Module File
System
windows
0.60.0
Module File
System
Module Items
Modules
Structs
Constants
Functions
Type Aliases
Unions
In windows::
Wdk::
Storage
Modules
FileSystem
windows
::
Wdk
::
Storage
Module
FileSystem
Copy item path
Settings
Help
Summary
Modules
§
Minifilters
Structs
§
ACE_
HEADER
ATOMIC_
CREATE_
ECP_
CONTEXT
BASE_
MCB
BOOT_
AREA_
INFO
BOOT_
AREA_
INFO_
0
CACHE_
MANAGER_
CALLBACKS
CACHE_
MANAGER_
CALLBACKS_
EX
CACHE_
MANAGER_
CALLBACK_
FUNCTIONS
CACHE_
UNINITIALIZE_
EVENT
CC_
ASYNC_
READ_
CONTEXT
CC_
ERROR_
CALLBACK_
CONTEXT
CC_
FILE_
SIZES
COMPRESSED_
DATA_
INFO
CONTAINER_
ROOT_
INFO_
INPUT
CONTAINER_
ROOT_
INFO_
OUTPUT
CONTAINER_
VOLUME_
STATE
COPY_
INFORMATION
CPTABLEINFO
CREATE_
REDIRECTION_
ECP_
CONTEXT
CREATE_
USN_
JOURNAL_
DATA
CSV_
DOWN_
LEVEL_
FILE_
TYPE
CSV_
DOWN_
LEVEL_
OPEN_
ECP_
CONTEXT
CSV_
QUERY_
FILE_
REVISION_
ECP_
CONTEXT
CSV_
QUERY_
FILE_
REVISION_
ECP_
CONTEXT_
FILE_
ID_
128
CSV_
SET_
HANDLE_
PROPERTIES_
ECP_
CONTEXT
DUAL_
OPLOCK_
KEY_
ECP_
CONTEXT
DUPLICATE_
CLUSTER_
DATA
ECP_
OPEN_
PARAMETERS
EOF_
WAIT_
BLOCK
EXTENT_
READ_
CACHE_
INFO_
BUFFER
FAST_
IO_
POSSIBLE
FILE_
ACCESS_
INFORMATION
FILE_
ALIGNMENT_
INFORMATION
FILE_
ALLOCATION_
INFORMATION
FILE_
ALL_
INFORMATION
FILE_
BASIC_
INFORMATION
FILE_
BOTH_
DIR_
INFORMATION
FILE_
CASE_
SENSITIVE_
INFORMATION
FILE_
COMPLETION_
INFORMATION
FILE_
COMPRESSION_
INFORMATION
FILE_
DIRECTORY_
INFORMATION
FILE_
DISPOSITION_
INFORMATION
FILE_
DISPOSITION_
INFORMATION_
EX
FILE_
DISPOSITION_
INFORMATION_
EX_
FLAGS
FILE_
EA_
INFORMATION
FILE_
END_
OF_
FILE_
INFORMATION_
EX
FILE_
FS_
ATTRIBUTE_
INFORMATION
FILE_
FS_
CONTROL_
INFORMATION
FILE_
FS_
DATA_
COPY_
INFORMATION
FILE_
FS_
DRIVER_
PATH_
INFORMATION
FILE_
FS_
SECTOR_
SIZE_
INFORMATION
FILE_
FS_
VOLUME_
FLAGS_
INFORMATION
FILE_
FULL_
DIR_
INFORMATION
FILE_
FULL_
EA_
INFORMATION
FILE_
GET_
EA_
INFORMATION
FILE_
GET_
QUOTA_
INFORMATION
FILE_
ID_
BOTH_
DIR_
INFORMATION
FILE_
ID_
EXTD_
BOTH_
DIR_
INFORMATION
FILE_
ID_
EXTD_
DIR_
INFORMATION
FILE_
ID_
FULL_
DIR_
INFORMATION
FILE_
ID_
GLOBAL_
TX_
DIR_
INFORMATION
FILE_
ID_
INFORMATION
FILE_
INFORMATION_
CLASS
FILE_
INFORMATION_
DEFINITION
FILE_
INTERNAL_
INFORMATION
FILE_
KNOWN_
FOLDER_
INFORMATION
FILE_
KNOWN_
FOLDER_
TYPE
FILE_
LINKS_
FULL_
ID_
INFORMATION
FILE_
LINKS_
INFORMATION
FILE_
LINK_
ENTRY_
FULL_
ID_
INFORMATION
FILE_
LINK_
ENTRY_
INFORMATION
FILE_
LINK_
INFORMATION
FILE_
LOCK
FILE_
LOCK_
INFO
FILE_
MAILSLOT_
QUERY_
INFORMATION
FILE_
MAILSLOT_
SET_
INFORMATION
FILE_
MODE_
INFORMATION
FILE_
MOVE_
CLUSTER_
INFORMATION
FILE_
NAMES_
INFORMATION
FILE_
NAME_
INFORMATION
FILE_
NETWORK_
OPEN_
INFORMATION
FILE_
NETWORK_
PHYSICAL_
NAME_
INFORMATION
FILE_
OBJECTID_
INFORMATION
FILE_
OBJECTID_
INFORMATION_
0_
0
FILE_
PIPE_
ASSIGN_
EVENT_
BUFFER
