Windows NT/2000本機(jī)API參考手冊(cè)

譯者序
引言
第1章 系統(tǒng)信息和控制
ZwQuerySystemInformation
ZwSetSystemInformation
SYSTEM_INFORMATION_CLASS
SystemBasicInformation
SystemProcessorInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemProcessesAndThreadsInformation
SystemCallcounts
SystemConfigurationInformation
SystemProcessorTimes
SystemGlobalFlah
SystemModuleInformation
SystemLockInformation
SystemHandleInformation
SystemObjectInformation
SystemPagefileInformation
SystemInstructionEmulationCounts
SystemCacheInformation
SystemPoolTagInformation
SystemProcessorStatistics
SystemDpcInformation
SystemLoadImage
SystemUnloadImage
SystemTimeAdjustment
SystemCrashdumpInformation
SystemExceptionInformation
SystemCrashDumpStateInformation
SystemKernelDebuggerInformation
SystemContextSwitchInformation
SystemRegistryQuotaInformation
SystemLoadAndCallImage
SystemPrioritySeparation
SystemTimeZoneInformation
SystemLookasideInformation
SystemTimeSlipEvent
SystemSetTimeSlipEvent
SystemCreateSession
SystemDeleteSession
SystemRangeStartInformation
SystemVerifierInformation
SystemAddVerifier
SystemSessionProcessesInformation
SystemPoolBlocksInformation
SystemMemoryUsageInformation
例子1.1：一個(gè)不完整的ToolHelp庫(kù)的實(shí)現(xiàn)
例子1.2：列出一個(gè)打開(kāi)進(jìn)程的句柄
ZwQuerySystemEnvironmentValue
ZwSetSystemEnvironmentValue
ZwShutdownSystem
ZwSystemDebugControl
例子1.3：設(shè)置內(nèi)部斷點(diǎn)
例子1.4：得到跟蹤信息
第2章 對(duì)象、對(duì)象目錄和符號(hào)鏈接
OBJECT_ATTRIBUTES
ZwQueryObject
ZwSetInformationoObject
OBJECT_INFORMATION_CLASS
ObjectBasicInformation
ObjectNameInformation
ObjecttypeInformation
ObjectAllTypesInformation
ObjectHandleInformation
ZwDuplicateObject
ZwMakeTemporaryObject
ZwClose
例子2.1；列出一個(gè)打開(kāi)進(jìn)程的句柄
ZwQuerySecurityObject
ZwSetSecurityObject
ZwCreateDirectoryObject
ZwOpenDirectoryObject
ZwQuerydirectoryObject
ZwCreateSymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
第3章 虛擬內(nèi)存
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQueryVirtualMemory
MEMORY_INFORMATION_CLASS
MemoryBasicInformation
MemoryWorkingSetList
MemorySectionName
ZwLockVirtualMemory
ZwUnlockVirtualMemory
ZwReadVirtualMemory
ZwWriteVirtualMemory
ZwProtectVirtualMemory
ZwFlushVirtualMemory
ZwAllocateUserPhysicalPages
ZwFreePhysicalpages
ZwMapuserPhysicalpages
ZwMapuserPhysicalpagesScatter
ZwGetWriteWatch
ZwResetWriteWatch
第4章 區(qū)\段
ZwCreateSection
ZwOpenSection
ZwQuerySection
SECTION_INFORMATION_CLASS
SectionBasicInformation
SectionImageInformation
ZwExtendSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwAreMappedFilesTheSame
第5章 線程
ZwCreateThread
ZwOpenThread
ZwTerminateThread
ZwQueryInformationThread
ZwSetInformationThread
THREADINFOCLASS
ThreadBasicInformation
ThreadPriority
ThreadBasePriority
ThreadAffinityMask
ThreadImpersonationToken
ThreadEnableAlignmentFaultFixup
ThreadEventPair
ThreadQuerySetWin32StartAddress
ThreadZerotlsCell
ThreadPerfomanceCount
ThreadAmILastThread
ThreadIdealProcessor
