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION;

typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000
{
	ULONG	ValidCrashDump;
	ULONG	Unknown;		// Windows 2000 only
} SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION_2000;

typedef struct _SYSTEM_DEBUGGER_INFORMATION
{
	BOOLEAN	KernelDebuggerEnabled;
	BOOLEAN	KernelDebuggerNotPresent;
} SYSTEM_DEBUGGER_INFORMATION, *PSYSTEM_DEBUGGER_INFORMATION;

typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
{
	ULONG	ContextSwitches;
	ULONG	FindAny;
	ULONG	FindLast;
	ULONG	FindIdeal;
	ULONG	IdleAny;
	ULONG	IdleCurrent;
	ULONG	IdleLast;
	ULONG	IdleIdeal;
	ULONG	PreemptAny;
	ULONG	PreemptCurrent;
	ULONG	PreemptLast;
	ULONG	SwitchToIdle;
} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;

typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
{
	ULONG	RegistryQuotaAllowed;	// bytes
	ULONG	RegistryQuotaUsed;		// bytes
	ULONG	PagedPoolSize;			// bytes
} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;

typedef struct _SYSTEM_ADD_DRIVER
{
	UNICODE_STRING	ModuleName;
} SYSTEM_ADD_DRIVER, *PSYSTEM_ADD_DRIVER;

typedef struct _SYSTEM_PRIORITY_SEPARATION_INFORMATION
{
	ULONG	PrioritySeparation;		// 0..2
} SYSTEM_PRIORITY_SEPARATION_INFORMATION, *PSYSTEM_PRIORITY_SEPARATION_INFORMATION;

#define MAX_BUS_NAME	24

typedef enum _PLUGPLAY_BUS_CLASS
{
	SystemBus,
	PlugPlayVirtualBus,
	MaxPlugPlayBusClass
} PLUGPLAY_BUS_CLASS, *PPLUGPLAY_BUS_CLASS;

typedef enum _PLUGPLAY_VIRTUAL_BUS_TYPE
{
	Root,
	MaxPlugPlayVirtualBusType
} PLUGPLAY_VIRTUAL_BUS_TYPE, *PPLUGPLAY_VIRTUAL_BUS_TYPE;

typedef enum _INTERFACE_TYPE
{
	InterfaceTypeUndefined = -1,
	Internal,
	Isa,
	Eisa,
	MicroChannel,
	TurboChannel,
	PCIBus,
	VMEBus,
	NuBus,
	PCMCIABus,
	CBus,
	MPIBus,
	MPSABus,
	ProcessorInternal,
	InternalPowerBus,
	PNPISABus,
	PNPBus,
	MaximumInterfaceType
}INTERFACE_TYPE, *PINTERFACE_TYPE;

typedef struct _PLUGPLAY_BUS_TYPE
{
	PLUGPLAY_BUS_CLASS	BusClass;
	union
	{
		INTERFACE_TYPE				SystemBusType;
		PLUGPLAY_VIRTUAL_BUS_TYPE	PlugPlayVirtualBusType;
    };
} PLUGPLAY_BUS_TYPE, *PPLUGPLAY_BUS_TYPE;

typedef struct _PLUGPLAY_BUS_INSTANCE
{
	PLUGPLAY_BUS_TYPE	BusType;
	ULONG				BusNumber;
	WCHAR				BusName[MAX_BUS_NAME];
} PLUGPLAY_BUS_INSTANCE, *PPLUGPLAY_BUS_INSTANCE;

typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
{
	ULONG					BusCount;
	PLUGPLAY_BUS_INSTANCE	BusInstance[1];
} SYSTEM_PLUGPLAY_BUS_INFORMATION, *PSYSTEM_PLUGPLAY_BUS_INFORMATION;

typedef enum _SYSTEM_DOCK_STATE
{
	SystemDockStateUnknown,
	SystemUndocked,
	SystemDocked
} SYSTEM_DOCK_STATE, *PSYSTEM_DOCK_STATE;

typedef struct _SYSTEM_DOCK_INFORMATION
{
	SYSTEM_DOCK_STATE	DockState;
	INTERFACE_TYPE		DeviceBusType;
	ULONG				DeviceBusNumber;
	ULONG				SlotNumber;
} SYSTEM_DOCK_INFORMATION, *PSYSTEM_DOCK_INFORMATION;

typedef struct _SYSTEM_POWER_INFORMATION	// not for SystemPowerInfo !
{
	BOOLEAN			SystemSuspendSupported;
	BOOLEAN			SystemHibernateSupported;
	BOOLEAN			ResumeTimerSupportsSuspend;
	BOOLEAN			ResumeTimerSupportsHibernate;
	BOOLEAN			LidSupported;
	BOOLEAN			TurboSettingSupported;
	BOOLEAN			TurboMode;
	BOOLEAN			SystemAcOrDc;
	BOOLEAN			PowerDownDisabled;
	LARGE_INTEGER	SpindownDrives;
} SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_SPEED_INFORMATION	// not for SystemProcessorSpeedInformation !
{
	ULONG	MaximumProcessorSpeed;
	ULONG	CurrentAvailableSpeed;
	ULONG	ConfiguredSpeedLimit;
	BOOLEAN	PowerLimit;
	BOOLEAN	ThermalLimit;
	BOOLEAN	TurboLimit;
} SYSTEM_PROCESSOR_SPEED_INFORMATION, *PSYSTEM_PROCESSOR_SPEED_INFORMATION;

typedef struct _SYSTEM_TIME_ZONE_INFORMATION
{
	LONG		Bias;
	WCHAR		StandardName[32];
	TIME_FIELDS	StandardDate;
	LONG		StandardBias;
	WCHAR		DaylightName[32];
	TIME_FIELDS	DaylightDate;
	LONG		DaylightBias;
} SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION;

typedef struct _SYSTEM_LOOKASIDE
{
	USHORT		Depth;
	USHORT		MaximumDepth;
	ULONG		TotalAllocates;
	ULONG		AllocateMisses;
	ULONG		TotalFrees;
	ULONG		FreeMisses;
	POOL_TYPE	Type;
	ULONG		Tag;
	ULONG		Size;
} SYSTEM_LOOKASIDE, *PSYSTEM_LOOKASIDE;

typedef struct _SYSTEM_LOOKASIDE_INFORMATION
{
	SYSTEM_LOOKASIDE	asl[];
} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;

typedef struct _SYSTEM_SET_TIME_SLIP_EVENT
{
	HANDLE	TimeSlipEvent;
} SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT;

typedef struct _SYSTEM_CREATE_SESSION
{
	ULONG	Session;
} SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION;

typedef struct _SYSTEM_DELETE_SESSION
{
	ULONG	Session;
} SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION;

typedef struct _SYSTEM_RANGE_START_INFORMATION
{
	PVOID	SystemRangeStart;
} SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
	IN SYSTEMINFOCLASS	SystemInformationClass,
	OUT PVOID			pSystemInformation,
	IN ULONG			uSystemInformationLength,
    OUT PULONG			puReturnLength OPTIONAL
	);

