Windows NT/2000本机API参考手册

译者序

引言

第1章 系统信息和控制

ZwQuerySystemInformation

ZwSetSystemInformation

SYSTEM_INFORMATION_CLASS

SystemBasicInformation

SystemProcessorInformation

SystemPerformanceInformation

SystemTimeOfDayInformation

SystemProcessesAndThreadsInformation

SystemCallcounts

SystemConfigurationInformation

SystemProcessorTimes

SystemGlobalFlah

SystemModuleInformation

SystemLockInformation

SystemHandleInformation

SystemObjectInformation

SystemPagefileInformation

SystemInstructionEmulationCounts

SystemCacheInformation

SystemPoolTagInformation

SystemProcessorStatistics

SystemDpcInformation

SystemLoadImage

SystemUnloadImage

SystemTimeAdjustment

SystemCrashdumpInformation

SystemExceptionInformation

SystemCrashDumpStateInformation

SystemKernelDebuggerInformation

SystemContextSwitchInformation

SystemRegistryQuotaInformation

SystemLoadAndCallImage

SystemPrioritySeparation

SystemTimeZoneInformation

SystemLookasideInformation

SystemTimeSlipEvent

SystemSetTimeSlipEvent

SystemCreateSession

SystemDeleteSession

SystemRangeStartInformation

SystemVerifierInformation

SystemAddVerifier

SystemSessionProcessesInformation

SystemPoolBlocksInformation

SystemMemoryUsageInformation

例子1.1：一个不完整的ToolHelp库的实现

例子1.2：列出一个打开进程的句柄

ZwQuerySystemEnvironmentValue

ZwSetSystemEnvironmentValue

ZwShutdownSystem

ZwSystemDebugControl

例子1.3：设置内部断点

例子1.4：得到跟踪信息

第2章 对象、对象目录和符号链接

OBJECT_ATTRIBUTES

ZwQueryObject

ZwSetInformationoObject

OBJECT_INFORMATION_CLASS

ObjectBasicInformation

ObjectNameInformation

ObjecttypeInformation

ObjectAllTypesInformation

ObjectHandleInformation

ZwDuplicateObject

ZwMakeTemporaryObject

ZwClose

例子2.1；列出一个打开进程的句柄

ZwQuerySecurityObject

ZwSetSecurityObject

ZwCreateDirectoryObject

ZwOpenDirectoryObject

ZwQuerydirectoryObject

ZwCreateSymbolicLinkObject

ZwOpenSymbolicLinkObject

ZwQuerySymbolicLinkObject

第3章 虚拟内存

ZwAllocateVirtualMemory

ZwFreeVirtualMemory

ZwQueryVirtualMemory

MEMORY_INFORMATION_CLASS

MemoryBasicInformation

MemoryWorkingSetList

MemorySectionName

ZwLockVirtualMemory

ZwUnlockVirtualMemory

ZwReadVirtualMemory

ZwWriteVirtualMemory

ZwProtectVirtualMemory

ZwFlushVirtualMemory

ZwAllocateUserPhysicalPages

ZwFreePhysicalpages

ZwMapuserPhysicalpages

ZwMapuserPhysicalpagesScatter

ZwGetWriteWatch

ZwResetWriteWatch

第4章 区\段

ZwCreateSection

ZwOpenSection

ZwQuerySection

SECTION_INFORMATION_CLASS

SectionBasicInformation

SectionImageInformation

ZwExtendSection

ZwMapViewOfSection

ZwUnmapViewOfSection

ZwAreMappedFilesTheSame

第5章 线程

ZwCreateThread

ZwOpenThread

ZwTerminateThread

ZwQueryInformationThread

ZwSetInformationThread

THREADINFOCLASS

ThreadBasicInformation

ThreadPriority

ThreadBasePriority

ThreadAffinityMask

ThreadImpersonationToken

ThreadEnableAlignmentFaultFixup

ThreadEventPair

ThreadQuerySetWin32StartAddress

ThreadZerotlsCell

ThreadPerfomanceCount

ThreadAmILastThread

ThreadIdealProcessor

ThreadPriorityBoost

ThreadSetTlsArrayAddress

