struct _DEVICE_OBJECT; struct _DRIVER_EXTENSION; struct _DRIVER_OBJECT; struct _IO_STACK_LOCATION; struct _IRP; struct _KAPC; struct _KDPC; typedef enum { BusQueryDeviceID, BusQueryHardwareIDs, BusQueryCompatibleIDs, BusQueryInstanceID, BusQueryDeviceSerialNumber } BUS_QUERY_ID_TYPE; typedef char CCHAR; typedef char CHAR; typedef short CSHORT; typedef enum { DeviceTextDescription, DeviceTextLocationInformation } DEVICE_TEXT_TYPE; typedef void *HANDLE; typedef long LONG; typedef __int64 LONGLONG; typedef const char *PCSZ; typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT; typedef void (*PDRIVER_CANCEL)(struct _DEVICE_OBJECT *DeviceObject, struct _IRP *Irp); typedef struct _DRIVER_EXTENSION *PDRIVER_EXTENSION; typedef void (*PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *DriverObject); typedef void (*PFAST_IO_DETACH_DEVICE)(struct _DEVICE_OBJECT *SourceDevice, struct _DEVICE_OBJECT *TargetDevice); typedef void (*PKRUNDOWN_ROUTINE)(struct _KAPC *Apc); typedef enum { PowerActionNone, PowerActionReserved, PowerActionSleep, PowerActionHibernate, PowerActionShutdown, PowerActionShutdownReset, PowerActionShutdownOff, PowerActionWarmEject } POWER_ACTION; typedef unsigned long *PULONG_PTR; typedef void *PVOID; typedef short SHORT; typedef unsigned char UCHAR; typedef unsigned long ULONG; typedef unsigned long ULONG_PTR; typedef unsigned short USHORT; struct _COMPRESSED_DATA_INFO; enum _DEVICE_POWER_STATE { PowerDeviceUnspecified, PowerDeviceD0, PowerDeviceD1, PowerDeviceD2, PowerDeviceD3, PowerDeviceMaximum }; enum _DEVICE_RELATION_TYPE { BusRelations, EjectionRelations, PowerRelations, RemovalRelations, TargetDeviceRelation, SingleBusRelations }; enum _DEVICE_USAGE_NOTIFICATION_TYPE { DeviceUsageTypeUndefined, DeviceUsageTypePaging, DeviceUsageTypeHibernation, DeviceUsageTypeDumpFile }; struct _EPROCESS; struct _ETHREAD; enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation, FileBothDirectoryInformation, FileBasicInformation, FileStandardInformation, FileInternalInformation, FileEaInformation, FileAccessInformation, FileNameInformation, FileRenameInformation, FileLinkInformation, FileNamesInformation, FileDispositionInformation, FilePositionInformation, FileFullEaInformation, FileModeInformation, FileAlignmentInformation, FileAllInformation, FileAllocationInformation, FileEndOfFileInformation, FileAlternateNameInformation, FileStreamInformation, FilePipeInformation, FilePipeLocalInformation, FilePipeRemoteInformation, FileMailslotQueryInformation, FileMailslotSetInformation, FileCompressionInformation, FileObjectIdInformation, FileCompletionInformation, FileMoveClusterInformation, FileQuotaInformation, FileReparsePointInformation, FileNetworkOpenInformation, FileAttributeTagInformation, FileTrackingInformation, FileIdBothDirectoryInformation, FileIdFullDirectoryInformation, FileValidDataLengthInformation, FileShortNameInformation, FileMaximumInformation }; enum _FSINFOCLASS { FileFsVolumeInformation = 1, FileFsLabelInformation, FileFsSizeInformation, FileFsDeviceInformation, FileFsAttributeInformation, FileFsControlInformation, FileFsFullSizeInformation, FileFsObjectIdInformation, FileFsDriverPathInformation, FileFsMaximumInformation }; struct _GUID { unsigned long Data1; unsigned short Data2; unsigned short Data3; unsigned char Data4[8]; }; enum _INTERFACE_TYPE { InterfaceTypeUndefined = 4294967295, Internal, Isa, Eisa, MicroChannel, TurboChannel, PCIBus, VMEBus, NuBus, PCMCIABus, CBus, MPIBus, MPSABus, ProcessorInternal, InternalPowerBus, PNPISABus, PNPBus, MaximumInterfaceType }; enum _IO_ALLOCATION_ACTION { KeepObject = 1, DeallocateObject, DeallocateObjectKeepRegisters }; struct _IO_TIMER; struct _KTHREAD; struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; }; enum _POOL_TYPE { NonPagedPool, PagedPool, NonPagedPoolMustSucceed, DontUseThisType, NonPagedPoolCacheAligned, PagedPoolCacheAligned, NonPagedPoolCacheAlignedMustS, MaxPoolType, NonPagedPoolSession = 32, PagedPoolSession, NonPagedPoolMustSucceedSession, DontUseThisTypeSession, NonPagedPoolCacheAlignedSession, PagedPoolCacheAlignedSession, NonPagedPoolCacheAlignedMustSSession }; enum _POWER_STATE_TYPE { SystemPowerState, DevicePowerState }; struct _SCSI_REQUEST_BLOCK; enum _SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous, SecurityIdentification, SecurityImpersonation, SecurityDelegation }; enum _SYSTEM_POWER_STATE { PowerSystemUnspecified, PowerSystemWorking, PowerSystemSleeping1, PowerSystemSleeping2, PowerSystemSleeping3, PowerSystemHibernate, PowerSystemShutdown, PowerSystemMaximum }; typedef unsigned int size_t; typedef char *va_list; typedef unsigned short wchar_t; typedef ULONG ACCESS_MASK; typedef UCHAR BOOLEAN; typedef enum _DEVICE_POWER_STATE DEVICE_POWER_STATE; typedef enum _DEVICE_RELATION_TYPE DEVICE_RELATION_TYPE; typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE DEVICE_USAGE_NOTIFICATION_TYPE; typedef ULONG_PTR ERESOURCE_THREAD; __stdcall void ExFreePoolWithTag(PVOID P, ULONG Tag); typedef enum _FILE_INFORMATION_CLASS FILE_INFORMATION_CLASS; typedef enum _FSINFOCLASS FS_INFORMATION_CLASS; typedef struct _GUID GUID; typedef enum _INTERFACE_TYPE INTERFACE_TYPE; typedef enum _IO_ALLOCATION_ACTION IO_ALLOCATION_ACTION; __stdcall void IoDeleteDevice(PDEVICE_OBJECT DeviceObject); typedef ULONG_PTR KAFFINITY; typedef UCHAR KIRQL; typedef CCHAR KPROCESSOR_MODE; typedef ULONG_PTR KSPIN_LOCK; __stdcall void KeBugCheckEx __attribute__((noreturn))(ULONG BugCheckCode, ULONG_PTR BugCheckParameter1, ULONG_PTR BugCheckParameter2, ULONG_PTR BugCheckParameter3, ULONG_PTR BugCheckParameter4); typedef ULONG LCID; typedef struct _LIST_ENTRY LIST_ENTRY; typedef LONG NTSTATUS; typedef PVOID PACCESS_TOKEN; typedef CHAR *PCH; typedef CHAR *PCHAR; typedef struct _EPROCESS *PEPROCESS; typedef struct _ETHREAD *PETHREAD; typedef void (*PINTERFACE_DEREFERENCE)(PVOID Context); typedef void (*PINTERFACE_REFERENCE)(PVOID Context); typedef struct _IO_TIMER *PIO_TIMER; typedef void (*PKDEFERRED_ROUTINE)(struct _KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2); typedef void (*PKNORMAL_ROUTINE)(PVOID NormalContext, PVOID SystemArgument1, PVOID SystemArgument2); typedef enum _POOL_TYPE POOL_TYPE; typedef enum _POWER_STATE_TYPE POWER_STATE_TYPE; typedef PVOID PSECURITY_DESCRIPTOR; typedef enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL; typedef ULONG SECURITY_INFORMATION; typedef ULONG_PTR SIZE_T; typedef enum _SYSTEM_POWER_STATE SYSTEM_POWER_STATE; typedef wchar_t WCHAR; struct _DEVOBJ_EXTENSION { CSHORT Type; USHORT Size; PDEVICE_OBJECT DeviceObject; }; struct _FLOATING_SAVE_AREA { ULONG ControlWord; ULONG StatusWord; ULONG TagWord; ULONG ErrorOffset; ULONG ErrorSelector; ULONG DataOffset; ULONG DataSelector; UCHAR RegisterArea[80]; ULONG Cr0NpxState; }; struct _IO_COMPLETION_CONTEXT { PVOID Port; PVOID Key; }; struct _KSYSTEM_TIME { ULONG LowPart; LONG High1Time; LONG High2Time; }; union _LARGE_INTEGER { struct { ULONG LowPart; LONG HighPart; }; struct { ULONG LowPart; LONG HighPart; } u; LONGLONG QuadPart; }; struct _LUID { ULONG LowPart; LONG HighPart; }; struct _MDL { struct _MDL *Next; CSHORT Size; CSHORT MdlFlags; struct _EPROCESS *Process; PVOID MappedSystemVa; PVOID StartVa; ULONG ByteCount; ULONG ByteOffset; }; struct _POWER_SEQUENCE { ULONG SequenceD1; ULONG SequenceD2; ULONG SequenceD3; }; struct _SECTION_OBJECT_POINTERS { PVOID DataSectionObject; PVOID SharedCacheMap; PVOID ImageSectionObject; }; __cdecl int _vsnprintf(char*, size_t, const char*, va_list); __cdecl void *memcpy(void*, const void*, size_t); __cdecl void *memset(void*, int, size_t); __cdecl int vsprintf(char*, const char*, va_list); __cdecl ULONG DbgPrint(PCH Format, ...); __stdcall PVOID ExAllocatePool(POOL_TYPE PoolType, SIZE_T NumberOfBytes); typedef struct _FLOATING_SAVE_AREA FLOATING_SAVE_AREA; typedef struct _KSYSTEM_TIME KSYSTEM_TIME; typedef union _LARGE_INTEGER LARGE_INTEGER; typedef struct _LUID LUID; typedef const WCHAR *PCWSTR; typedef struct _IO_COMPLETION_CONTEXT *PIO_COMPLETION_CONTEXT; typedef void (*PKKERNEL_ROUTINE)(struct _KAPC *Apc, PKNORMAL_ROUTINE *NormalRoutine, PVOID *NormalContext, PVOID *SystemArgument1, PVOID *SystemArgument2); typedef struct _MDL *PMDL; typedef struct _POWER_SEQUENCE *PPOWER_SEQUENCE; typedef WCHAR *PWSTR; typedef struct _SECTION_OBJECT_POINTERS SECTION_OBJECT_POINTERS; typedef BOOLEAN SECURITY_CONTEXT_TRACKING_MODE; struct _DEVICE_CAPABILITIES { USHORT Size; USHORT Version; ULONG DeviceD1:1; ULONG DeviceD2:1; ULONG LockSupported:1; ULONG EjectSupported:1; ULONG Removable:1; ULONG DockDevice:1; ULONG UniqueID:1; ULONG SilentInstall:1; ULONG RawDeviceOK:1; ULONG SurpriseRemovalOK:1; ULONG WakeFromD0:1; ULONG WakeFromD1:1; ULONG WakeFromD2:1; ULONG WakeFromD3:1; ULONG HardwareDisabled:1; ULONG NonDynamic:1; ULONG WarmEjectSupported:1; ULONG NoDisplayInUI:1; ULONG Reserved:14; ULONG Address; ULONG UINumber; DEVICE_POWER_STATE DeviceState[7]; SYSTEM_POWER_STATE SystemWake; DEVICE_POWER_STATE DeviceWake; ULONG D1Latency; ULONG D2Latency; ULONG D3Latency; }; struct _DISPATCHER_HEADER { UCHAR Type; UCHAR Absolute; UCHAR Size; UCHAR Inserted; LONG SignalState; LIST_ENTRY WaitListHead; }; struct _INTERFACE { USHORT Size; USHORT Version; PVOID Context; PINTERFACE_REFERENCE InterfaceReference; PINTERFACE_DEREFERENCE InterfaceDereference; }; struct _IO_STATUS_BLOCK { union { NTSTATUS Status; PVOID Pointer; }; ULONG_PTR Information; }; struct _KDEVICE_QUEUE { CSHORT Type; CSHORT Size; LIST_ENTRY DeviceListHead; KSPIN_LOCK Lock; BOOLEAN Busy; }; struct _KDEVICE_QUEUE_ENTRY { LIST_ENTRY DeviceListEntry; ULONG SortKey; BOOLEAN Inserted; }; struct _KDPC { CSHORT Type; UCHAR Number; UCHAR Importance; LIST_ENTRY DpcListEntry; PKDEFERRED_ROUTINE DeferredRoutine; PVOID DeferredContext; PVOID SystemArgument1; PVOID SystemArgument2; PULONG_PTR Lock; }; struct _OWNER_ENTRY { ERESOURCE_THREAD OwnerThread; union { LONG OwnerCount; ULONG TableSize; }; }; union _POWER_STATE { SYSTEM_POWER_STATE SystemState; DEVICE_POWER_STATE DeviceState; }; struct _SECURITY_SUBJECT_CONTEXT { PACCESS_TOKEN ClientToken; SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; PACCESS_TOKEN PrimaryToken; PVOID ProcessAuditId; }; struct _STRING { USHORT Length; USHORT MaximumLength; PCHAR Buffer; }; struct _VPB { CSHORT Type; CSHORT Size; USHORT Flags; USHORT VolumeLabelLength; struct _DEVICE_OBJECT *DeviceObject; struct _DEVICE_OBJECT *RealDevice; ULONG SerialNumber; ULONG ReferenceCount; WCHAR VolumeLabel[32]; }; typedef struct _DISPATCHER_HEADER DISPATCHER_HEADER; typedef struct _IO_STATUS_BLOCK IO_STATUS_BLOCK; typedef struct _KDEVICE_QUEUE KDEVICE_QUEUE; typedef struct _KDEVICE_QUEUE_ENTRY KDEVICE_QUEUE_ENTRY; typedef struct _KDPC KDPC; extern volatile KSYSTEM_TIME KeTickCount; typedef struct _OWNER_ENTRY OWNER_ENTRY; typedef struct _DEVICE_CAPABILITIES *PDEVICE_CAPABILITIES; typedef LARGE_INTEGER PHYSICAL_ADDRESS; typedef struct _INTERFACE *PINTERFACE; typedef struct _IO_STATUS_BLOCK *PIO_STATUS_BLOCK; typedef struct _KDPC *PKDPC; typedef LARGE_INTEGER *PLARGE_INTEGER; typedef union _POWER_STATE POWER_STATE; typedef struct _OWNER_ENTRY *POWNER_ENTRY; typedef SECTION_OBJECT_POINTERS *PSECTION_OBJECT_POINTERS; typedef struct _VPB *PVPB; typedef struct _SECURITY_SUBJECT_CONTEXT SECURITY_SUBJECT_CONTEXT; typedef struct _STRING STRING; struct _CONTEXT { ULONG ContextFlags; ULONG Dr0; ULONG Dr1; ULONG Dr2; ULONG Dr3; ULONG Dr6; ULONG Dr7; FLOATING_SAVE_AREA FloatSave; ULONG SegGs; ULONG SegFs; ULONG SegEs; ULONG SegDs; ULONG Edi; ULONG Esi; ULONG Ebx; ULONG Edx; ULONG Ecx; ULONG Eax; ULONG Ebp; ULONG Eip; ULONG SegCs; ULONG EFlags; ULONG Esp; ULONG SegSs; UCHAR ExtendedRegisters[512]; }; struct _FILE_BASIC_INFORMATION { LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; ULONG FileAttributes; }; struct _FILE_NETWORK_OPEN_INFORMATION { LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER AllocationSize; LARGE_INTEGER EndOfFile; ULONG FileAttributes; }; struct _FILE_STANDARD_INFORMATION { LARGE_INTEGER AllocationSize; LARGE_INTEGER EndOfFile; ULONG NumberOfLinks; BOOLEAN DeletePending; BOOLEAN Directory; }; struct _KAPC { CSHORT Type; CSHORT Size; ULONG Spare0; struct _KTHREAD *Thread; LIST_ENTRY ApcListEntry; PKKERNEL_ROUTINE KernelRoutine; PKRUNDOWN_ROUTINE RundownRoutine; PKNORMAL_ROUTINE NormalRoutine; PVOID NormalContext; PVOID SystemArgument1; PVOID SystemArgument2; CCHAR ApcStateIndex; KPROCESSOR_MODE ApcMode; BOOLEAN Inserted; }; struct _LUID_AND_ATTRIBUTES { LUID Luid; ULONG Attributes; } __attribute__((pack(4))); struct _SECURITY_QUALITY_OF_SERVICE { ULONG Length; SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; SECURITY_CONTEXT_TRACKING_MODE ContextTrackingMode; BOOLEAN EffectiveOnly; }; struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; }; typedef struct _KAPC KAPC; typedef struct _LUID_AND_ATTRIBUTES LUID_AND_ATTRIBUTES; typedef struct _FILE_BASIC_INFORMATION *PFILE_BASIC_INFORMATION; typedef struct _FILE_NETWORK_OPEN_INFORMATION *PFILE_NETWORK_OPEN_INFORMATION; typedef struct _FILE_STANDARD_INFORMATION *PFILE_STANDARD_INFORMATION; typedef __stdcall void (*PIO_APC_ROUTINE)(PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, ULONG Reserved); typedef struct _SECURITY_QUALITY_OF_SERVICE *PSECURITY_QUALITY_OF_SERVICE; typedef STRING *PSTRING; typedef struct _UNICODE_STRING UNICODE_STRING; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { UCHAR Type; UCHAR ShareDisposition; USHORT Flags; union { struct { PHYSICAL_ADDRESS Start; ULONG Length; } __attribute__((pack(4))) Generic; struct { PHYSICAL_ADDRESS Start; ULONG Length; } __attribute__((pack(4))) Port; struct { ULONG Level; ULONG Vector; KAFFINITY Affinity; } __attribute__((pack(4))) Interrupt; struct { PHYSICAL_ADDRESS Start; ULONG Length; } __attribute__((pack(4))) Memory; struct { ULONG Channel; ULONG Port; ULONG Reserved1; } __attribute__((pack(4))) Dma; struct { ULONG Data[3]; } __attribute__((pack(4))) DevicePrivate; struct { ULONG Start; ULONG Length; ULONG Reserved; } __attribute__((pack(4))) BusNumber; struct { ULONG DataSize; ULONG Reserved1; ULONG Reserved2; } __attribute__((pack(4))) DeviceSpecificData; } u; } __attribute__((pack(4))); struct _IO_RESOURCE_DESCRIPTOR { UCHAR Option; UCHAR Type; UCHAR ShareDisposition; UCHAR Spare1; USHORT Flags; USHORT Spare2; union { struct { ULONG Length; ULONG Alignment; PHYSICAL_ADDRESS MinimumAddress; PHYSICAL_ADDRESS MaximumAddress; } Port; struct { ULONG Length; ULONG Alignment; PHYSICAL_ADDRESS MinimumAddress; PHYSICAL_ADDRESS MaximumAddress; } Memory; struct { ULONG MinimumVector; ULONG MaximumVector; } Interrupt; struct { ULONG MinimumChannel; ULONG MaximumChannel; } Dma; struct { ULONG Length; ULONG Alignment; PHYSICAL_ADDRESS MinimumAddress; PHYSICAL_ADDRESS MaximumAddress; } Generic; struct { ULONG Data[3]; } DevicePrivate; struct { ULONG Length; ULONG MinBusNumber; ULONG MaxBusNumber; ULONG Reserved; } BusNumber; struct { ULONG Priority; ULONG Reserved1; ULONG Reserved2; } ConfigData; } u; }; struct _KEVENT { DISPATCHER_HEADER Header; }; struct _KSEMAPHORE { DISPATCHER_HEADER Header; LONG Limit; }; typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR CM_PARTIAL_RESOURCE_DESCRIPTOR; typedef struct _IO_RESOURCE_DESCRIPTOR IO_RESOURCE_DESCRIPTOR; typedef struct _KEVENT KEVENT; typedef PSTRING PANSI_STRING; typedef PSTRING PCANSI_STRING; typedef struct _KEVENT *PKEVENT; typedef struct _KSEMAPHORE *PKSEMAPHORE; typedef UNICODE_STRING *PUNICODE_STRING; struct _INITIAL_PRIVILEGE_SET { ULONG PrivilegeCount; ULONG Control; LUID_AND_ATTRIBUTES