NTSYSAPI
NTSTATUS
NTAPI
NtSetSystemInformation(
	IN SYSTEMINFOCLASS	SystemInformationClass,
	IN PVOID			pSystemInformation,
	IN ULONG			uSystemInformationLength
	);

// Time functions
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySystemTime(
	OUT PLARGE_INTEGER	SystemTime
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetSystemTime(
	IN PLARGE_INTEGER	NewTime,
	OUT PLARGE_INTEGER	OldTime OPTIONAL
);

NTSYSAPI
VOID
NTAPI
RtlTimeToTimeFields(
	IN PLARGE_INTEGER	pliTime,
	OUT PTIME_FIELDS	pTimeFields
);

NTSYSAPI
BOOLEAN
NTAPI
RtlTimeFieldsToTime(
	IN	PTIME_FIELDS	pTimeFields,
	OUT PLARGE_INTEGER	pliTime
);

NTSYSAPI
VOID
NTAPI
RtlSecondsSince1970ToTime(
    IN ULONG			SecondsSince1970,
    OUT PLARGE_INTEGER	Time
);

NTSYSAPI
VOID
NTAPI
RtlTimeToSecondsSince1970(
	IN PLARGE_INTEGER	Time,
	OUT PULONG			SecondsSince1970
);

// Event functions
NTSYSAPI
NTSTATUS
NTAPI
NtOpenEvent(
	PHANDLE				phEvent,
	ACCESS_MASK			AccessMask,
	POBJECT_ATTRIBUTES	pObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtClearEvent(
	IN HANDLE	hEvent
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetEvent(
	IN HANDLE	hEvent,
	OUT PLONG	plSignaled OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtCreateSemaphore(
    OUT PHANDLE SemaphoreHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN LONG InitialCount,
    IN LONG MaximumCount
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenSemaphore(
    OUT PHANDLE SemaphoreHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtReleaseSemaphore(
    IN HANDLE SemaphoreHandle,
    IN LONG ReleaseCount,
    OUT PLONG PreviousCount OPTIONAL
);

typedef enum _SEMAPHORE_INFORMATION_CLASS
{
	SemaphoreBasicInformation
} SEMAPHORE_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySemaphore(
    IN HANDLE SemaphoreHandle,
    IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
    OUT PVOID SemaphoreInformation,
    IN ULONG SemaphoreInformationLength,
    OUT PULONG ResultLength OPTIONAL
);

typedef struct _SEMAPHORE_BASIC_INFORMATION
{
	LONG CurrentCount;
	LONG MaximumCount;
} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;

// Directory and Symbolic Link functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateDirectoryObject(
	OUT PHANDLE				phDirectory,
	IN ACCESS_MASK			AccessMask,
	IN POBJECT_ATTRIBUTES	pObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenDirectoryObject(
	OUT PHANDLE				DirectoryHandle,
	IN ACCESS_MASK			DesiredAccess,
	IN POBJECT_ATTRIBUTES	ObjectAttributes
);

typedef struct _DIRECTORY_CONTENTS
{
    struct
	{
        UNICODE_STRING Name;
        UNICODE_STRING Type;
    } Entry[ANYSIZE_ARRAY];
} DIRECTORY_CONTENTS, *PDIRECTORY_CONTENTS;

NTSYSAPI
NTSTATUS
NTAPI 
NtQueryDirectoryObject(
	IN HANDLE				DirectoryHandle,
	OUT PDIRECTORY_CONTENTS	Buffer,
	IN ULONG				Length,
	IN BOOLEAN				ReturnSingleEntry,
	IN BOOLEAN				RestartScan,
	IN OUT PULONG			Index,
	OUT PULONG				ResultLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenSymbolicLinkObject(
	OUT PHANDLE				SymbolicLinkHandle,
	IN ACCESS_MASK			DesiredAccess,
	IN POBJECT_ATTRIBUTES	ObjectAttributes
);

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(
	IN HANDLE			SymbolicLinkHandle,
	OUT PUNICODE_STRING	NameString,
	OUT PULONG			ResultLength OPTIONAL
);

// File functions
NTSYSAPI
NTSTATUS
NTAPI
NtCreateFile(
	PHANDLE				phFile,
	ACCESS_MASK			AccessMask,
	POBJECT_ATTRIBUTES	pObjectAttributes,
	PIO_STATUS_BLOCK	pIoStatusBlock,
	PLARGE_INTEGER		pliAllocationSize,
	ULONG				uFileAttributes,
	ULONG				uShareAccess,
	ULONG				uCreateDisposition,
	ULONG				uCreateOptions,
	PVOID				pEaBuffer,
	ULONG				uEaLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenFile(
	PHANDLE				phFile,
	ACCESS_MASK			AccessMask,

	POBJECT_ATTRIBUTES	pObjectAttributes,
	PIO_STATUS_BLOCK	pIoStatusBlock,
	ULONG				uShareAccess,
	ULONG				uOpenOptions
);

NTSYSAPI
NTSTATUS
NTAPI
NtDeleteFile(
	IN POBJECT_ATTRIBUTES	pObjectAttributes
);

typedef enum _FILE_INFORMATION_CLASS
{
    FileDirectoryInformation       = 1,
    FileFullDirectoryInformation, // 2
    FileBothDirectoryInformation, // 3
    FileBasicInformation,         // 4
    FileStandardInformation,      // 5
    FileInternalInformation,      // 6
    FileEaInformation,            // 7
    FileAccessInformation,        // 8
    FileNameInformation,          // 9
    FileRenameInformation,        // 10
    FileLinkInformation,          // 11
    FileNamesInformation,         // 12
    FileDispositionInformation,   // 13
    FilePositionInformation,      // 14
    FileFullEaInformation,        // 15
    FileModeInformation,          // 16
    FileAlignmentInformation,     // 17
    FileAllInformation,           // 18
    FileAllocationInformation,    // 19
    FileEndOfFileInformation,     // 20
    FileAlternateNameInformation, // 21
    FileStreamInformation,        // 22
    FilePipeInformation,          // 23
    FilePipeLocalInformation,     // 24
    FilePipeRemoteInformation,    // 25
    FileMailslotQueryInformation, // 26
    FileMailslotSetInformation,   // 27
    FileCompressionInformation,   // 28
    FileObjectIdInformation,      // 29
    FileCompletionInformation,    // 30
    FileMoveClusterInformation,   // 31
    FileInformationReserved32,    // 32
    FileInformationReserved33,    // 33
    FileNetworkOpenInformation,   // 34
    FileMaximumInformation
} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;