ThreadIsIoPending

ThreadHideFromDebugger

ZwSuspendThread

ZwResumeThread

ZwGetContextThread

ZwSetContextThread

ZwQueueApcThread

ZwTestAlert

ZwAlertThread

ZwAlertResumeThread

ZwRegisterThreadterminatePort

ZwImpersonateThread

ZwImpersonateAnonymousToken

第6章 进程

ZwCreateProcess

ZwOpenProcess

ZwTerminateProcess

ZwQueryInformationProcess

ZwSetInformationProcess

PROCESSINFOCLASS

ProcessBasicInformation

ProcessQuotaLimits

ProcessIoCounters

ProcessVmCounters

ProcessTimes

ProcessBasePriority

ProcessRaisePriority

ProcessDebugPort

ProcessExceptionPort

ProcessAccessToken

ProcessDefaultHardErrorMode

ProcessPooledUsageAndLimits

ProcessWorkingSetWatch

ProcessUserModeIOPL

ProcessEnableAlignmentFaultFixup

ProcessPriorityClass

ProcessWx86Information

ProcessHandleCount

ProcessAffinityMask

ProcessPriorityBoost

ProcessDeviceMap

ProcessSessionInformation

ProcessForegroundInformation

ProcessWow64Information

RtlCreateProcessParameters

RtlDestroyProcessParameters

PROCESS_PARAMETERS

RtlCreateQueryDebugBuffer

RtlQueryProcessDebugInformation

RtlDestroyQueryDebugBuffer

DEBUG_BUFFER

DEBUG_MODULE_INFORMATION

DEBUG_HEAP_INFORMATION

DEBUG_LOCK_INFORMATION

例子6.1：分叉一个Win32进程

例子6.2：创建一个Win32进程

例子6.3：使用RtlQueryProcessDebugInformatioton实现拓展ToolHelp库

第7章 作业

ZwCreateJobObject

ZwOpenJobObject

ZwTerminateJobObject

ZwAssignProcessToJobObject

ZwQueryInformationJobObject

ZwSetInformationJobObject

JOBOBJECTINFOCLASS

JobObjectBasicAccountingInformation

JobObjectBasicLimitInformation

JobObjectBasicProcessIdList

JobObjectBasicUIRestrictions

JobObjectSecurityLimitInformation

JobObjectEndOfJobTimeInformation

JobObjectAssociateCompletionPortInformation

JobObjectBasicAndIoAccountingInformation

JobObjectExtendedLimitInformation

第8章 标记（Token）

ZwCreateToken

ZwOpenProcessToken

ZwOpenthreadToken

ZwDuplicateToken

ZwFilterToken

ZwAdjustPrivilegesToken

ZwAdjustGroupsToken

ZwQueryInformationToken

ZwSetInformationToken

TOKEN_INFORMATION_CLASS

TokenUser

TokenGroups和TokenRestrictedSide

TokenPrivileges

TokenOwner

TokenPrimaryGroup

TokenDefaultDacl

TokenSource

TokenType

TokenImpersonationLevel

TokenStatistics

TokenSessionId

例子8.1：为SYSTEM用户创建一个命令窗口

第9章 同步

ZwWaitForSingleObject

ZwSignalAndWaitForSingleObject

ZwWaitForMultipleObject

ZwCreateTimer

ZwOpenTimer

ZwCancelTimer

ZwSetTimer

ZwQueryTimer

TIMER_INFORMATION_CLASS

TimeBasicInformation

ZwCreateEvent

ZwOpenEvent

ZwSetEvent

ZwPulseEvent

ZwResetEvent

ZwClearEvent

ZwQueryEvent

EVENT_INFORMATION_CLASS

EventBasicInformation

ZwCreateSemaphore

ZwOpenSemaphore

ZwReleaseSemaphore

ZwQuerySemaphore

SEMAPHORE_INFORMATION_CLASS

SemaphoreBasicInformation

ZwCreateMutant

ZwOpenMutant

ZwReleaseMutant

ZwQueryMutant

MUTANT_INFORMATION_CLASS

MutantBasicInformation

ZwCreateIoCompletion

ZwOpenIoCompletion

ZwSetIoCompletion

ZwRemoveIoCompletion

ZwQueryIoCompletion

IO_COMPLETION_INFORMATION_CLASS

IoCompletionBasicInformation

ZwCreateEventPair

ZwOpenEventPair