Privilege[3]; }; struct _PRIVILEGE_SET { ULONG PrivilegeCount; ULONG Control; LUID_AND_ATTRIBUTES Privilege[1]; }; typedef struct _INITIAL_PRIVILEGE_SET INITIAL_PRIVILEGE_SET; __stdcall NTSTATUS IoCreateSymbolicLink(PUNICODE_STRING SymbolicLinkName, PUNICODE_STRING DeviceName); __stdcall NTSTATUS IoDeleteSymbolicLink(PUNICODE_STRING SymbolicLinkName); __stdcall PVOID MmGetSystemRoutineAddress(PUNICODE_STRING SystemRoutineName); typedef NTSTATUS (*PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *DriverObject, PUNICODE_STRING RegistryPath); typedef struct _PRIVILEGE_SET PRIVILEGE_SET; __stdcall NTSTATUS RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PCANSI_STRING SourceString, BOOLEAN AllocateDestinationString); __stdcall void RtlFreeUnicodeString(PUNICODE_STRING UnicodeString); __stdcall void RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString); __stdcall void RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString); struct _CM_PARTIAL_RESOURCE_LIST { USHORT Version; USHORT Revision; ULONG Count; CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1]; }; struct _ERESOURCE { LIST_ENTRY SystemResourcesList; POWNER_ENTRY OwnerTable; SHORT ActiveCount; USHORT Flag; PKSEMAPHORE SharedWaiters; PKEVENT ExclusiveWaiters; OWNER_ENTRY OwnerThreads[2]; ULONG ContentionCount; USHORT NumberOfSharedWaiters; USHORT NumberOfExclusiveWaiters; union { PVOID Address; ULONG_PTR CreatorBackTraceIndex; }; KSPIN_LOCK SpinLock; }; struct _FILE_OBJECT { CSHORT Type; CSHORT Size; PDEVICE_OBJECT DeviceObject; PVPB Vpb; PVOID FsContext; PVOID FsContext2; PSECTION_OBJECT_POINTERS SectionObjectPointer; PVOID PrivateCacheMap; NTSTATUS FinalStatus; struct _FILE_OBJECT *RelatedFileObject; BOOLEAN LockOperation; BOOLEAN DeletePending; BOOLEAN ReadAccess; BOOLEAN WriteAccess; BOOLEAN DeleteAccess; BOOLEAN SharedRead; BOOLEAN SharedWrite; BOOLEAN SharedDelete; ULONG Flags; UNICODE_STRING FileName; LARGE_INTEGER CurrentByteOffset; ULONG Waiters; ULONG Busy; PVOID LastLock; KEVENT Lock; KEVENT Event; PIO_COMPLETION_CONTEXT CompletionContext; }; struct _IO_RESOURCE_LIST { USHORT Version; USHORT Revision; ULONG Count; IO_RESOURCE_DESCRIPTOR Descriptors[1]; }; typedef struct _CM_PARTIAL_RESOURCE_LIST CM_PARTIAL_RESOURCE_LIST; typedef struct _IO_RESOURCE_LIST IO_RESOURCE_LIST; typedef void (*PFAST_IO_ACQUIRE_FILE)(struct _FILE_OBJECT *FileObject); typedef NTSTATUS (*PFAST_IO_ACQUIRE_FOR_CCFLUSH)(struct _FILE_OBJECT *FileObject, struct _DEVICE_OBJECT *DeviceObject); typedef NTSTATUS (*PFAST_IO_ACQUIRE_FOR_MOD_WRITE)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER EndingOffset, struct _ERESOURCE **ResourceToRelease, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_CHECK_IF_POSSIBLE)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, BOOLEAN Wait, ULONG LockKey, BOOLEAN CheckForReadOperation, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_DEVICE_CONTROL)(struct _FILE_OBJECT *FileObject, BOOLEAN Wait, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength, ULONG IoControlCode, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_LOCK)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, BOOLEAN FailImmediately, BOOLEAN ExclusiveLock, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_MDL_READ)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_MDL_READ_COMPLETE)(struct _FILE_OBJECT *FileObject, PMDL MdlChain, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_MDL_READ_COMPLETE_COMPRESSED)(struct _FILE_OBJECT *FileObject, PMDL MdlChain, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_MDL_WRITE_COMPLETE)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, PMDL MdlChain, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, PMDL MdlChain, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_PREPARE_MDL_WRITE)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_QUERY_BASIC_INFO)(struct _FILE_OBJECT *FileObject, BOOLEAN