typedef struct _FILE_DIRECTORY_INFORMATION
{
    ULONG			NextEntryOffset;
    ULONG			FileIndex;
    LARGE_INTEGER	CreationTime;
    LARGE_INTEGER	LastAccessTime;
    LARGE_INTEGER	LastWriteTime;
    LARGE_INTEGER	ChangeTime;
    LARGE_INTEGER	EndOfFile;
    LARGE_INTEGER	AllocationSize;
    ULONG			FileAttributes;
    ULONG			FileNameLength;
    WCHAR			FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

typedef struct _FILE_FULL_DIR_INFORMATION
{
    ULONG			NextEntryOffset;
    ULONG			FileIndex;
    LARGE_INTEGER	CreationTime;
    LARGE_INTEGER	LastAccessTime;
    LARGE_INTEGER	LastWriteTime;
    LARGE_INTEGER	ChangeTime;
    LARGE_INTEGER	EndOfFile;
    LARGE_INTEGER	AllocationSize;
    ULONG			FileAttributes;
    ULONG			FileNameLength;
    ULONG			EaSize;
    WCHAR			FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

typedef struct _FILE_BOTH_DIR_INFORMATION
{
    ULONG			NextEntryOffset;
    ULONG			FileIndex;
    LARGE_INTEGER	CreationTime;
    LARGE_INTEGER	LastAccessTime;
    LARGE_INTEGER	LastWriteTime;
    LARGE_INTEGER	ChangeTime;
    LARGE_INTEGER	EndOfFile;
    LARGE_INTEGER	AllocationSize;
    ULONG			FileAttributes;
    ULONG			FileNameLength;
    ULONG			EaSize;
    CCHAR			ShortNameLength;
    WCHAR			ShortName[12];
    WCHAR			FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

typedef struct _FILE_BASIC_INFORMATION
{                    
    LARGE_INTEGER	CreationTime;                             
    LARGE_INTEGER	LastAccessTime;                           
    LARGE_INTEGER	LastWriteTime;                            
    LARGE_INTEGER	ChangeTime;                               
    ULONG			FileAttributes;                                   
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;         

typedef struct _FILE_STANDARD_INFORMATION
{                 
    LARGE_INTEGER	AllocationSize;                           
    LARGE_INTEGER	EndOfFile;                                
    ULONG			NumberOfLinks;                                    
    BOOLEAN			DeletePending;                                  
    BOOLEAN			Directory;                                      
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;   
                                                            
typedef struct _FILE_INTERNAL_INFORMATION
{
    LARGE_INTEGER	IndexNumber;
} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;

typedef struct _FILE_EA_INFORMATION
{
    ULONG	EaSize;
} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;

typedef struct _FILE_ACCESS_INFORMATION
{
    ACCESS_MASK	AccessFlags;
} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;

typedef struct _FILE_NAME_INFORMATION
{
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;

typedef struct _FILE_RENAME_INFORMATION
{
    BOOLEAN	ReplaceIfExists;
    HANDLE	RootDirectory;
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;

typedef struct _FILE_LINK_INFORMATION
{
    BOOLEAN	ReplaceIfExists;
    HANDLE	RootDirectory;
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;

typedef struct _FILE_NAMES_INFORMATION
{
    ULONG	NextEntryOffset;
    ULONG	FileIndex;
    ULONG	FileNameLength;
    WCHAR	FileName[1];
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;

typedef struct _FILE_ALLOCATION_INFORMATION
{
    LARGE_INTEGER	AllocationSize;
} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;

typedef struct _FILE_COMPRESSION_INFORMATION
{
    LARGE_INTEGER   CompressedFileSize;
    USHORT          CompressionFormat;
    UCHAR           CompressionUnitShift;
    UCHAR           ChunkShift;
    UCHAR           ClusterShift;
    UCHAR           Reserved[3];
} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;

typedef struct _FILE_COMPLETION_INFORMATION
{
    HANDLE  Port;
    ULONG   Key;
} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationFile(
    IN HANDLE					FileHandle,
    OUT PIO_STATUS_BLOCK		IoStatusBlock,
    OUT PVOID					FileInformation,
    IN ULONG					Length,
    IN FILE_INFORMATION_CLASS	FileInformationClass
);

NTSYSAPI
NTSTATUS

NTAPI
NtDeviceIoControlFile(
    IN HANDLE				FileHandle,
    IN HANDLE				Event OPTIONAL,
    IN PIO_APC_ROUTINE		ApcRoutine OPTIONAL,
    IN PVOID				ApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK	IoStatusBlock,
    IN ULONG				IoControlCode,
    IN PVOID				InputBuffer OPTIONAL,
    IN ULONG				InputBufferLength,
    OUT PVOID				OutputBuffer OPTIONAL,
    IN ULONG				OutputBufferLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtFsControlFile(
    IN HANDLE				FileHandle,
    IN HANDLE				Event OPTIONAL,
    IN PIO_APC_ROUTINE		ApcRoutine OPTIONAL,
    IN PVOID				ApcContext OPTIONAL,
    OUT PIO_STATUS_BLOCK	IoStatusBlock,
    IN ULONG				FsControlCode,
    IN PVOID				InputBuffer OPTIONAL,
    IN ULONG				InputBufferLength,
    OUT PVOID				OutputBuffer OPTIONAL,
    IN ULONG				OutputBufferLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtQueryVolumeInformationFile(
    IN HANDLE				FileHandle,
    OUT PIO_STATUS_BLOCK	IoStatusBlock,
    OUT PVOID				FsInformation,
    IN ULONG				Length,
    IN FS_INFORMATION_CLASS	FsInformationClass
);

NTSYSAPI
NTSTATUS
NTAPI
NtFlushBuffersFile(
    IN HANDLE				FileHandle,
    OUT PIO_STATUS_BLOCK	IoStatusBlock
);

// Process functions
#define NtCurrentProcess()				((HANDLE) -1)

