455 lines
10 KiB
Plaintext
455 lines
10 KiB
Plaintext
|
|
NAME NTOSKRNL
|
|
|
|
EXPORTS
|
|
|
|
CmRegisterCallback
|
|
CmUnRegisterCallback
|
|
DbgBreakPoint
|
|
DbgPrint
|
|
ExAcquireFastMutexUnsafe
|
|
ExAcquireResourceExclusiveLite
|
|
ExAcquireResourceSharedLite
|
|
ExAcquireSharedStarveExclusive
|
|
ExAcquireSharedWaitForExclusive
|
|
ExAllocatePool
|
|
ExAllocatePoolWithQuota
|
|
ExAllocatePoolWithQuotaTag
|
|
ExAllocatePoolWithTag
|
|
ExAllocatePoolWithTagPriority
|
|
ExConvertExclusiveToSharedLite
|
|
ExCreateCallback
|
|
ExDeleteNPagedLookasideList
|
|
ExDeletePagedLookasideList
|
|
ExDeleteResourceLite
|
|
ExEventObjectType CONSTANT // Data - use pointer for access
|
|
ExFreePool
|
|
ExFreePoolWithTag
|
|
ExGetExclusiveWaiterCount
|
|
ExGetPreviousMode
|
|
ExGetSharedWaiterCount
|
|
ExInitializeNPagedLookasideList
|
|
ExInitializePagedLookasideList
|
|
ExInitializeResourceLite
|
|
ExInterlockedAddLargeInteger
|
|
ExInterlockedAddLargeStatistic
|
|
ExIsProcessorFeaturePresent
|
|
ExIsResourceAcquiredExclusiveLite
|
|
ExIsResourceAcquiredSharedLite
|
|
ExLocalTimeToSystemTime
|
|
ExNotifyCallback
|
|
ExQueueWorkItem
|
|
ExRaiseStatus
|
|
ExRegisterCallback
|
|
ExReinitializeResourceLite
|
|
ExReleaseFastMutexUnsafe
|
|
ExReleaseResourceForThreadLite
|
|
ExReleaseResourceLite
|
|
ExSemaphoreObjectType CONSTANT // Data - use pointer for access
|
|
ExSetResourceOwnerPointer
|
|
ExSetTimerResolution
|
|
ExSystemTimeToLocalTime
|
|
ExUnregisterCallback
|
|
ExVerifySuite
|
|
IoAcquireCancelSpinLock
|
|
IoAcquireRemoveLockEx
|
|
IoAllocateAdapterChannel
|
|
IoAllocateDriverObjectExtension
|
|
IoAllocateErrorLogEntry
|
|
IoAllocateIrp
|
|
IoAllocateMdl
|
|
IoAllocateWorkItem
|
|
IoAttachDevice
|
|
IoAttachDeviceToDeviceStack
|
|
IoBuildAsynchronousFsdRequest
|
|
IoBuildDeviceIoControlRequest
|
|
IoBuildPartialMdl
|
|
IoBuildSynchronousFsdRequest
|
|
IoCancelIrp
|
|
IoCheckShareAccess
|
|
IoConnectInterrupt
|
|
IoCreateDevice
|
|
IoCreateFile
|
|
IoCreateNotificationEvent
|
|
IoCreateSymbolicLink
|
|
IoCreateSynchronizationEvent
|
|
IoCreateUnprotectedSymbolicLink
|
|
IoCsqInitialize
|
|
IoCsqInsertIrp
|
|
IoCsqRemoveIrp
|
|
IoCsqRemoveNextIrp
|
|
IoDeleteDevice
|
|
IoDeleteSymbolicLink
|
|
IoDetachDevice
|
|
IoDisconnectInterrupt
|
|
IoFileObjectType CONSTANT // Data - use pointer for access
|
|
IoForwardIrpSynchronously
|
|
IoFreeErrorLogEntry
|
|
IoFreeIrp
|
|
IoFreeMdl
|
|
IoFreeWorkItem
|
|
IoGetAttachedDeviceReference
|
|
IoGetCurrentProcess
|
|
IoGetDeviceInterfaceAlias
|
|
IoGetDeviceInterfaces
|
|
IoGetDeviceObjectPointer
|
|
IoGetDeviceProperty
|
|
IoGetDmaAdapter