ZwWaitLowEventPair

ZwWaitHighEventPair

ZwSetLowWaitHighEventPair

ZwSetHighWaitLowEventPair

ZwSetLowEventPair

ZwSetHighEventPair

第10章 时间

ZwQuerySystemTime

ZwSetSystemTime

ZwQueryPerformanceCounter

ZwSetTimerResolution

ZwQueryTimerResolution

ZwDelayExecution

ZwYieldExecution

ZwGettickCount

第11章 执行配置

DPROFILE_SOURCE

ZwCreateProfile

ZwSetIntervalProfile

ZwQueryIntervalProfile

ZwStartProfile

ZwStopProfile

例子11.1：配置内核

第12章 端口（局部过程调用）

PORT_MESSAGE

PORT_SECTION_WRITE

PORT_SECTION_READ

ZwCreatePort

ZwCreateWaitablePort

ZwConnectPort

ZwSecureConnectPort

ZwListenPort

ZwAcceptConnectPort

ZwCompleteConnectPort

ZwRequestPort

ZwRequestWaitReplyPort

ZwReplyPort

ZwReplyWaitReplyPort

ZwReplyWaitReceivePort

ZwReplyWaitReceivePortEx

ZwReadRequestData

ZwWriteRequestData

ZwQueryInformationPort

PORT_INFORMATION_CLASS

PortBasicInformation

ZwImpersonateClientOfPort

例子12.1：连接到一个命名端口

第13章 文件

ZwCreateFile

ZwOpenFile

ZwDeleteFile

ZwFlushBuffersFile

ZwCancelIoFile

ZwReadFile

ZwWriteFile

ZwReadFileScatter

ZwWriteFileGather

ZwLockFile

ZwUnlockFile

ZwDeviceIoControlFile

ZwFscontrolFile

ZwNotifyChangeDirectoryFile

FILE_NOTIFY_INFORMATION

ZwQueryEaFile

ZwSetEaFile

FILE_FULL_EA_INFORMATION

FILE_GET_EA_INFORMATION

ZwCreateNamedPipeFile

ZwCreateMailslotFile

ZwQueryVolumeInformationFile

ZwSetVolumeInformationFile

FS_INFORMATION_CLASS

FileFsVolumeInformation

FileFsVolumeInformation

FileFsLabelInformation

FileFssizeInformation

FileFsdeviceInformation

FileFsAttributeInformation

FileFsControlInformation

FileFsFullSizeInformation

FileFsObjectIdInformation

ZwQueryQuotaInformationFile

ZwSetquotaInformationFile

FILE_USER_QUOTA_INFORMATION

FILE_QUOTA_LIST_INFORMATION

ZwQueryAttributesFile

ZwQueryFullAttributesFile

ZwQueryInformationFile

ZwSetInformationFile

ZwQueryDirectoryFile

ZwQueryOleDirectoryFile

FILE_INFORMATION_CLASS

FileDirectoryInformation

FilefullDirectoryInformation

FileBothDirectoryInformation

FileBasicInformation

FilestandardInformation

FileInternalInformation

FileEaInformation

FileAccessInformation

FileNameInformation

FileRenameInformation和FileLinkInformation

FileNamesInformation

FileDispositionInformation

FilePositionInformation

FileModeInformation

FileAlignmentInformation

FileAllInformation

FileAllocationInformation

FileEndOffileInformation

FileStreamInformation

FilePipeInformation

FilePipeLocalInformation

FilePipeRemoteInformation

FileMailslotQueryInformation

FileMailstotSetInformation

FilecompressionInformation

FileObjectIdInformation

FileCompletionInformation

FileMoveClusterInformation

FileQuotaInformation

FileReparsePointInformation

FileNetworkOpenInformation

FileAttributeTagInformation

例子13.1：通过文件标识符打开一个文件

第14章 注册表关键项

ZwCreateKey

ZwOpenKey

ZwDeleteKey

ZwFlushKey

ZwSaveKey

ZwSaveMergedKey

ZwRestoreKey

ZwLoadKey

ZwLoadKey2

ZwUnloadKey

ZwQueryOpenSubKeys

ZwReplaceKey

ZwSetInformationKey

KEY_SET_INFORMATION_CLASS

KeyLastWriteTimeInforamtion