ThreadPriorityBoost
ThreadSetTlsArrayAddress
ThreadIsIoPending
ThreadHideFromDebugger
ZwSuspendThread
ZwResumeThread
ZwGetContextThread
ZwSetContextThread
ZwQueueApcThread
ZwTestAlert
ZwAlertThread
ZwAlertResumeThread
ZwRegisterThreadterminatePort
ZwImpersonateThread
ZwImpersonateAnonymousToken
第6章 進(jìn)程
ZwCreateProcess
ZwOpenProcess
ZwTerminateProcess
ZwQueryInformationProcess
ZwSetInformationProcess
PROCESSINFOCLASS
ProcessBasicInformation
ProcessQuotaLimits
ProcessIoCounters
ProcessVmCounters
ProcessTimes
ProcessBasePriority
ProcessRaisePriority
ProcessDebugPort
ProcessExceptionPort
ProcessAccessToken
ProcessDefaultHardErrorMode
ProcessPooledUsageAndLimits
ProcessWorkingSetWatch
ProcessUserModeIOPL
ProcessEnableAlignmentFaultFixup
ProcessPriorityClass
ProcessWx86Information
ProcessHandleCount
ProcessAffinityMask
ProcessPriorityBoost
ProcessDeviceMap
ProcessSessionInformation
ProcessForegroundInformation
ProcessWow64Information
RtlCreateProcessParameters
RtlDestroyProcessParameters
PROCESS_PARAMETERS
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
DEBUG_BUFFER
DEBUG_MODULE_INFORMATION
DEBUG_HEAP_INFORMATION
DEBUG_LOCK_INFORMATION
例子6.1：分叉一個(gè)Win32進(jìn)程
例子6.2：創(chuàng)建一個(gè)Win32進(jìn)程
例子6.3：使用RtlQueryProcessDebugInformatioton實(shí)現(xiàn)拓展ToolHelp庫(kù)
第7章 作業(yè)
ZwCreateJobObject
ZwOpenJobObject
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwQueryInformationJobObject
ZwSetInformationJobObject
JOBOBJECTINFOCLASS
JobObjectBasicAccountingInformation
JobObjectBasicLimitInformation
JobObjectBasicProcessIdList
JobObjectBasicUIRestrictions
JobObjectSecurityLimitInformation
JobObjectEndOfJobTimeInformation
JobObjectAssociateCompletionPortInformation
JobObjectBasicAndIoAccountingInformation
JobObjectExtendedLimitInformation
第8章 標(biāo)記（Token）
ZwCreateToken
ZwOpenProcessToken
ZwOpenthreadToken
ZwDuplicateToken
ZwFilterToken
ZwAdjustPrivilegesToken
ZwAdjustGroupsToken
ZwQueryInformationToken
ZwSetInformationToken
TOKEN_INFORMATION_CLASS
TokenUser
TokenGroups和TokenRestrictedSide
TokenPrivileges
TokenOwner
TokenPrimaryGroup
TokenDefaultDacl
TokenSource
TokenType
TokenImpersonationLevel
TokenStatistics
TokenSessionId
例子8.1：為SYSTEM用戶創(chuàng)建一個(gè)命令窗口
第9章 同步
ZwWaitForSingleObject
ZwSignalAndWaitForSingleObject
ZwWaitForMultipleObject
ZwCreateTimer
ZwOpenTimer
ZwCancelTimer
ZwSetTimer
ZwQueryTimer
TIMER_INFORMATION_CLASS
TimeBasicInformation
ZwCreateEvent
ZwOpenEvent
ZwSetEvent
ZwPulseEvent
ZwResetEvent
ZwClearEvent
ZwQueryEvent
EVENT_INFORMATION_CLASS
EventBasicInformation
ZwCreateSemaphore
ZwOpenSemaphore
ZwReleaseSemaphore
ZwQuerySemaphore
SEMAPHORE_INFORMATION_CLASS
SemaphoreBasicInformation
ZwCreateMutant
ZwOpenMutant
ZwReleaseMutant
ZwQueryMutant
MUTANT_INFORMATION_CLASS
MutantBasicInformation
ZwCreateIoCompletion
ZwOpenIoCompletion
ZwSetIoCompletion
ZwRemoveIoCompletion
ZwQueryIoCompletion
IO_COMPLETION_INFORMATION_CLASS