NTSYSAPI
NTSTATUS
NTAPI
NtOpenProcess(
	OUT PHANDLE				phProcess,
	IN ACCESS_MASK			AccessMask,
	IN POBJECT_ATTRIBUTES	pObjectAttributes,
	IN PCLIENT_ID			pClientId
);

NTSYSAPI
NTSTATUS
NTAPI
NtCreateProcess(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN HANDLE InheritFromProcessHandle,
    IN BOOLEAN InheritHandles,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL
);

typedef enum _PROCESSINFOCLASS
{
	ProcessBasicInformation,
	ProcessQuotaLimits,			// QUOTA_LIMITS
	ProcessIoCounters,			// IOCOUNTERS
	ProcessVmCounters,			// VM_COUNTERS
	ProcessTimes,				// KERNEL_USER_TIMES
	ProcessBasePriority,		// BASE_PRIORITY_INFORMATION
	ProcessRaisePriority,
	ProcessDebugPort,
	ProcessExceptionPort,
	ProcessAccessToken,
	ProcessLdtInformation,
	ProcessLdtSize,
	ProcessDefaultHardErrorMode,
	ProcessIoPortHandlers,          // Note: this is kernel mode only
	ProcessPooledUsageAndLimits,
	ProcessWorkingSetWatch,
	ProcessUserModeIOPL,
	ProcessEnableAlignmentFaultFixup,
	ProcessPriorityClass,
	ProcessWx86Information,
	ProcessHandleCount,
	ProcessAffinityMask,		// AFFINITY_MASK
	ProcessPriorityBoost,
	ProcessDeviceMap,
    ProcessSessionInformation,
    ProcessForegroundInformation,
    ProcessWow64Information,
    MaxProcessInfoClass
} PROCESSINFOCLASS;

typedef struct _PROCESS_BASIC_INFORMATION
{
	NTSTATUS	ExitStatus;
	PPEB		PebBaseAddress;
	KAFFINITY	AffinityMask;
	KPRIORITY	BasePriority;
	ULONG		uUniqueProcessId;
	ULONG		uInheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;

typedef struct _PROCESS_RAISE_PRIORITY
{
	KPRIORITY	RaisePriority;
} PROCESS_RAISE_PRIORITY, *PPROCESS_RAISE_PRIORITY;

typedef struct _PROCESS_DEBUG_PORT_INFORMATION
{
	HANDLE	DebugPort;
} PROCESS_DEBUG_PORT_INFORMATION, *PPROCESS_DEBUG_PORT_INFORMATION;

typedef struct _PROCESS_EXCEPTION_PORT
{
	HANDLE	ExceptionPort;
} PROCESS_EXCEPTION_PORT, *PPROCESS_EXCEPTION_PORT;

typedef struct _PROCESS_ACCESS_TOKEN
{
	HANDLE	Token;
	HANDLE	Thread;
} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;

#ifndef _LDT_ENTRY_DEFINED
#define _LDT_ENTRY_DEFINED

typedef struct _LDT_ENTRY
{
    USHORT	LimitLow;
    USHORT	BaseLow;
    union
	{
        struct
		{
            UCHAR	BaseMid;
            UCHAR	Flags1;     // Declare as bytes to avoid alignment
            UCHAR	Flags2;     // Problems.
            UCHAR	BaseHi;
        } Bytes;

        struct
		{
            ULONG	BaseMid : 8;
            ULONG	Type : 5;
            ULONG	Dpl : 2;
            ULONG	Pres : 1;
            ULONG	LimitHi : 4;
            ULONG	Sys : 1;
            ULONG	Reserved_0 : 1;
            ULONG	Default_Big : 1;
            ULONG	Granularity : 1;
            ULONG	BaseHi : 8;
        } Bits;
    } HighWord;
} LDT_ENTRY, *PLDT_ENTRY;

#endif

#define LDT_TABLE_SIZE  (8 * 1024 * sizeof(LDT_ENTRY))

typedef struct _LDT_INFORMATION
{
    ULONG		Start;
    ULONG		Length;
    LDT_ENTRY	LdtEntries[1];
} PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;

typedef struct _LDT_SIZE
{
	ULONG	Length;
} PROCESS_LDT_SIZE, *PPROCESS_LDT_SIZE;

typedef struct _PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION
{
	ULONG	HardErrorMode;	// SEM_* (SEM_FAILCRITICALERRORS, etc.)
} PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION, *PPROCESS_DEFAULT_HARDERROR_MODE_INFORMATION;

typedef struct _PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION
{
	ULONG	PeakPagedPoolUsage;
	ULONG	PagedPoolUsage;
	ULONG	PagedPoolLimit;
	ULONG	PeakNonPagedPoolUsage;
	ULONG	NonPagedPoolUsage;
	ULONG	NonPagedPoolLimit;
	ULONG	PeakPagefileUsage;
	ULONG	PagefileUsage;
	ULONG	PagefileLimit;
} PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION, *PPROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION;

typedef struct _PROCESS_WS_WATCH_INFORMATION
{
	PVOID	FaultingPc;
	PVOID	FaultingVa;
} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;

typedef struct _PROCESS_IOPL
{
	ULONG	Iopl;
} PROCESS_IOPL, *PPROCESS_IOPL;

typedef struct _PROCESS_ALLIGNMENT_FAULT_FIXUP
{
	BOOLEAN	EnableAllignmentFaultFixup;
} PROCESS_ALLIGNMENT_FAULT_FIXUP, *PPROCESS_ALLIGNMENT_FAULT_FIXUP;

#define KRNL_NORMAL_PRIORITY_CLASS       0x02
#define KRNL_IDLE_PRIORITY_CLASS         0x01
#define KRNL_HIGH_PRIORITY_CLASS         0x03
#define KRNL_REALTIME_PRIORITY_CLASS     0x04

typedef struct _PROCESS_PRIORITY_CLASS_INFORMATION
{
	UCHAR	Unknown;
	UCHAR	PriorityClass;
} PROCESS_PRIORITY_CLASS_INFORMATION, *PPROCESS_PRIORITY_CLASS_INFORMATION;

typedef struct _PROCESS_X86_INFORMATION
{
	ULONG	x86Info;
} PROCESS_X86_INFORMATION, *PPROCESS_X86_INFORMATION;

typedef struct _PROCESS_HANDLE_COUNT_INFORMATION
{
	ULONG	HandleCount;
} PROCESS_HANDLE_COUNT_INFORMATION, *PPROCESS_HANDLE_COUNT_INFORMATION;

typedef struct _PROCESS_PRIORITY_BOOST_INFORMATION
{
	ULONG	PriorityBoostEnabled;
} PROCESS_PRIORITY_BOOST_INFORMATION, *PPROCESS_PRIORITY_BOOST_INFORMATION;

typedef struct _PROCESS_DEVICE_MAP_INFORMATION
{
    union
	{
        struct
		{
            HANDLE	DirectoryHandle;
        } Set;

        struct
		{
            ULONG	DriveMap;
            UCHAR	DriveType[32];
        } Query;
    };