Wait, PFILE_BASIC_INFORMATION Buffer, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_QUERY_NETWORK_OPEN_INFO)(struct _FILE_OBJECT *FileObject, BOOLEAN Wait, struct _FILE_NETWORK_OPEN_INFORMATION *Buffer, struct _IO_STATUS_BLOCK *IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_QUERY_STANDARD_INFO)(struct _FILE_OBJECT *FileObject, BOOLEAN Wait, PFILE_STANDARD_INFORMATION Buffer, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_READ)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, BOOLEAN Wait, ULONG LockKey, PVOID Buffer, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_READ_COMPRESSED)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PVOID Buffer, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus, struct _COMPRESSED_DATA_INFO *CompressedDataInfo, ULONG CompressedDataInfoLength, struct _DEVICE_OBJECT *DeviceObject); typedef void (*PFAST_IO_RELEASE_FILE)(struct _FILE_OBJECT *FileObject); typedef NTSTATUS (*PFAST_IO_RELEASE_FOR_CCFLUSH)(struct _FILE_OBJECT *FileObject, struct _DEVICE_OBJECT *DeviceObject); typedef NTSTATUS (*PFAST_IO_RELEASE_FOR_MOD_WRITE)(struct _FILE_OBJECT *FileObject, struct _ERESOURCE *ResourceToRelease, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_UNLOCK_ALL)(struct _FILE_OBJECT *FileObject, PEPROCESS ProcessId, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_UNLOCK_ALL_BY_KEY)(struct _FILE_OBJECT *FileObject, PVOID ProcessId, ULONG Key, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_UNLOCK_SINGLE)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_WRITE)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, BOOLEAN Wait, ULONG LockKey, PVOID Buffer, PIO_STATUS_BLOCK IoStatus, struct _DEVICE_OBJECT *DeviceObject); typedef BOOLEAN (*PFAST_IO_WRITE_COMPRESSED)(struct _FILE_OBJECT *FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PVOID Buffer, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus, struct _COMPRESSED_DATA_INFO *CompressedDataInfo, ULONG CompressedDataInfoLength, struct _DEVICE_OBJECT *DeviceObject); typedef struct _FILE_OBJECT *PFILE_OBJECT; struct _ACCESS_STATE { LUID OperationID; BOOLEAN SecurityEvaluated; BOOLEAN GenerateAudit; BOOLEAN GenerateOnClose; BOOLEAN PrivilegesAllocated; ULONG Flags; ACCESS_MASK RemainingDesiredAccess; ACCESS_MASK PreviouslyGrantedAccess; ACCESS_MASK OriginalDesiredAccess; SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; PSECURITY_DESCRIPTOR SecurityDescriptor; PVOID AuxData; union { INITIAL_PRIVILEGE_SET InitialPrivilegeSet; PRIVILEGE_SET PrivilegeSet; } Privileges; BOOLEAN AuditPrivileges; UNICODE_STRING ObjectName; UNICODE_STRING ObjectTypeName; }; typedef struct _ACCESS_STATE *PACCESS_STATE; struct _CM_FULL_RESOURCE_DESCRIPTOR { INTERFACE_TYPE InterfaceType; ULONG BusNumber; CM_PARTIAL_RESOURCE_LIST PartialResourceList; }; struct _IO_RESOURCE_REQUIREMENTS_LIST { ULONG ListSize; INTERFACE_TYPE InterfaceType; ULONG BusNumber; ULONG SlotNumber; ULONG Reserved[3]; ULONG AlternativeLists; IO_RESOURCE_LIST List[1]; }; struct _IRP { CSHORT Type; USHORT Size; PMDL MdlAddress; ULONG Flags; union { struct _IRP *MasterIrp; LONG IrpCount; PVOID SystemBuffer; } AssociatedIrp; LIST_ENTRY ThreadListEntry; IO_STATUS_BLOCK IoStatus; KPROCESSOR_MODE RequestorMode; BOOLEAN PendingReturned; CHAR StackCount; CHAR CurrentLocation; BOOLEAN Cancel; KIRQL CancelIrql; CCHAR ApcEnvironment; UCHAR AllocationFlags; PIO_STATUS_BLOCK UserIosb; PKEVENT UserEvent; union { struct { PIO_APC_ROUTINE UserApcRoutine; PVOID UserApcContext; } AsynchronousParameters; LARGE_INTEGER AllocationSize; } Overlay; PDRIVER_CANCEL CancelRoutine; PVOID UserBuffer; union { struct { union { KDEVICE_QUEUE_ENTRY DeviceQueueEntry; struct { PVOID DriverContext[4]; }; }; PETHREAD Thread; PCHAR AuxiliaryBuffer; struct { LIST_ENTRY ListEntry; union { struct _IO_STACK_LOCATION *CurrentStackLocation; ULONG PacketType; }; }; PFILE_OBJECT