IoCompletionBasicInformation
ZwCreateEventPair
ZwOpenEventPair
ZwWaitLowEventPair
ZwWaitHighEventPair
ZwSetLowWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwSetLowEventPair
ZwSetHighEventPair
第10章 時(shí)間
ZwQuerySystemTime
ZwSetSystemTime
ZwQueryPerformanceCounter
ZwSetTimerResolution
ZwQueryTimerResolution
ZwDelayExecution
ZwYieldExecution
ZwGettickCount
第11章 執(zhí)行配置
DPROFILE_SOURCE
ZwCreateProfile
ZwSetIntervalProfile
ZwQueryIntervalProfile
ZwStartProfile
ZwStopProfile
例子11.1：配置內(nèi)核
第12章 端口（局部過(guò)程調(diào)用）
PORT_MESSAGE
PORT_SECTION_WRITE
PORT_SECTION_READ
ZwCreatePort
ZwCreateWaitablePort
ZwConnectPort
ZwSecureConnectPort
ZwListenPort
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwRequestPort
ZwRequestWaitReplyPort
ZwReplyPort
ZwReplyWaitReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReceivePortEx
ZwReadRequestData
ZwWriteRequestData
ZwQueryInformationPort
PORT_INFORMATION_CLASS
PortBasicInformation
ZwImpersonateClientOfPort
例子12.1：連接到一個(gè)命名端口
第13章 文件
ZwCreateFile
ZwOpenFile
ZwDeleteFile
ZwFlushBuffersFile
ZwCancelIoFile
ZwReadFile
ZwWriteFile
ZwReadFileScatter
ZwWriteFileGather
ZwLockFile
ZwUnlockFile
ZwDeviceIoControlFile
ZwFscontrolFile
ZwNotifyChangeDirectoryFile
FILE_NOTIFY_INFORMATION
ZwQueryEaFile
ZwSetEaFile
FILE_FULL_EA_INFORMATION
FILE_GET_EA_INFORMATION
ZwCreateNamedPipeFile
ZwCreateMailslotFile
ZwQueryVolumeInformationFile
ZwSetVolumeInformationFile
FS_INFORMATION_CLASS
FileFsVolumeInformation
FileFsVolumeInformation
FileFsLabelInformation
FileFssizeInformation
FileFsdeviceInformation
FileFsAttributeInformation
FileFsControlInformation
FileFsFullSizeInformation
FileFsObjectIdInformation
ZwQueryQuotaInformationFile
ZwSetquotaInformationFile
FILE_USER_QUOTA_INFORMATION
FILE_QUOTA_LIST_INFORMATION
ZwQueryAttributesFile
ZwQueryFullAttributesFile
ZwQueryInformationFile
ZwSetInformationFile
ZwQueryDirectoryFile
ZwQueryOleDirectoryFile
FILE_INFORMATION_CLASS
FileDirectoryInformation
FilefullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FilestandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation和FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOffileInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailstotSetInformation
FilecompressionInformation
FileObjectIdInformation
FileCompletionInformation
FileMoveClusterInformation
FileQuotaInformation
FileReparsePointInformation
FileNetworkOpenInformation
FileAttributeTagInformation
例子13.1：通過(guò)文件標(biāo)識(shí)符打開(kāi)一個(gè)文件
第14章 注冊(cè)表關(guān)鍵項(xiàng)
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwFlushKey
ZwSaveKey
ZwSaveMergedKey
ZwRestoreKey
ZwLoadKey
ZwLoadKey2
ZwUnloadKey
ZwQueryOpenSubKeys
ZwReplaceKey
ZwSetInformationKey
KEY_SET_INFORMATION_CLASS
KeyLastWriteTimeInforamtion
ZwQueryKey
ZwEnumerateKey
KEY_INFORMATION_CLASS
KeyBasicInformation
KeyNodeInformation
KeyFullInformation
KeyNameInformation
ZwNotifyChangeKey