|
|
IoGetDriverObjectExtension
|
|
IoGetInitialStack
|
|
IoGetRelatedDeviceObject
|
|
IoGetStackLimits
|
|
IoInitializeIrp
|
|
IoInitializeRemoveLockEx
|
|
IoInitializeTimer
|
|
IoInvalidateDeviceRelations
|
|
IoInvalidateDeviceState
|
|
IoIsWdmVersionAvailable
|
|
#if defined(_WIN64)
|
|
IoIs32bitProcess
|
|
#endif
|
|
IoOpenDeviceInterfaceRegistryKey
|
|
IoOpenDeviceRegistryKey
|
|
IoQueueWorkItem
|
|
IoRegisterDeviceInterface
|
|
IoRegisterPlugPlayNotification
|
|
IoRegisterShutdownNotification
|
|
IoReleaseCancelSpinLock
|
|
IoReleaseRemoveLockAndWaitEx
|
|
IoReleaseRemoveLockEx
|
|
IoReuseIrp
|
|
IoReportTargetDeviceChange
|
|
IoReportTargetDeviceChangeAsynchronous
|
|
IoRequestDeviceEject
|
|
IoSetCompletionRoutineEx
|
|
IoSetDeviceInterfaceState
|
|
IoSetShareAccess
|
|
IoSetStartIoAttributes
|
|
IoStartNextPacket
|
|
IoStartNextPacketByKey
|
|
IoStartPacket
|
|
IoStartTimer
|
|
IoStopTimer
|
|
IoUnregisterPlugPlayNotification
|
|
IoUnregisterShutdownNotification
|
|
IoWMIAllocateInstanceIds
|
|
IoWMIDeviceObjectToInstanceName
|
|
#if defined(_WIN64)
|
|
IoWMIDeviceObjectToProviderId
|
|
#endif
|
|
IoWMIExecuteMethod
|
|
IoWMIHandleToInstanceName
|
|
IoWMIOpenBlock
|
|
IoWMIRegistrationControl
|
|
IoWMIQueryAllData
|
|
IoWMIQueryAllDataMultiple
|
|
IoWMIQuerySingleInstance
|
|
IoWMIQuerySingleInstanceMultiple
|
|
IoWMISetNotificationCallback
|
|
IoWMISetSingleInstance
|
|
IoWMISetSingleItem
|
|
IoWMISuggestInstanceName
|
|
IoWMIWriteEvent
|
|
IoWriteErrorLogEntry
|
|
IofCallDriver
|
|
IofCompleteRequest
|
|
KeAcquireSpinLockAtDpcLevel
|
|
KdDebuggerNotPresent CONSTANT // Data - use pointer for access
|
|
KeAcquireInterruptSpinLock
|
|
KeAreApcsDisabled
|
|
KeDeregisterBugCheckCallback
|
|
KeReleaseInterruptSpinLock
|
|
KeBugCheckEx
|
|
KeCancelTimer
|
|
KeClearEvent
|
|
KeDelayExecutionThread
|
|
KeEnterCriticalRegion
|
|
KeGetCurrentThread
|
|
KeGetRecommendedSharedDataAlignment
|
|
KeInitializeDeviceQueue
|
|
KeInitializeDpc
|
|
KeInitializeEvent
|
|
KeInitializeMutex
|
|
KeInitializeSemaphore
|
|
KeInitializeSpinLock
|
|
KeInitializeTimer
|
|
KeInitializeTimerEx
|
|
KeInsertByKeyDeviceQueue
|
|
KeInsertDeviceQueue
|
|
KeInsertQueueDpc
|
|
KeLeaveCriticalRegion
|
|
KeQueryInterruptTime
|
|
KeQueryPriorityThread
|
|
KeQueryRuntimeThread
|
|
KeQuerySystemTime
|
|
KeQueryTimeIncrement
|
|
KeReadStateEvent
|
|
KeReadStateSemaphore
|
|
KeReadStateTimer
|
|
KeRegisterBugCheckCallback
|
|
KeReleaseMutex
|
|
KeReleaseSemaphore
|
|
KeReleaseSpinLockFromDpcLevel
|
|
KeRemoveByKeyDeviceQueue
|
|
KeRemoveByKeyDeviceQueueIfBusy
|
|
KeRemoveDeviceQueue
|
|