OriginalFileObject; } Overlay; KAPC Apc; PVOID CompletionKey; } Tail; }; typedef struct _CM_FULL_RESOURCE_DESCRIPTOR CM_FULL_RESOURCE_DESCRIPTOR; typedef IO_ALLOCATION_ACTION (*PDRIVER_CONTROL)(struct _DEVICE_OBJECT *DeviceObject, struct _IRP *Irp, PVOID MapRegisterBase, PVOID Context); typedef NTSTATUS (*PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *DeviceObject, struct _IRP *Irp); typedef void (*PDRIVER_STARTIO)(struct _DEVICE_OBJECT *DeviceObject, struct _IRP *Irp); typedef BOOLEAN (*PFAST_IO_QUERY_OPEN)(struct _IRP *Irp, PFILE_NETWORK_OPEN_INFORMATION NetworkInformation, struct _DEVICE_OBJECT *DeviceObject); typedef struct _IO_RESOURCE_REQUIREMENTS_LIST *PIO_RESOURCE_REQUIREMENTS_LIST; typedef struct _IRP *PIRP; struct _IO_SECURITY_CONTEXT { PSECURITY_QUALITY_OF_SERVICE SecurityQos; PACCESS_STATE AccessState; ACCESS_MASK DesiredAccess; ULONG FullCreateOptions; }; __stdcall __fastcall void IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost); typedef NTSTATUS (*PIO_COMPLETION_ROUTINE)(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context); typedef struct _IO_SECURITY_CONTEXT *PIO_SECURITY_CONTEXT; struct _CM_RESOURCE_LIST { ULONG Count; CM_FULL_RESOURCE_DESCRIPTOR List[1]; }; struct _FAST_IO_DISPATCH { ULONG SizeOfFastIoDispatch; PFAST_IO_CHECK_IF_POSSIBLE FastIoCheckIfPossible; PFAST_IO_READ FastIoRead; PFAST_IO_WRITE FastIoWrite; PFAST_IO_QUERY_BASIC_INFO FastIoQueryBasicInfo; PFAST_IO_QUERY_STANDARD_INFO FastIoQueryStandardInfo; PFAST_IO_LOCK FastIoLock; PFAST_IO_UNLOCK_SINGLE FastIoUnlockSingle; PFAST_IO_UNLOCK_ALL FastIoUnlockAll; PFAST_IO_UNLOCK_ALL_BY_KEY FastIoUnlockAllByKey; PFAST_IO_DEVICE_CONTROL FastIoDeviceControl; PFAST_IO_ACQUIRE_FILE AcquireFileForNtCreateSection; PFAST_IO_RELEASE_FILE ReleaseFileForNtCreateSection; PFAST_IO_DETACH_DEVICE FastIoDetachDevice; PFAST_IO_QUERY_NETWORK_OPEN_INFO FastIoQueryNetworkOpenInfo; PFAST_IO_ACQUIRE_FOR_MOD_WRITE AcquireForModWrite; PFAST_IO_MDL_READ MdlRead; PFAST_IO_MDL_READ_COMPLETE MdlReadComplete; PFAST_IO_PREPARE_MDL_WRITE PrepareMdlWrite; PFAST_IO_MDL_WRITE_COMPLETE MdlWriteComplete; PFAST_IO_READ_COMPRESSED FastIoReadCompressed; PFAST_IO_WRITE_COMPRESSED FastIoWriteCompressed; PFAST_IO_MDL_READ_COMPLETE_COMPRESSED MdlReadCompleteCompressed; PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED MdlWriteCompleteCompressed; PFAST_IO_QUERY_OPEN FastIoQueryOpen; PFAST_IO_RELEASE_FOR_MOD_WRITE ReleaseForModWrite; PFAST_IO_ACQUIRE_FOR_CCFLUSH AcquireForCcFlush; PFAST_IO_RELEASE_FOR_CCFLUSH ReleaseForCcFlush; }; struct _WAIT_CONTEXT_BLOCK { KDEVICE_QUEUE_ENTRY WaitQueueEntry; PDRIVER_CONTROL DeviceRoutine; PVOID DeviceContext; ULONG NumberOfMapRegisters; PVOID DeviceObject; PVOID CurrentIrp; PKDPC BufferChainingDpc; }; typedef struct _CM_RESOURCE_LIST *PCM_RESOURCE_LIST; typedef struct _FAST_IO_DISPATCH *PFAST_IO_DISPATCH; typedef struct _WAIT_CONTEXT_BLOCK WAIT_CONTEXT_BLOCK; struct _DRIVER_OBJECT { CSHORT Type; CSHORT Size; PDEVICE_OBJECT DeviceObject; ULONG Flags; PVOID DriverStart; ULONG DriverSize; PVOID DriverSection; PDRIVER_EXTENSION DriverExtension; UNICODE_STRING DriverName; PUNICODE_STRING HardwareDatabase; PFAST_IO_DISPATCH FastIoDispatch; PDRIVER_INITIALIZE DriverInit; PDRIVER_STARTIO DriverStartIo; PDRIVER_UNLOAD DriverUnload; PDRIVER_DISPATCH MajorFunction[28]; }; struct _IO_STACK_LOCATION { UCHAR MajorFunction; UCHAR MinorFunction; UCHAR Flags; UCHAR Control; union { struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT FileAttributes; USHORT ShareAccess; ULONG EaLength; } __attribute__((pack(4))) Create; struct { ULONG Length; ULONG Key; LARGE_INTEGER ByteOffset; } __attribute__((pack(4))) Read; struct { ULONG Length; ULONG Key; LARGE_INTEGER ByteOffset; } __attribute__((pack(4))) Write; struct { ULONG Length; FILE_INFORMATION_CLASS FileInformationClass; } __attribute__((pack(4))) QueryFile; struct { ULONG Length; FILE_INFORMATION_CLASS