ZwQueryKey

ZwEnumerateKey

KEY_INFORMATION_CLASS

KeyBasicInformation

KeyNodeInformation

KeyFullInformation

KeyNameInformation

ZwNotifyChangeKey

ZwNotifyChangeMultipleKeys

ZwdeleteValueKey

ZwSetValueKey

ZwQueryValueKey

ZwEnumerateValueKey

KEY_VALUE_INFORMATION_CLASS

KeyValueBasicInformation

KeyValueFullInformation和KeyValueFullInformationAlign64

KeyValuePartialInformation

ZwQueryMultipleValueKey

DEY_VALUE_ENTRY

ZwInitializeRegistry

第15章 安全性和审计

ZwPrivilegeCheck

ZwPrivilegeObjectAuditAlarm

ZwPrivilegeServiceAuditAlarm

ZwAccess Check

ZwAccess CheckAndAuditAlarm

ZwAccess CheckByType

ZwAccess CheckByTypeAndAuditAlarm

ZwAccess CheckByTypeResultList

ZwAccess CheckByTypeResultListAndAuditAlarm

ZwAccess CheckByteResultListAndauditAlarmByHandle

ZwOpenObjectAuditAlarm

ZwcloseObjectAuditAlarm

ZwdeleteObjectAuditAlarm

第16章 即插即用和电源管理

ZwRequestWakeupLatency

ZwRequestDeviceWakeup

ZwCancelDeviceWakeupRequest

ZwIssystemResumeAutomatic

ZwSetThreadExecutionState

ZwGetDevicePowerState

ZwSetsystemPowerState

ZwInitiatePowerAction

ZwPowerInformation

POWER_INFORMATION_LEVEL

SystemPowerPolicyAc，SystemPowerPolicDc，SystemPowerPolicyCurrent

SystemPowerCapabilities

SystemBatteryState

SystemPowerStatehandler

ProcessorStateHandler

AdministratorPowerPolicy

ProcessorInformation

SystemPowerInformation

ZwPlugPlayControl

ZwGetPlugPlayEvent

第17章 其它系统服务

ZwRaiseException

ZwContinue

ZwW32Call

ZwCallbackReturn

ZwsetLowWaitHighThread

ZwSetHighWaitLowThread

ZwLoadDriver

ZwUnloadDriver

ZwFlushInstructionCache

ZwFlushWriteBuffer

ZwQueryDefaultLocale

ZsSetDefaultLocale

ZwQueryDefaultUILanguage

ZwSetDefaultUILanguage

ZwQueryInstallUILanguage

ZwAllocateLocallyUniqueId

ZwAllocateUuids

ZwSetUuidSeed

ZwRaiseHardError

ZwSetDefaultHardErrorPort

ZwDisplayString

ZwCreatePagingFile

ZwAddAtom

ZwFindAtom

ZwDeleteAtom

ZwQueryInformationAtom

ATOM_INFORMATION_CLASS

AtomBasicInformation

AtomListInformation

ZwSetLdtEntries

ZwVdmControl

Unimplemented System Services

附录A 从内核模式调用系统服务

例子A.1：重新实现NtQueryEvent

例子A.2：动态粘接到ntdll.dl

附录B 内核模式具体针对Intel平台的入口点

KiTrap03

KiTrap04

KiGetTickCount

KiCallbackReturn

kiSetLowWaitHighThread

KiDebugService

KiSystemService

附录C 异常和调试

例子C.1：KiDispatchException的伪代码

例子C.2：KiUserExceptionDispatcher的伪代码

内核调试器

例子C.3：debugService的伪代码

用户模式调试器

DEBU_MESSAGE

调试消息路由

由路由进程添加的值

OutputDebugString

跟踪对DLL所导出的例程的调用

例子C.4：跟踪实用程序

附录D 取NTFS盘上结构

NTFS_RECORD_HEADER

FILE_RECORD_HEADER

ATTRIBUTE

RESIDENT_ATTRIBUTE

NONRESIDENT_ATTRIBUTE

AttributeStandardInformation

AttributeAttributeList

AttributeFileName

AttributeObjectId

AttributeSecuritydescriptor

AttributeVolumeName

AttributeVolumeInformation

AttributeData

AttributeIndexRoot

AttributeIndexAllocation

DIRECTORY_INDEX

DIRECTORY_ENTRY

AttributeBitmap

AttributeReparsePoint

AttributeEAInformation

AttributeEA

AttributePropertySet

AttributeLoggedUtilityStream

特殊文件

打开特殊文件

从被删除的文件恢复数据

例子D.1：从一个文件恢复数据

例子D.2：对被恢复的数据解压缩