KeRemoveEntryDeviceQueue
|
|
KeRemoveQueueDpc
|
|
KeResetEvent
|
|
KeRestoreFloatingPointState
|
|
KeSaveFloatingPointState
|
|
KeSetEvent
|
|
KeSetPriorityThread
|
|
KeSetTimer
|
|
KeSetTimerEx
|
|
KeSynchronizeExecution
|
|
KeTickCount CONSTANT // Data - use pointer for access
|
|
KeWaitForSingleObject
|
|
KeWaitForMultipleObjects
|
|
MmIsVerifierEnabled
|
|
MmAddVerifierThunks
|
|
MmAdvanceMdl
|
|
Mm64BitPhysicalAddress CONSTANT // Data - use pointer for access
|
|
MmCreateMdl
|
|
MmAllocatePagesForMdl
|
|
MmBuildMdlForNonPagedPool
|
|
MmFreePagesFromMdl
|
|
MmGetSystemRoutineAddress
|
|
MmIsDriverVerifying
|
|
MmMapIoSpace
|
|
MmMapLockedPages
|
|
MmMapLockedPagesSpecifyCache
|
|
MmAllocateMappingAddress
|
|
MmFreeMappingAddress
|
|
MmMapLockedPagesWithReservedMapping
|
|
MmUnmapReservedMapping
|
|
MmPageEntireDriver
|
|
MmProbeAndLockPages
|
|
MmProbeAndLockProcessPages
|
|
MmProtectMdlSystemAddress
|
|
MmResetDriverPaging
|
|
MmQuerySystemSize
|
|
MmSizeOfMdl
|
|
MmUnlockPages
|
|
MmUnmapIoSpace
|
|
MmUnmapLockedPages
|
|
NlsMbCodePageTag CONSTANT // Data - use pointer for access
|
|
NtClose
|
|
ObfDereferenceObject
|
|
ObGetObjectSecurity
|
|
ObLogSecurityDescriptor
|
|
ObReferenceSecurityDescriptor
|
|
ObDereferenceSecurityDescriptor
|
|
ObfReferenceObject
|
|
ObReferenceObjectByHandle
|
|
ObReferenceObjectByPointer
|
|
ObReleaseObjectSecurity
|
|
PoCallDriver
|
|
PoSetPowerState
|
|
PoRegisterDeviceForIdleDetection
|
|
PoRequestPowerIrp
|
|
PoRegisterSystemState
|
|
PoRequestShutdownEvent
|
|
PoSetSystemState
|
|
PoStartNextPowerIrp
|
|
PoUnregisterSystemState
|
|
ProbeForRead
|
|
ProbeForWrite
|
|
PsCreateSystemThread
|
|
PsTerminateSystemThread
|
|
RtlAnsiStringToUnicodeString
|
|
RtlAppendUnicodeStringToString
|
|
RtlAppendUnicodeToString
|
|
RtlAreBitsClear
|
|
RtlAreBitsSet
|
|
RtlAssert
|
|
RtlClearAllBits
|
|
RtlClearBit
|
|
RtlClearBits
|
|
RtlCompareMemory
|
|
RtlCompareUnicodeString
|
|
#if !defined(_WIN64)
|
|
RtlConvertLongToLargeInteger
|
|
RtlConvertUlongToLargeInteger
|
|
#endif
|
|
RtlCopyMemory = memcpy
|
|
RtlCopyUnicodeString
|
|
RtlCreateSecurityDescriptor
|
|
RtlDeleteRegistryValue
|
|
RtlEqualUnicodeString
|
|
#if !defined(_WIN64)
|
|
RtlExtendedIntegerMultiply
|
|
RtlExtendedLargeIntegerDivide
|
|
#endif
|
|
#if !defined(_AMD64_)
|
|
RtlExtendedMagicDivide
|
|
#endif
|
|
RtlFillMemory
|
|
RtlFindClearBits
|
|
RtlFindClearBitsAndSet
|
|
RtlFindClearRuns
|
|
RtlFindFirstRunClear
|
|
RtlFindLastBackwardRunClear
|
|
RtlFindLeastSignificantBit
|
|
RtlFindLongestRunClear
|
|
RtlFindSetBits
|
|
RtlFindSetBitsAndClear
|
|
RtlFreeAnsiString
|
|