} PROCESS_DEVICE_MAP_INFORMATION, *PPROCESS_DEVICE_MAP_INFORMATION;

typedef struct _PROCESS_SESSION_INFORMATION
{
    ULONG	SessionId;
} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationProcess(
    IN HANDLE			hProcess,
    IN PROCESSINFOCLASS	ProcessInformationClass,
    OUT PVOID			pProcessInformation,
    IN ULONG			uProcessInformationLength,
    OUT PULONG			puReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationProcess(
    IN HANDLE			hProcess,
    IN PROCESSINFOCLASS	ProcessInformationClass,
    OUT PVOID			pProcessInformation,
    IN ULONG			uProcessInformationLength
);

NTSTATUS
NTAPI
RtlCreateProcessParameters(
    OUT PPROCESS_PARAMETERS *ProcessParameters,
    IN PUNICODE_STRING ImageFile,
    IN PUNICODE_STRING DllPath OPTIONAL,
    IN PUNICODE_STRING CurrentDirectory OPTIONAL,
    IN PUNICODE_STRING CommandLine OPTIONAL,
    IN ULONG CreationFlags,
    IN PUNICODE_STRING WindowTitle OPTIONAL,
    IN PUNICODE_STRING Desktop OPTIONAL,
    IN PUNICODE_STRING Reserved OPTIONAL,
    IN PUNICODE_STRING Reserved2 OPTIONAL
);

NTSTATUS
NTAPI
RtlDestroyProcessParameters(
    IN PPROCESS_PARAMETERS ProcessParameters
);

// Thread functions
#define NtCurrentThread()				((HANDLE) -2)

typedef struct _USER_STACK
{
	PVOID	FixedStackBase;
	PVOID	FixedStackLimit;
	PVOID	ExpandableStackBase;
	PVOID	ExpandableStackLimit;
	PVOID	ExpandableStackBottom;
} USER_STACK, *PUSER_STACK;

NTSYSAPI
NTSTATUS
NTAPI
NtCreateThread(
    OUT PHANDLE				ThreadHandle,
    IN ACCESS_MASK			DesiredAccess,
    IN POBJECT_ATTRIBUTES	ObjectAttributes,
    IN HANDLE				ProcessHandle,
    OUT PCLIENT_ID			ClientId,
    IN PCONTEXT				ThreadContext,
    IN PUSER_STACK			UserStack,
    IN BOOLEAN				CreateSuspended
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenThread(
	OUT PHANDLE				phThread,
	IN ACCESS_MASK			AccessMask,
	IN POBJECT_ATTRIBUTES	pObjectAttributes,
	IN PCLIENT_ID			pClientId
);

NTSYSAPI
NTSTATUS
NTAPI
NtTerminateThread(
    IN HANDLE	ThreadHandle OPTIONAL,
    IN NTSTATUS	ExitStatus
);

NTSYSAPI
NTSTATUS
NTAPI
NtSuspendThread(
    IN HANDLE	ThreadHandle,
    OUT PULONG	PreviousSuspendCount OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtResumeThread(
    IN HANDLE	ThreadHandle,
    OUT PULONG	PreviousSuspendCount OPTIONAL
);

typedef enum _THREADINFOCLASS
{
	ThreadBasicInformation,
	ThreadTimes,				// KERNEL_USER_TIMES
	ThreadPriority,
	ThreadBasePriority,			// BASE_PRIORITY_INFORMATION
	ThreadAffinityMask,			// AFFINITY_MASK
	ThreadImpersonationToken,
	ThreadDescriptorTableEntry,
	ThreadEnableAlignmentFaultFixup,
	ThreadEventPair,
	ThreadQuerySetWin32StartAddress,
	ThreadZeroTlsCell,
	ThreadPerformanceCount,
	ThreadAmILastThread,
	ThreadIdealProcessor,
	ThreadPriorityBoost,
	ThreadSetTlsArrayAddress,
	ThreadIsIoPending,			// W2K
	ThreadHideFromDebugger,		// W2K
	MaxThreadInfoClass
} THREADINFOCLASS;

typedef struct _THREAD_BASIC_INFORMATION
{
    NTSTATUS	ExitStatus;
    PTEB		TebBaseAddress;
    CLIENT_ID	ClientId;
    KAFFINITY	AffinityMask;
    KPRIORITY	Priority;
    KPRIORITY	BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

typedef struct _THREAD_PRIORITY
{
	KPRIORITY	Priority;
} THREAD_PRIORITY, *PTHREAD_PRIORITY;

typedef struct _THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION
{
    ULONG		Selector;
    LDT_ENTRY	Descriptor;
} THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION, *PTHREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION;

typedef struct _THREAD_EVENTPAIR
{
	HANDLE	EventPair;
} THREAD_EVENTPAIR, *PTHREAD_EVENTPAIR;

typedef struct _THREAD_WIN32_START_ADDRESS_INFORMATION
{
	PVOID	Win32StartAddress;
} THREAD_WIN32_START_ADDRESS_INFORMATION, *PTHREAD_WIN32_START_ADDRESS_INFORMATION;

typedef struct _THREAD_ZERO_TLSCELL
{
	ULONG	TlsIndex;
} THREAD_ZERO_TLSCELL, *PTHREAD_ZERO_TLSCELL;

typedef struct _THREAD_PERFORMANCE_COUNTER_INFORMATION
{
	ULONG	Count1;
	ULONG	Count2;
} THREAD_PERFORMANCE_COUNTER_INFORMATION, *PTHREAD_PERFORMANCE_COUNTER_INFORMATION;

typedef struct _THREAD_AMI_LAST_THREAD
{
	ULONG	AmILastThread;
} THREAD_AMI_LAST_THREAD, *PTHREAD_AMI_LAST_THREAD;

typedef struct _THREAD_IDEAL_PROCESSOR
{
	ULONG	IdealProcessor;
} THREAD_IDEAL_PROCESSOR, *PTHREAD_IDEAL_PROCESSOR;

typedef struct _THREAD_TLS_ARRAY
{
	PULONG	TlsArray;
} THREAD_TLS_ARRAY, *PTHREAD_TLS_ARRAY;

