sirp Posted October 18, 2010 Posted October 18, 2010 The Undocumented Microsoft FunctionsAboutATOM_BASIC_INFORMATIONATOM_INFORMATION_CLASSATOM_TABLE_INFORMATIONDbgPrintDBG_STATEEVENT_BASIC_INFORMATIONEVENT_INFORMATION_CLASSEVENT_TYPEFILE_BASIC_INFORMATIONFILE_BOTH_DIR_INFORMATIONFILE_DIRECTORY_INFORMATIONFILE_FS_ATTRIBUTE_INFORMATIONFILE_FS_CONTROL_INFORMATIONFILE_FS_DEVICE_INFORMATIONFILE_FS_LABEL_INFORMATIONFILE_FS_SIZE_INFORMATIONFILE_FS_VOLUME_INFORMATIONFILE_FULL_DIR_INFORMATIONFILE_FULL_EA_INFORMATIONFILE_GET_EA_INFORMATIONFILE_INFORMATION_CLASSFILE_INTERNAL_INFORMATIONFILE_LINK_INFORMATIONFILE_NAMES_INFORMATIONFILE_NAME_INFORMATIONFILE_NETWORK_OPEN_INFORMATIONFILE_NOTIFY_INFORMATIONFILE_RENAME_INFORMATIONFS_INFORMATION_CLASSHARDERROR_MSGHARDERROR_RESPONSEHARDERROR_RESPONSE_OPTIONIndexINITIAL_TEBIO_COMPLETION_BASIC_INFORMATIONIO_COMPLETION_INFORMATION_CLASSKEY_MULTIPLE_VALUE_INFORMATIONKiUserApcDispatcherKPROFILE_SOURCELdrGetDllHandleLdrGetProcedureAddressLdrLoadDllLdrQueryProcessModuleInformationLdrShutdownProcessLdrShutdownThreadLdrUnloadDllLDR_MODULELPC_MESSAGELPC_SECTION_MEMORYLPC_SECTION_OWNER_MEMORYLPC_TERMINATION_MESSAGEMEMORY_BASIC_INFORMATIONMEMORY_INFORMATION_CLASSMUTANT_BASIC_INFORMATIONNtAcceptConnectPortNtAccessCheckNtAccessCheckAndAuditAlarmNtAddAtomNtAdjustGroupsTokenNtAdjustPrivilegesTokenNtAlertResumeThreadNtAlertThreadNtAllocateLocallyUniqueIdNtAllocateUuidsNtAllocateVirtualMemoryNtCallbackReturnNtCancelIoFileNtCancelTimerNtClearEventNtCloseNtCloseObjectAuditAlarmNtCompactKeysNtCompleteConnectPortNtCompressKeyNtConnectPortNtContinueNtCreateDirectoryObjectNtCreateEventNtCreateEventPairNtCreateFileNtCreateIoCompletionNtCreateKeyNtCreateKeyedEventNtCreateMailslotFileNtCreateMutantNtCreateNamedPipeFileNtCreatePagingFileNtCreatePortNtCreateProcessNtCreateProfileNtCreateSectionNtCreateSemaphoreNtCreateSymbolicLinkObjectNtCreateThreadNtCreateTimerNtCreateTokenNtCurrentTebNtDelayExecutionNtDeleteAtomNtDeleteFileNtDeleteKeyNtDeleteObjectAuditAlarmNtDeleteValueKeyNtDeviceIoControlFileNtDisplayStringNtDuplicateObjectNtDuplicateTokenNtEnumerateKeyNtEnumerateValueKeyNtExtendSectionNtFindAtomNtFlushBuffersFileNtFlushInstructionCacheNtFlushKeyNtFlushVirtualMemoryNtFlushWriteBufferNtFreeVirtualMemoryNtFsControlFileNtGetContextThreadNtGetTickCountNtImpersonateClientOfPortNtImpersonateThreadNtListenPortNtLoadDriverNtLoadKeyNtLoadKey2NtLockFileNtLockVirtualMemoryNtMakeTemporaryObjectNtMapViewOfSectionNtNotifyChangeDirectoryFileNtNotifyChangeKeyNtOpenDirectoryObjectNtOpenEventNtOpenEventPairNtOpenFileNtOpenIoCompletionNtOpenKeyNtOpenKeyedEventNtOpenMutantNtOpenObjectAuditAlarmNtOpenProcessNtOpenProcessTokenNtOpenSectionNtOpenSemaphoreNtOpenSymbolicLinkObjectNtOpenThreadNtOpenThreadTokenNtOpenTimerNtPrivilegeCheckNtPrivilegedServiceAuditAlarmNtPrivilegeObjectAuditAlarmNtProtectVirtualMemoryNtPulseEventNtQueryAttributesFileNtQueryDefaultLocaleNtQueryDirectoryFileNtQueryDirectoryObjectNtQueryEaFileNtQueryEventNtQueryFullAttributesFileNtQueryInformationAtomNtQueryInformationFileNtQueryInformationPortNtQueryInformationProcessNtQueryInformationThreadNtQueryInformationTokenNtQueryIntervalProfileNtQueryIoCompletionNtQueryKeyNtQueryMultipleValueKeyNtQueryMutantNtQueryObjectNtQueryOleDirectoryFileNtQueryPerformanceCounterNtQuerySectionNtQuerySecurityObjectNtQuerySemaphoreNtQuerySymbolicLinkObjectNtQuerySystemEnvironmentValueNtQuerySystemInformationNtQuerySystemTimeNtQueryTimerNtQueryTimerResolutionNtQueryValueKeyNtQueryVirtualMemoryNtQueryVolumeInformationFileNtQueueApcThreadNtRaiseExceptionNtRaiseHardErrorNtReadFileNtReadFileScatterNtReadRequestDataNtReadVirtualMemoryNtRegisterThreadTerminatePortNtReleaseKeyedEventNtReleaseMutantNtReleaseSemaphoreNtRemoveIoCompletionNtReplaceKeyNtReplyPortNtReplyWaitReceivePortNtReplyWaitReplyPortNtRequestPortNtRequestWaitReplyPortNtResetEventNtRestoreKeyNtResumeThreadNtSaveKeyNtSetContextThreadNtSetDefaultHardErrorPortNtSetDefaultLocaleNtSetEaFileNtSetEventNtSetEventBoostPriorityNtSetHighEventPairNtSetHighWaitLowEventPairNtSetHighWaitLowThreadNtSetInformationFileNtSetInformationKeyNtSetInformationObjectNtSetInformationProcessNtSetInformationThreadNtSetInformationTokenNtSetIntervalProfileNtSetIoCompletionNtSetLowEventPairNtSetLowWaitHighEventPairNtSetLowWaitHighThreadNtSetSecurityObjectNtSetSystemEnvironmentValueNtSetSystemInformationNtSetSystemTimeNtSetTimerNtSetTimerResolutionNtSetValueKeyNtSetVolumeInformationFileNtShutdownSystemNtSignalAndWaitForSingleObjectNtStartProfileNtStopProfileNtSuspendThreadNtSystemDebugControlNtTerminateProcessNtTerminateThreadNtTestAlertNtUnloadDriverNtUnloadKeyNtUnlockFileNtUnlockVirtualMemoryNtUnmapViewOfSectionNtWaitForKeyedEventNtWaitForMultipleObjectsNtWaitForSingleObjectNtWaitHighEventPairNtWaitLowEventPairNtWriteFileNtWriteFileGatherNtWriteRequestDataNtWriteVirtualMemoryNtYieldExecutionOBJDIR_INFORMATIONOBJECT_BASIC_INFORMATIONOBJECT_INFORMATION_CLASSOBJECT_NAME_INFORMATIONOBJECT_WAIT_TYPEOther object functionsPEBPEB_FREE_BLOCKPEB_LDR_DATAPOOLED_USAGE_AND_LIMITSPORT_INFORMATION_CLASSPROCESS_ACCESS_TOKENPROCESS_INFORMATION_CLASSPROCESS_WS_WATCH_INFORMATIONRtlAllocateHeapRtlCaptureStackBackTraceRtlCompactHeapRtlCompressBufferRtlCreateEnvironmentRtlCreateHeapRtlCreateUserProcessRtlCreateUserThreadRtlDecompressBufferRtlDestroyEnvironmentRtlDestroyHeapRtlEnumProcessHeapsRtlExpandEnvironmentStrings_URtlFormatCurrentUserKeyPathRtlFreeHeapRtlGetCallersAddressRtlGetCompressionWorkSpaceSizeRtlGetProcessHeapsRtlImageNtHeaderRtlImageRvaToVaRtlInitializeContextRtlLockHeapRtlProtectHeapRtlQueryEnvironmentVariable_URtlReAllocateHeapRtlSetCurrentEnvironmentRtlSetEnvironmentVariableRtlSizeHeapRtlTimeFieldsToTimeRtlTimeToTimeFieldsRtlUnlockHeapRtlValidateHeapRtlValidateProcessHeapsRtlWalkHeapRTL_DRIVE_LETTER_CURDIRRTL_HEAP_DEFINITIONRTL_USER_PROCESS_INFORMATIONRTL_USER_PROCESS_PARAMETERSSECTION_BASIC_INFORMATIONSECTION_IMAGE_INFORMATIONSECTION_INFORMATION_CLASSSECTION_INHERITSEMAPHORE_BASIC_INFORMATIONSEMAPHORE_INFORMATION_CLASSSHUTDOWN_ACTIONSYSDBG_COMMANDSYSTEM_INFORMATION_CLASSSYSTEM_MODULESYSTEM_MODULE_INFORMATIONSYSTEM_PAGEFILE_INFORMATIONSYSTEM_PROCESS_INFORMATIONSYSTEM_REGISTRY_QUOTA_INFORMATIONSYSTEM_THREADTEBTHREAD_BASIC_INFORMATIONTHREAD_INFORMATION_CLASSTHREAD_TIMES_INFORMATIONTIMER_BASIC_INFORMATIONTIMER_INFORMATION_CLASSTIME_FIELDSurl
Fungus Posted October 18, 2010 Posted October 18, 2010 Very nice, thanks for the post.There is tons of great information contained here.
What Posted October 19, 2010 Posted October 19, 2010 (edited) Here is ntdll header for C. Has a lot of the functions listed. Edited October 19, 2010 by What
frank_boldewin Posted October 19, 2010 Posted October 19, 2010 Here is ntdll header for C. Has a lot of the functions listed.thanx for sharing what.can you tell me from which source this comes?
What Posted October 19, 2010 Posted October 19, 2010 can you tell me from which source this comes?Honestly, I can't remember. I was just searching the web sometime ago, and I came across it and found it useful.
atom0s Posted October 20, 2010 Posted October 20, 2010 A fair amount of these aren't functions, but definitions for constant values as well as structures. Most of these are defined in the Windows driver development kit (WDK) which you can download from the Microsoft Connect site for free. A lot of these are also documented on MSDN here:/>http://msdn.microsoft.com/en-us/library/ff557573%28VS.85%29.aspxYou can obtain the WDK here:/>http://www.microsoft.com/whdc/DevTools/WDK/WDKpkg.mspx 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now