RtlFreeUnicodeString
|
|
RtlGUIDFromString
|
|
RtlHashUnicodeString
|
|
RtlInitAnsiString
|
|
RtlInitString
|
|
RtlInitUnicodeString
|
|
RtlInitializeBitMap
|
|
RtlInt64ToUnicodeString
|
|
RtlIntegerToUnicodeString
|
|
RtlLengthSecurityDescriptor
|
|
RtlMoveMemory
|
|
RtlNumberOfClearBits
|
|
RtlNumberOfSetBits
|
|
RtlPrefetchMemoryNonTemporal
|
|
RtlQueryRegistryValues
|
|
RtlRaiseException
|
|
RtlSetAllBits
|
|
RtlSetBit
|
|
RtlSetBits
|
|
RtlSetDaclSecurityDescriptor
|
|
RtlStringFromGUID
|
|
RtlTestBit
|
|
RtlTimeFieldsToTime
|
|
RtlTimeToTimeFields
|
|
|
|
#if !defined(_AMD64_)
|
|
|
|
RtlUlongByteSwap
|
|
RtlUlonglongByteSwap
|
|
|
|
#endif
|
|
|
|
RtlUnicodeStringToAnsiString
|
|
RtlUnicodeStringToInteger
|
|
RtlUnwind
|
|
|
|
#if !defined(_AMD64_)
|
|
|
|
RtlUshortByteSwap
|
|
|
|
#endif
|
|
|
|
RtlValidSecurityDescriptor
|
|
RtlValidRelativeSecurityDescriptor
|
|
RtlWriteRegistryValue
|
|
RtlxAnsiStringToUnicodeSize
|
|
RtlxUnicodeStringToAnsiSize
|
|
RtlZeroMemory
|
|
WmiQueryTraceInformation
|
|
WmiTraceMessage
|
|
WmiTraceMessageVa
|
|
ZwClose
|
|
ZwCreateDirectoryObject
|
|
ZwCreateFile
|
|
ZwCreateKey
|
|
ZwDeleteKey
|
|
ZwDeleteValueKey
|
|
ZwEnumerateKey
|
|
ZwEnumerateValueKey
|
|
ZwFlushKey
|
|
ZwMakeTemporaryObject
|
|
ZwMapViewOfSection
|
|
ZwOpenKey
|
|
ZwOpenSection
|
|
ZwOpenSymbolicLinkObject
|
|
ZwPowerInformation
|
|
ZwQueryInformationFile
|
|
ZwQueryKey
|
|
ZwQuerySymbolicLinkObject
|
|
ZwQueryValueKey
|
|
ZwReadFile
|
|
ZwSetInformationFile
|
|
ZwSetValueKey
|
|
ZwUnmapViewOfSection
|
|
ZwWriteFile
|
|
|
|
_itoa
|
|
_purecall
|
|
_snprintf
|
|
_snwprintf
|
|
_stricmp
|
|
_strlwr
|
|
_strnicmp
|
|
_strnset
|
|
_strrev
|
|
#if !defined(_AMD64_)
|
|
_strset
|
|
#endif
|
|
_strupr
|
|
_vsnprintf
|
|
_wcsicmp
|
|
_wcslwr
|
|
_wcsnicmp
|
|
_wcsnset
|
|
_wcsrev
|
|
_wcsupr
|
|
atoi
|
|
atol
|
|
isdigit
|
|
islower
|
|
isprint
|
|
isspace
|
|
isupper
|
|
isxdigit
|
|
mbstowcs
|
|
mbtowc
|
|
memchr
|
|
qsort
|
|
rand
|
|
sprintf
|
|
srand
|
|
#if !defined(_AMD64_)
|
|
strcat
|
|
#endif
|
|
strchr
|
|
#if !defined(_AMD64_)
|
|
strcmp
|
|
strcpy
|
|
strlen
|
|
#endif
|
|
strncat
|
|
strncmp
|
|
strncpy
|
|
strrchr
|
|
strspn
|
|
strstr
|
|
swprintf
|
|
tolower
|
|
toupper
|
|
towlower
|
|
towupper
|
|
vsprintf
|
|
wcscat
|
|
wcschr
|
|
wcscmp
|
|
wcscpy
|
|
wcscspn
|
|
wcslen
|
|
wcsncat
|
|
wcsncmp
|
|
wcsncpy
|
|
wcsrchr
|
|
wcsspn
|
|
wcsstr
|
|
wcstombs
|
|
wctomb
|
|
|
|
#ifdef _X86_
|
|
#include "i386nt.src"
|
|
#elif _IA64_
|
|
#include "ia64nt.src"
|
|
#elif _ALPHA_
|
|
#include "alphant.src"
|
|
#elif _AMD64_
|
|
#include "amd64nt.src"
|
|
#endif
|
|
|