ZwNotifyChangeMultipleKeys
ZwdeleteValueKey
ZwSetValueKey
ZwQueryValueKey
ZwEnumerateValueKey
KEY_VALUE_INFORMATION_CLASS
KeyValueBasicInformation
KeyValueFullInformation和KeyValueFullInformationAlign64
KeyValuePartialInformation
ZwQueryMultipleValueKey
DEY_VALUE_ENTRY
ZwInitializeRegistry
第15章 安全性和審計(jì)
ZwPrivilegeCheck
ZwPrivilegeObjectAuditAlarm
ZwPrivilegeServiceAuditAlarm
ZwAccess Check
ZwAccess CheckAndAuditAlarm
ZwAccess CheckByType
ZwAccess CheckByTypeAndAuditAlarm
ZwAccess CheckByTypeResultList
ZwAccess CheckByTypeResultListAndAuditAlarm
ZwAccess CheckByteResultListAndauditAlarmByHandle
ZwOpenObjectAuditAlarm
ZwcloseObjectAuditAlarm
ZwdeleteObjectAuditAlarm
第16章 即插即用和電源管理
ZwRequestWakeupLatency
ZwRequestDeviceWakeup
ZwCancelDeviceWakeupRequest
ZwIssystemResumeAutomatic
ZwSetThreadExecutionState
ZwGetDevicePowerState
ZwSetsystemPowerState
ZwInitiatePowerAction
ZwPowerInformation
POWER_INFORMATION_LEVEL
SystemPowerPolicyAc，SystemPowerPolicDc，SystemPowerPolicyCurrent
SystemPowerCapabilities
SystemBatteryState
SystemPowerStatehandler
ProcessorStateHandler
AdministratorPowerPolicy
ProcessorInformation
SystemPowerInformation
ZwPlugPlayControl
ZwGetPlugPlayEvent
第17章 其它系統(tǒng)服務(wù)
ZwRaiseException
ZwContinue
ZwW32Call
ZwCallbackReturn
ZwsetLowWaitHighThread
ZwSetHighWaitLowThread
ZwLoadDriver
ZwUnloadDriver
ZwFlushInstructionCache
ZwFlushWriteBuffer
ZwQueryDefaultLocale
ZsSetDefaultLocale
ZwQueryDefaultUILanguage
ZwSetDefaultUILanguage
ZwQueryInstallUILanguage
ZwAllocateLocallyUniqueId
ZwAllocateUuids
ZwSetUuidSeed
ZwRaiseHardError
ZwSetDefaultHardErrorPort
ZwDisplayString
ZwCreatePagingFile
ZwAddAtom
ZwFindAtom
ZwDeleteAtom
ZwQueryInformationAtom
ATOM_INFORMATION_CLASS
AtomBasicInformation
AtomListInformation
ZwSetLdtEntries
ZwVdmControl
Unimplemented System Services
附錄A 從內(nèi)核模式調(diào)用系統(tǒng)服務(wù)
例子A.1：重新實(shí)現(xiàn)NtQueryEvent
例子A.2：動(dòng)態(tài)粘接到ntdll.dl
附錄B 內(nèi)核模式具體針對(duì)Intel平臺(tái)的入口點(diǎn)
KiTrap03
KiTrap04
KiGetTickCount
KiCallbackReturn
kiSetLowWaitHighThread
KiDebugService
KiSystemService
附錄C 異常和調(diào)試
例子C.1：KiDispatchException的偽代碼
例子C.2：KiUserExceptionDispatcher的偽代碼
內(nèi)核調(diào)試器
例子C.3：debugService的偽代碼
用戶模式調(diào)試器
DEBU_MESSAGE
調(diào)試消息路由
由路由進(jìn)程添加的值
OutputDebugString
跟蹤對(duì)DLL所導(dǎo)出的例程的調(diào)用
例子C.4：跟蹤實(shí)用程序
附錄D 取NTFS盤(pán)上結(jié)構(gòu)
NTFS_RECORD_HEADER
FILE_RECORD_HEADER
ATTRIBUTE
RESIDENT_ATTRIBUTE
NONRESIDENT_ATTRIBUTE
AttributeStandardInformation
AttributeAttributeList
AttributeFileName
AttributeObjectId
AttributeSecuritydescriptor
AttributeVolumeName
AttributeVolumeInformation
AttributeData
AttributeIndexRoot
AttributeIndexAllocation
DIRECTORY_INDEX
DIRECTORY_ENTRY
AttributeBitmap
AttributeReparsePoint
AttributeEAInformation
AttributeEA
AttributePropertySet
AttributeLoggedUtilityStream
特殊文件
打開(kāi)特殊文件
從被刪除的文件恢復(fù)數(shù)據(jù)
例子D.1：從一個(gè)文件恢復(fù)數(shù)據(jù)
例子D.2：對(duì)被恢復(fù)的數(shù)據(jù)解壓縮