typedef struct _THREAD_IS_IO_PENDING_INFORMATION
{
	ULONG	IsIOPending;
} THREAD_IS_IO_PENDING_INFORMATION, *PTHREAD_IS_IO_PENDING_INFORMATION;

typedef struct _THREAD_HIDE_FROM_DEBUGGER
{
	ULONG	HideFromDebugger;
} THREAD_HIDE_FROM_DEBUGGER, *PTHREAD_HIDE_FROM_DEBUGGER;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryInformationThread(
    IN HANDLE			hThread,
    IN THREADINFOCLASS	ThreadInformationClass,
    OUT PVOID			pThreadInformation,
    IN ULONG			uThreadInformationLength,
    OUT PULONG			puReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationThread(
	IN HANDLE			hThread,
	IN THREADINFOCLASS	ThreadInformationClass,
	OUT PVOID			pThreadInformation,
	IN ULONG			uthreadInformationLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenThreadToken(
	IN HANDLE	hThread,
	IN ACCESS_MASK	DesiredAccess,
	IN BOOLEAN		bOpenAsSelf,
	OUT PHANDLE		phToken
);

NTSYSAPI
NTSTATUS
NTAPI
NtImpersonateThread(
    IN HANDLE						ThreadHandle,
    IN HANDLE						TargetThreadHandle,
    IN PSECURITY_QUALITY_OF_SERVICE	SecurityQos
);

NTSYSAPI
NTSTATUS
NTAPI
NtGetContextThread(
    IN HANDLE		ThreadHandle,
    OUT PCONTEXT	Context
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetContextThread(
    IN HANDLE	ThreadHandle,
    IN PCONTEXT	Context
);

NTSYSAPI
NTSTATUS
NTAPI
NtQueueApcThread(
    IN HANDLE			ThreadHandle,
    IN PKNORMAL_ROUTINE	ApcRoutine,
    IN PVOID ApcContext	OPTIONAL,
    IN PVOID Argument1	OPTIONAL,
    IN PVOID Argument2	OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtImpersonateAnonymousToken(
	IN HANDLE	hThread
);

NTSYSAPI
NTSTATUS
NTAPI
NtCreateSection(
    OUT PHANDLE SectionHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN PLARGE_INTEGER SectionSize OPTIONAL,
    IN ULONG Protect,
    IN ULONG Attributes,
    IN HANDLE FileHandle
);

NTSYSAPI
NTSTATUS
NTAPI
NtOpenSection(
	OUT PHANDLE				SectionHandle,
	IN ACCESS_MASK			DesiredAccess,
	IN POBJECT_ATTRIBUTES	ObjectAttributes
);

typedef enum _SECTION_INFORMATION_CLASS
{
	SectionBasicInformation,
	SectionImageInformation
} SECTION_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySection(
    IN HANDLE SectionHandle,
    IN SECTION_INFORMATION_CLASS SectionInformationClass,
    OUT PVOID SectionInformation,
    IN ULONG SectionInformationLength,
    OUT PULONG ResultLength OPTIONAL
);

typedef struct _SECTION_BASIC_INFORMATION
{
	PVOID			BaseAddress;
	ULONG			Attributes;
	LARGE_INTEGER	Size;
} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;

typedef struct _SECTION_IMAGE_INFORMATION
{
	PVOID	EntryPoint;
	ULONG	Unknown1;
	ULONG	StackReserve;
	ULONG	StackCommit;
	ULONG	Subsystem;
	USHORT	MinorSubsystemVersion;
	USHORT	MajorSubsystemVersion;
	ULONG	Unknown2;
	ULONG	Characteristics;
	USHORT	ImageNumber;
	BOOLEAN	Executable;
	UCHAR	Unknown3;
	ULONG	Unknown4[3];
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
NtExtendSection(
	IN HANDLE SectionHandle,
	IN PLARGE_INTEGER SectionSize
);

NTSYSAPI
NTSTATUS
NTAPI
NtUnmapViewOfSection(
	IN HANDLE	hProcess,
	IN PVOID	pBaseAddress
);

NTSYSAPI
NTSTATUS
NTAPI
NtWaitForSingleObject(
	IN HANDLE			hObject,
	IN BOOL				fAlertable,
	IN PLARGE_INTEGER	pliTimeout   // NULL = infinite
);

// Object functions
typedef enum _OBJECT_INFORMATION_CLASS
{
	ObjectBasicInformation,             // 0    Y       N
	ObjectNameInformation,              // 1    Y       N
	ObjectTypeInformation,              // 2    Y       N
	ObjectAllTypesInformation,          // 3    Y       N
	ObjectHandleInformation             // 4    Y       Y
} OBJECT_INFORMATION_CLASS;

typedef struct _OBJECT_BASIC_INFORMATION
{
	ULONG			Attributes;
	ACCESS_MASK		GrantedAccess;
	ULONG			HandleCount;
	ULONG			PointerCount;
	ULONG			PagedPoolUsage;
	ULONG			NonPagedPoolUsage;
	ULONG			Reserved[3];
	ULONG			NameInformationLength;
	ULONG			TypeInformationLength;
	ULONG			SecurityDescriptorLength;
	LARGE_INTEGER	CreateTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

typedef struct _OBJECT_NAME_INFORMATION
{               
	UNICODE_STRING	Name;                                
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;   

typedef struct _OBJECT_TYPE_INFORMATION
{
	UNICODE_STRING	Name;
	ULONG			ObjectCount;
	ULONG			HandleCount;
	ULONG			Reserved1[4];
	ULONG			PeakObjectCount;
	ULONG			PeakHandleCount;
	ULONG			Reserved2[4];
	ULONG			InvalidAttributes;
	GENERIC_MAPPING	GenericMapping;
	ULONG			ValidAccess;
	UCHAR			Unknown;
	BOOLEAN			MaintainHandleDatabase;
	UCHAR			Reserved3[2];
	POOL_TYPE		PoolType;
	ULONG			PagedPoolUsage;
	ULONG			NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_ALL_TYPES_INFORMATION
{
	ULONG					NumberOfTypes;
	OBJECT_TYPE_INFORMATION	TypeInformation;
} OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;

typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION
{
	BOOLEAN	Inherit;
	BOOLEAN	ProtectFromClose;
} OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryObject(
	IN HANDLE ObjectHandle,
	IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
	OUT PVOID ObjectInformation,
	IN ULONG ObjectInformationLength,
	OUT PULONG ReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetInformationObject(
	IN HANDLE ObjectHandle,
	IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
	IN PVOID ObjectInformation,
	IN ULONG ObjectInformationLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtDuplicateObject(
	IN HANDLE SourceProcessHandle,
	IN HANDLE SourceHandle,
	IN HANDLE TargetProcessHandle OPTIONAL,
	OUT PHANDLE TargetHandle OPTIONAL,
	IN ACCESS_MASK DesiredAccess,
	IN ULONG HandleAttributes,
	IN ULONG Options
);