FileInformationClass; PFILE_OBJECT FileObject; union { struct { BOOLEAN ReplaceIfExists; BOOLEAN AdvanceOnly; } __attribute__((pack(4))); ULONG ClusterCount; HANDLE DeleteHandle; }; } __attribute__((pack(4))) SetFile; struct { ULONG Length; FS_INFORMATION_CLASS FsInformationClass; } __attribute__((pack(4))) QueryVolume; struct { ULONG OutputBufferLength; ULONG InputBufferLength; ULONG IoControlCode; PVOID Type3InputBuffer; } __attribute__((pack(4))) DeviceIoControl; struct { SECURITY_INFORMATION SecurityInformation; ULONG Length; } __attribute__((pack(4))) QuerySecurity; struct { SECURITY_INFORMATION SecurityInformation; PSECURITY_DESCRIPTOR SecurityDescriptor; } __attribute__((pack(4))) SetSecurity; struct { PVPB Vpb; PDEVICE_OBJECT DeviceObject; } __attribute__((pack(4))) MountVolume; struct { PVPB Vpb; PDEVICE_OBJECT DeviceObject; } __attribute__((pack(4))) VerifyVolume; struct { struct _SCSI_REQUEST_BLOCK *Srb; } __attribute__((pack(4))) Scsi; struct { DEVICE_RELATION_TYPE Type; } __attribute__((pack(4))) QueryDeviceRelations; struct { const GUID *InterfaceType; USHORT Size; USHORT Version; PINTERFACE Interface; PVOID InterfaceSpecificData; } __attribute__((pack(4))) QueryInterface; struct { PDEVICE_CAPABILITIES Capabilities; } __attribute__((pack(4))) DeviceCapabilities; struct { PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList; } __attribute__((pack(4))) FilterResourceRequirements; struct { ULONG WhichSpace; PVOID Buffer; ULONG Offset; ULONG Length; } __attribute__((pack(4))) ReadWriteConfig; struct { BOOLEAN Lock; } __attribute__((pack(4))) SetLock; struct { BUS_QUERY_ID_TYPE IdType; } __attribute__((pack(4))) QueryId; struct { DEVICE_TEXT_TYPE DeviceTextType; LCID LocaleId; } __attribute__((pack(4))) QueryDeviceText; struct { BOOLEAN InPath; BOOLEAN Reserved[3]; DEVICE_USAGE_NOTIFICATION_TYPE Type; } __attribute__((pack(4))) UsageNotification; struct { SYSTEM_POWER_STATE PowerState; } __attribute__((pack(4))) WaitWake; struct { PPOWER_SEQUENCE PowerSequence; } __attribute__((pack(4))) PowerSequence; struct { ULONG SystemContext; POWER_STATE_TYPE Type; POWER_STATE State; POWER_ACTION ShutdownType; } __attribute__((pack(4))) Power; struct { PCM_RESOURCE_LIST AllocatedResources; PCM_RESOURCE_LIST AllocatedResourcesTranslated; } __attribute__((pack(4))) StartDevice; struct { ULONG_PTR ProviderId; PVOID DataPath; ULONG BufferSize; PVOID Buffer; } __attribute__((pack(4))) WMI; struct { PVOID Argument1; PVOID Argument2; PVOID Argument3; PVOID Argument4; } __attribute__((pack(4))) Others; } Parameters; PDEVICE_OBJECT DeviceObject; PFILE_OBJECT FileObject; PIO_COMPLETION_ROUTINE CompletionRoutine; PVOID Context; }; typedef NTSTATUS (*PDRIVER_ADD_DEVICE)(struct _DRIVER_OBJECT *DriverObject, struct _DEVICE_OBJECT *PhysicalDeviceObject); typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; struct _DEVICE_OBJECT { CSHORT Type; USHORT Size; LONG ReferenceCount; struct _DRIVER_OBJECT *DriverObject; struct _DEVICE_OBJECT *NextDevice; struct _DEVICE_OBJECT *AttachedDevice; struct _IRP *CurrentIrp; PIO_TIMER Timer; ULONG Flags; ULONG Characteristics; PVPB Vpb; PVOID DeviceExtension; ULONG DeviceType; CCHAR StackSize; union { LIST_ENTRY ListEntry; WAIT_CONTEXT_BLOCK Wcb; } Queue; ULONG AlignmentRequirement; KDEVICE_QUEUE DeviceQueue; KDPC Dpc; ULONG ActiveThreadCount; PSECURITY_DESCRIPTOR SecurityDescriptor; KEVENT DeviceLock; USHORT SectorSize; USHORT Spare1; struct _DEVOBJ_EXTENSION *DeviceObjectExtension; PVOID Reserved; } __attribute__((align(8))); __stdcall NTSTATUS IoCreateDevice(PDRIVER_OBJECT DriverObject, ULONG DeviceExtensionSize, PUNICODE_STRING DeviceName, ULONG DeviceType, ULONG DeviceCharacteristics, BOOLEAN Exclusive, PDEVICE_OBJECT *DeviceObject); struct _DRIVER_EXTENSION { struct _DRIVER_OBJECT *DriverObject; PDRIVER_ADD_DEVICE AddDevice; ULONG Count; UNICODE_STRING ServiceKeyName; };