sirp Posted October 18, 2010 Share Posted October 18, 2010 The Undocumented Microsoft FunctionsAboutATOM_BASIC_INFORMATIONATOM_INFORMATION_CLASSATOM_TABLE_INFORMATIONDbgPrintDBG_STATEEVENT_BASIC_INFORMATIONEVENT_INFORMATION_CLASSEVENT_TYPEFILE_BASIC_INFORMATIONFILE_BOTH_DIR_INFORMATIONFILE_DIRECTORY_INFORMATIONFILE_FS_ATTRIBUTE_INFORMATIONFILE_FS_CONTROL_INFORMATIONFILE_FS_DEVICE_INFORMATIONFILE_FS_LABEL_INFORMATIONFILE_FS_SIZE_INFORMATIONFILE_FS_VOLUME_INFORMATIONFILE_FULL_DIR_INFORMATIONFILE_FULL_EA_INFORMATIONFILE_GET_EA_INFORMATIONFILE_INFORMATION_CLASSFILE_INTERNAL_INFORMATIONFILE_LINK_INFORMATIONFILE_NAMES_INFORMATIONFILE_NAME_INFORMATIONFILE_NETWORK_OPEN_INFORMATIONFILE_NOTIFY_INFORMATIONFILE_RENAME_INFORMATIONFS_INFORMATION_CLASSHARDERROR_MSGHARDERROR_RESPONSEHARDERROR_RESPONSE_OPTIONIndexINITIAL_TEBIO_COMPLETION_BASIC_INFORMATIONIO_COMPLETION_INFORMATION_CLASSKEY_MULTIPLE_VALUE_INFORMATIONKiUserApcDispatcherKPROFILE_SOURCELdrGetDllHandleLdrGetProcedureAddressLdrLoadDllLdrQueryProcessModuleInformationLdrShutdownProcessLdrShutdownThreadLdrUnloadDllLDR_MODULELPC_MESSAGELPC_SECTION_MEMORYLPC_SECTION_OWNER_MEMORYLPC_TERMINATION_MESSAGEMEMORY_BASIC_INFORMATIONMEMORY_INFORMATION_CLASSMUTANT_BASIC_INFORMATIONNtAcceptConnectPortNtAccessCheckNtAccessCheckAndAuditAlarmNtAddAtomNtAdjustGroupsTokenNtAdjustPrivilegesTokenNtAlertResumeThreadNtAlertThreadNtAllocateLocallyUniqueIdNtAllocateUuidsNtAllocateVirtualMemoryNtCallbackReturnNtCancelIoFileNtCancelTimerNtClearEventNtCloseNtCloseObjectAuditAlarmNtCompactKeysNtCompleteConnectPortNtCompressKeyNtConnectPortNtContinueNtCreateDirectoryObjectNtCreateEventNtCreateEventPairNtCreateFileNtCreateIoCompletionNtCreateKeyNtCreateKeyedEventNtCreateMailslotFileNtCreateMutantNtCreateNamedPipeFileNtCreatePagingFileNtCreatePortNtCreateProcessNtCreateProfileNtCreateSectionNtCreateSemaphoreNtCreateSymbolicLinkObjectNtCreateThreadNtCreateTimerNtCreateTokenNtCurrentTebNtDelayExecutionNtDeleteAtomNtDeleteFileNtDeleteKeyNtDeleteObjectAuditAlarmNtDeleteValueKeyNtDeviceIoControlFileNtDisplayStringNtDuplicateObjectNtDuplicateTokenNtEnumerateKeyNtEnumerateValueKeyNtExtendSectionNtFindAtomNtFlushBuffersFileNtFlushInstructionCacheNtFlushKeyNtFlushVirtualMemoryNtFlushWriteBufferNtFreeVirtualMemoryNtFsControlFileNtGetContextThreadNtGetTickCountNtImpersonateClientOfPortNtImpersonateThreadNtListenPortNtLoadDriverNtLoadKeyNtLoadKey2NtLockFileNtLockVirtualMemoryNtMakeTemporaryObjectNtMapViewOfSectionNtNotifyChangeDirectoryFileNtNotifyChangeKeyNtOpenDirectoryObjectNtOpenEventNtOpenEventPairNtOpenFileNtOpenIoCompletionNtOpenKeyNtOpenKeyedEventNtOpenMutantNtOpenObjectAuditAlarmNtOpenProcessNtOpenProcessTokenNtOpenSectionNtOpenSemaphoreNtOpenSymbolicLinkObjectNtOpenThreadNtOpenThreadTokenNtOpenTimerNtPrivilegeCheckNtPrivilegedServiceAuditAlarmNtPrivilegeObjectAuditAlarmNtProtectVirtualMemoryNtPulseEventNtQueryAttributesFileNtQueryDefaultLocaleNtQueryDirectoryFileNtQueryDirectoryObjectNtQueryEaFileNtQueryEventNtQueryFullAttributesFileNtQueryInformationAtomNtQueryInformationFileNtQueryInformationPortNtQueryInformationProcessNtQueryInformationThreadNtQueryInformationTokenNtQueryIntervalProfileNtQueryIoCompletionNtQueryKeyNtQueryMultipleValueKeyNtQueryMutantNtQueryObjectNtQueryOleDirectoryFileNtQueryPerformanceCounterNtQuerySectionNtQuerySecurityObjectNtQuerySemaphoreNtQuerySymbolicLinkObjectNtQuerySystemEnvironmentValueNtQuerySystemInformationNtQuerySystemTimeNtQueryTimerNtQueryTimerResolutionNtQueryValueKeyNtQueryVirtualMemoryNtQueryVolumeInformationFileNtQueueApcThreadNtRaiseExceptionNtRaiseHardErrorNtReadFileNtReadFileScatterNtReadRequestDataNtReadVirtualMemoryNtRegisterThreadTerminatePortNtReleaseKeyedEventNtReleaseMutantNtReleaseSemaphoreNtRemoveIoCompletionNtReplaceKeyNtReplyPortNtReplyWaitReceivePortNtReplyWaitReplyPortNtRequestPortNtRequestWaitReplyPortNtResetEventNtRestoreKeyNtResumeThreadNtSaveKeyNtSetContextThreadNtSetDefaultHardErrorPortNtSetDefaultLocaleNtSetEaFileNtSetEventNtSetEventBoostPriorityNtSetHighEventPairNtSetHighWaitLowEventPairNtSetHighWaitLowThreadNtSetInformationFileNtSetInformationKeyNtSetInformationObjectNtSetInformationProcessNtSetInformationThreadNtSetInformationTokenNtSetIntervalProfileNtSetIoCompletionNtSetLowEventPairNtSetLowWaitHighEventPairNtSetLowWaitHighThreadNtSetSecurityObjectNtSetSystemEnvironmentValueNtSetSystemInformationNtSetSystemTimeNtSetTimerNtSetTimerResolutionNtSetValueKeyNtSetVolumeInformationFileNtShutdownSystemNtSignalAndWaitForSingleObjectNtStartProfileNtStopProfileNtSuspendThreadNtSystemDebugControlNtTerminateProcessNtTerminateThreadNtTestAlertNtUnloadDriverNtUnloadKeyNtUnlockFileNtUnlockVirtualMemoryNtUnmapViewOfSectionNtWaitForKeyedEventNtWaitForMultipleObjectsNtWaitForSingleObjectNtWaitHighEventPairNtWaitLowEventPairNtWriteFileNtWriteFileGatherNtWriteRequestDataNtWriteVirtualMemoryNtYieldExecutionOBJDIR_INFORMATIONOBJECT_BASIC_INFORMATIONOBJECT_INFORMATION_CLASSOBJECT_NAME_INFORMATIONOBJECT_WAIT_TYPEOther object functionsPEBPEB_FREE_BLOCKPEB_LDR_DATAPOOLED_USAGE_AND_LIMITSPORT_INFORMATION_CLASSPROCESS_ACCESS_TOKENPROCESS_INFORMATION_CLASSPROCESS_WS_WATCH_INFORMATIONRtlAllocateHeapRtlCaptureStackBackTraceRtlCompactHeapRtlCompressBufferRtlCreateEnvironmentRtlCreateHeapRtlCreateUserProcessRtlCreateUserThreadRtlDecompressBufferRtlDestroyEnvironmentRtlDestroyHeapRtlEnumProcessHeapsRtlExpandEnvironmentStrings_URtlFormatCurrentUserKeyPathRtlFreeHeapRtlGetCallersAddressRtlGetCompressionWorkSpaceSizeRtlGetProcessHeapsRtlImageNtHeaderRtlImageRvaToVaRtlInitializeContextRtlLockHeapRtlProtectHeapRtlQueryEnvironmentVariable_URtlReAllocateHeapRtlSetCurrentEnvironmentRtlSetEnvironmentVariableRtlSizeHeapRtlTimeFieldsToTimeRtlTimeToTimeFieldsRtlUnlockHeapRtlValidateHeapRtlValidateProcessHeapsRtlWalkHeapRTL_DRIVE_LETTER_CURDIRRTL_HEAP_DEFINITIONRTL_USER_PROCESS_INFORMATIONRTL_USER_PROCESS_PARAMETERSSECTION_BASIC_INFORMATIONSECTION_IMAGE_INFORMATIONSECTION_INFORMATION_CLASSSECTION_INHERITSEMAPHORE_BASIC_INFORMATIONSEMAPHORE_INFORMATION_CLASSSHUTDOWN_ACTIONSYSDBG_COMMANDSYSTEM_INFORMATION_CLASSSYSTEM_MODULESYSTEM_MODULE_INFORMATIONSYSTEM_PAGEFILE_INFORMATIONSYSTEM_PROCESS_INFORMATIONSYSTEM_REGISTRY_QUOTA_INFORMATIONSYSTEM_THREADTEBTHREAD_BASIC_INFORMATIONTHREAD_INFORMATION_CLASSTHREAD_TIMES_INFORMATIONTIMER_BASIC_INFORMATIONTIMER_INFORMATION_CLASSTIME_FIELDSurl Link to comment
Fungus Posted October 18, 2010 Share Posted October 18, 2010 Very nice, thanks for the post.There is tons of great information contained here. Link to comment
What Posted October 19, 2010 Share Posted October 19, 2010 (edited) Here is ntdll header for C. Has a lot of the functions listed. Edited October 19, 2010 by What Link to comment
frank_boldewin Posted October 19, 2010 Share Posted October 19, 2010 Here is ntdll header for C. Has a lot of the functions listed.thanx for sharing what.can you tell me from which source this comes? Link to comment
What Posted October 19, 2010 Share Posted October 19, 2010 can you tell me from which source this comes?Honestly, I can't remember. I was just searching the web sometime ago, and I came across it and found it useful. Link to comment
atom0s Posted October 20, 2010 Share Posted October 20, 2010 A fair amount of these aren't functions, but definitions for constant values as well as structures. Most of these are defined in the Windows driver development kit (WDK) which you can download from the Microsoft Connect site for free. A lot of these are also documented on MSDN here:/>http://msdn.microsoft.com/en-us/library/ff557573%28VS.85%29.aspxYou can obtain the WDK here:/>http://www.microsoft.com/whdc/DevTools/WDK/WDKpkg.mspx 1 Link to comment
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now