NTSYSAPI
NTSTATUS
NTAPI
NtQuerySecurityObject(
	IN HANDLE FileHandle,
	IN SECURITY_INFORMATION SecurityInformation,
	OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
	IN ULONG Length,
	OUT PULONG ResultLength
);

NTSYSAPI
NTSTATUS
NTAPI
NtSetSecurityObject(
	IN HANDLE FileHandle,
	IN SECURITY_INFORMATION SecurityInformation,
	IN PSECURITY_DESCRIPTOR SecurityDescriptor
);

// Memory management functions
NTSYSAPI
NTSTATUS
NTAPI
NtAllocateVirtualMemory(
	IN HANDLE ProcessHandle,
	IN OUT PVOID *BaseAddress,
	IN ULONG ZeroBits,
	IN OUT PULONG AllocationSize,
	IN ULONG AllocationType,
	IN ULONG Protect
);

typedef enum _MEMORY_INFORMATION_CLASS
{
	MemoryBasicInformation,
	MemoryWorkingSetList,
	MemorySectionName,
	MemoryBasicVlmInformation
} MEMORY_INFORMATION_CLASS;

NTSYSAPI
NTSTATUS
NTAPI
NtQueryVirtualMemory(
	IN HANDLE ProcessHandle,
	IN PVOID BaseAddress,
	IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
	OUT PVOID MemoryInformation,
	IN ULONG MemoryInformationLength,
	OUT PULONG ReturnLength OPTIONAL
);

/* Defined in Winnt.h
typedef struct _MEMORY_BASIC_INFORMATION
{
	PVOID	BaseAddress;
	PVOID	AllocationBase;
	ULONG	AllocationProtect;
	ULONG	RegionSize;
	ULONG	State;
	ULONG	Protect;
	ULONG	Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
*/

typedef struct _MEMORY_WORKING_SET_LIST
{
	ULONG	NumberOfPages;
	ULONG	WorkingSetList[1];
} MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;

typedef struct _MEMORY_SECTION_NAME
{
	UNICODE_STRING	SectionFileName;
} MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;

NTSYSAPI
NTSTATUS
NTAPI
NtReadVirtualMemory(
	IN HANDLE ProcessHandle,
	IN PVOID BaseAddress,
	OUT PVOID Buffer,
	IN ULONG BufferLength,
	OUT PULONG ReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtWriteVirtualMemory(
	IN HANDLE ProcessHandle,
	IN PVOID BaseAddress,
	IN PVOID Buffer,
	IN ULONG BufferLength,
	OUT PULONG ReturnLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
NtProtectVirtualMemory(
    IN HANDLE ProcessHandle,
    IN OUT PVOID *BaseAddress,
    IN OUT PULONG ProtectSize,
    IN ULONG NewProtect,
    OUT PULONG OldProtect
);

NTSYSAPI
NTSTATUS
NTAPI
NtFlushVirtualMemory(
    IN HANDLE ProcessHandle,
    IN OUT PVOID *BaseAddress,
    IN OUT PULONG FlushSize,
    OUT PIO_STATUS_BLOCK IoStatusBlock
);

// Ldr Functions
NTSYSAPI
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll(
	IN HANDLE hModule
);

// Rtl String Functions
NTSYSAPI
VOID
NTAPI
RtlInitUnicodeString (
    OUT PUNICODE_STRING DestinationString,
    IN PCWSTR SourceString
    );

NTSYSAPI
VOID
NTAPI
RtlCreateUnicodeString(
    OUT PUNICODE_STRING AllocatedString,
    IN PCWSTR SourceString
    );

NTSYSAPI
VOID
NTAPI
RtlFreeUnicodeString(
    IN PUNICODE_STRING UnicodeString
    );

NTSYSAPI
ULONG
NTAPI
RtlAnsiStringToUnicodeSize(
    IN PANSI_STRING AnsiString
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlAnsiStringToUnicodeString(
    OUT PUNICODE_STRING DestinationString,
    IN PANSI_STRING SourceString,
    IN BOOLEAN AllocateDestinationString
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlAppendUnicodeStringToString(
    OUT PUNICODE_STRING Destination,
    IN PUNICODE_STRING Source
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlAppendUnicodeToString(
    OUT PUNICODE_STRING Destination,
    IN PWSTR Source
    );

NTSYSAPI
LONG
NTAPI
RtlCompareUnicodeString(
    IN PUNICODE_STRING String1,
    IN PUNICODE_STRING String2,
    IN BOOLEAN CaseInSensitive
    );

NTSYSAPI
VOID
NTAPI
RtlCopyUnicodeString(
    OUT PUNICODE_STRING DestinationString,
    IN PUNICODE_STRING SourceString
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlDowncaseUnicodeString(
    OUT PUNICODE_STRING DestinationString,
    IN PUNICODE_STRING SourceString,
    IN BOOLEAN AllocateDestinationString
    );

NTSYSAPI
BOOLEAN
NTAPI
RtlEqualUnicodeString(
    IN PUNICODE_STRING String1,
    IN PUNICODE_STRING String2,
    IN BOOLEAN CaseInSensitive
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlIntegerToUnicodeString(
    IN ULONG Value,
    IN ULONG Base,
    OUT PUNICODE_STRING String
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlUnicodeStringToInteger(
    IN PUNICODE_STRING String,
    IN ULONG Base,
    OUT PULONG Value
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlOemStringToUnicodeString(
    OUT PUNICODE_STRING DestinationString,
    IN POEM_STRING SourceString,
    IN BOOLEAN AllocateDestinationString
    );

NTSYSAPI
BOOLEAN
NTAPI
RtlPrefixUnicodeString(
    IN PUNICODE_STRING String1,
    IN PUNICODE_STRING String2,
    IN BOOLEAN CaseInSensitive
    );

NTSYSAPI
WCHAR
NTAPI
RtlUpcaseUnicodeChar(
    IN WCHAR SourceCharacter
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlUpcaseUnicodeString(
    OUT PUNICODE_STRING DestinationString,
    IN PUNICODE_STRING SourceString,
    IN BOOLEAN AllocateDestinationString
    );

NTSYSAPI
ULONG
NTAPI
RtlxAnsiStringToUnicodeSize(
    IN PANSI_STRING AnsiString
    );

NTSYSAPI
ULONG
NTAPI
RtlxOemStringToUnicodeSize(
    IN POEM_STRING OemString
    );

// Rtl Misc Operations
NTSYSAPI
NTSTATUS
NTAPI
NtReplyPort(
	IN HANDLE	hPort,
	OUT PVOID	pReply
);

NTSYSAPI
NTSTATUS
NTAPI
NtClose(
	IN HANDLE	hObject
);

NTSYSAPI
ULONG
NTAPI
RtlNtStatusToDosError(
	NTSTATUS	status
);

NTSYSAPI
UINT
NTAPI
RtlGetLongestNtPathLength();

NTSYSAPI
UINT
NTAPI
RtlDetermineDosPathNameType_U(
	IN PWSTR	Path
);

NTSYSAPI
UINT
NTAPI
RtlIsDosDeviceName_U(
	IN PWSTR	Path
);

NTSYSAPI
BOOLEAN
NTAPI
RtlDosPathNameToNtPathName_U(
    IN PCWSTR			DosName,
    OUT PUNICODE_STRING	NtName,
    OUT PCWSTR			*DosFilePath OPTIONAL,
    OUT PUNICODE_STRING	NtFilePath OPTIONAL
);

// Rtl Large Integer Operations

#define RtlLargeIntegerLessThanZero($a)	(($a).HighPart < 0)
#define Li2Double(x)					((double)((x).HighPart) * 4.294967296E9 + (double)((x).LowPart))

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlEnlargedIntegerMultiply(
	IN LONG lMultiplicand,
	IN LONG lMultiplier
	);

NTSYSAPI
ULONG
NTAPI
RtlEnlargedUnsignedDivide(
	IN LARGE_INTEGER	liDividend,
	IN ULONG			uDivisor,
	OUT PULONG			puRemainder OPTIONAL
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlEnlargedUnsignedMultiply(
	IN ULONG	uMultiplicand,
	IN ULONG	uMultiplier
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlExtendedIntegerMultiply(
	IN LARGE_INTEGER	liMultiplicand,
	IN LONG				lMultiplier
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlExtendedLargeIntegerDivide(
	IN LARGE_INTEGER	liDividend,
	IN ULONG			uDivisor,
	OUT PULONG			puRemainder OPTIONAL
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerAdd(
	IN LARGE_INTEGER	liAddend1,
	IN LARGE_INTEGER	liAddend2
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerDivide(
	IN LARGE_INTEGER	liDividend,
	IN LARGE_INTEGER	liDivisor,
	OUT PLARGE_INTEGER	pliRemainder OPTIONAL
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerNegate(
	IN LARGE_INTEGER	liSubtrahend
	);

NTSYSAPI
LARGE_INTEGER
NTAPI
RtlLargeIntegerSubtract(
	IN LARGE_INTEGER	liMinuend,
	IN LARGE_INTEGER	liSubtrahend
	);

// Debug Functions
typedef struct _DEBUG_BUFFER
{
    HANDLE	SectionHandle;
    PVOID	SectionBase;
    PVOID	RemoteSectionBase;
    ULONG	SectionBaseDelta;
    HANDLE	EventPairHandle;
    ULONG	Unknown[2];
    HANDLE	RemoteThreadHandle;
    ULONG	InfoClassMask;
    ULONG	SizeOfInfo;
    ULONG	AllocatedSize;
    ULONG	SectionSize;
    PVOID	ModuleInformation;
    PVOID	BackTraceInformation;
    PVOID	HeapInformation;
    PVOID	LockInformation;
    PVOID	Reserved[8];
} DEBUG_BUFFER, *PDEBUG_BUFFER;

#define PDI_MODULES		0x01
#define PDI_BACKTRACE	0x02
#define PDI_HEAPS		0x04
#define PDI_HEAP_TAGS	0x08
#define PDI_HEAP_BLOCKS	0x10
#define PDI_LOCKS		0x20

typedef struct _DEBUG_MODULE_INFORMATION // c.f. SYSTEM_MODULE_INFORMATION
{
    ULONG	Reserved[2];
    ULONG	Base;
    ULONG	Size;
    ULONG	Flags;
    USHORT	Index;
    USHORT	Unknown;
    USHORT	LoadCount;
    USHORT	ModuleNameOffset;
    CHAR	ImageName[256];
} DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;

typedef struct _DEBUG_HEAP_INFORMATION
{
    ULONG	Base;
    ULONG	Flags;
    USHORT	Granularity;
    USHORT	Unknown;
    ULONG	Allocated;
    ULONG	Committed;
    ULONG	TagCount;
    ULONG	BlockCount;
    ULONG	Reserved[7];
    PVOID	Tags;
    PVOID	Blocks;
} DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;

typedef struct _DEBUG_LOCK_INFORMATION // c.f. SYSTEM_LOCK_INFORMATION
{
    PVOID	Address;
    USHORT	Type;
    USHORT	CreatorBackTraceIndex;
    ULONG	OwnerThreadId;
    ULONG	ActiveCount;
    ULONG	ContentionCount;
    ULONG	EntryCount;
    ULONG	RecursionCount;
    ULONG	NumberOfSharedWaiters;
    ULONG	NumberOfExclusiveWaiters;
} DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;


NTSYSAPI
PDEBUG_BUFFER
NTAPI
RtlCreateQueryDebugBuffer(
    IN ULONG Size,
    IN BOOLEAN EventPair
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlQueryProcessDebugInformation(
    IN ULONG ProcessId,
    IN ULONG DebugInfoClassMask,
    IN OUT PDEBUG_BUFFER DebugBuffer
    );

NTSYSAPI
NTSTATUS
NTAPI
RtlDestroyQueryDebugBuffer(
    IN PDEBUG_BUFFER DebugBuffer
    );

NTSYSAPI
NTSTATUS
NTAPI
NtLoadDriver(
    // "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>"
	IN PUNICODE_STRING RegistryPath
);

NTSYSAPI
NTSTATUS
NTAPI
NtUnloadDriver(
    // "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>"
	IN PUNICODE_STRING RegistryPath
);

NTSYSAPI
NTSTATUS
NTAPI
RtlAdjustPrivilege(
	IN ULONG Privilege,
	IN BOOLEAN NewValue,
	IN BOOLEAN ForThread,
	OUT PBOOLEAN OldValue
);

#ifdef __cplusplus
}

#pragma warning(default : 4200)

#endif
#endif