FILE_
PIPE_
CLIENT_
PROCESS_
BUFFER
FILE_
PIPE_
CLIENT_
PROCESS_
BUFFER_
EX
FILE_
PIPE_
CLIENT_
PROCESS_
BUFFER_
V2
FILE_
PIPE_
CREATE_
SYMLINK_
INPUT
FILE_
PIPE_
DELETE_
SYMLINK_
INPUT
FILE_
PIPE_
EVENT_
BUFFER
FILE_
PIPE_
INFORMATION
FILE_
PIPE_
LOCAL_
INFORMATION
FILE_
PIPE_
PEEK_
BUFFER
FILE_
PIPE_
REMOTE_
INFORMATION
FILE_
PIPE_
SILO_
ARRIVAL_
INPUT
FILE_
PIPE_
WAIT_
FOR_
BUFFER
FILE_
POSITION_
INFORMATION
FILE_
QUOTA_
INFORMATION
FILE_
REMOTE_
PROTOCOL_
INFORMATION
FILE_
REMOTE_
PROTOCOL_
INFORMATION_
0
FILE_
REMOTE_
PROTOCOL_
INFORMATION_
1_
0
FILE_
REMOTE_
PROTOCOL_
INFORMATION_
1_
0_
0
FILE_
REMOTE_
PROTOCOL_
INFORMATION_
1_
0_
1
FILE_
RENAME_
INFORMATION
FILE_
REPARSE_
POINT_
INFORMATION
FILE_
STANDARD_
INFORMATION
FILE_
STANDARD_
LINK_
INFORMATION
FILE_
STAT_
INFORMATION
FILE_
STAT_
LX_
INFORMATION
FILE_
STORAGE_
RESERVE_
ID_
INFORMATION
FILE_
STREAM_
INFORMATION
FILE_
TIMESTAMPS
FILE_
TRACKING_
INFORMATION
FILE_
VOLUME_
NAME_
INFORMATION
FSCTL_
GHOST_
FILE_
EXTENTS_
INPUT_
BUFFER
FSCTL_
QUERY_
GHOSTED_
FILE_
EXTENTS_
INPUT_
RANGE
FSCTL_
QUERY_
GHOSTED_
FILE_
EXTENTS_
OUTPUT
FSCTL_
QUERY_
VOLUME_
NUMA_
INFO_
OUTPUT
FSCTL_
UNMAP_
SPACE_
INPUT_
BUFFER
FSCTL_
UNMAP_
SPACE_
OUTPUT
FSRTL_
ADVANCED_
FCB_
HEADER
FSRTL_
AUXILIARY_
BUFFER
FSRTL_
CHANGE_
BACKING_
TYPE
FSRTL_
COMMON_
FCB_
HEADER
FSRTL_
COMPARISON_
RESULT
FSRTL_
MUP_
PROVIDER_
INFO_
LEVEL_
1
FSRTL_
MUP_
PROVIDER_
INFO_
LEVEL_
2
FSRTL_
PER_
FILEOBJECT_
CONTEXT
FSRTL_
PER_
FILE_
CONTEXT
FSRTL_
PER_
STREAM_
CONTEXT
FSRTL_
UNC_
PROVIDER_
REGISTRATION
FSRTL_
UNC_
PROVIDER_
REGISTRATION_
0_
0
FSRTL_
UNC_
PROVIDER_
REGISTRATION_
1_
0
FS_
BPIO_
INFO
FS_
BPIO_
INPUT
FS_
FILTER_
CALLBACKS
FS_
FILTER_
CALLBACK_
DATA
FS_
FILTER_
PARAMETERS_
0
FS_
FILTER_
PARAMETERS_
1
FS_
FILTER_
PARAMETERS_
2
FS_
FILTER_
PARAMETERS_
3
FS_
FILTER_
PARAMETERS_
4
FS_
FILTER_
SECTION_
SYNC_
OUTPUT
FS_
FILTER_
SECTION_
SYNC_
TYPE
FS_
FILTER_
STREAM_
FO_
NOTIFICATION_
TYPE
FS_
INFORMATION_
CLASS
GENERATE_
NAME_
CONTEXT
GHOSTED_
FILE_
EXTENT
HEAP_
MEMORY_
INFO_
CLASS
IO_
CREATE_
STREAM_
FILE_
OPTIONS
IO_
DEVICE_
HINT_
ECP_
CONTEXT
IO_
PRIORITY_
INFO
IO_
STOP_
ON_
SYMLINK_
FILTER_
ECP_
v0
IO_
STOP_
ON_
SYMLINK_
FILTER_
ECP_
v0_
0
KAPC_
STATE
KAPC_
STATE_
0_
0
KAPC_
STATE_
1_
0
LARGE_
MCB
LCN_
WEAK_
REFERENCE_
BUFFER
LCN_
WEAK_
REFERENCE_
CREATE_
INPUT_
BUFFER
LINK_
TRACKING_
INFORMATION
LINK_
TRACKING_
INFORMATION_
TYPE
MCB
MEMORY_
INFORMATION_
CLASS
MEMORY_
RANGE_
ENTRY
MFT_
ENUM_
DATA
MMFLUSH_
TYPE
MM_
PREFETCH_
FLAGS_
0
MSV1_
0_
AVID
MSV1_
0_
ENUMUSERS_
REQUEST
MSV1_
0_
ENUMUSERS_
RESPONSE
MSV1_
0_
GETCHALLENRESP_
REQUEST
MSV1_
0_
GETCHALLENRESP_
REQUEST_
V1
MSV1_
0_
GETCHALLENRESP_
RESPONSE
MSV1_
0_
GETUSERINFO_
REQUEST
MSV1_
0_
GETUSERINFO_
RESPONSE
MSV1_
0_
LM20_
CHALLENGE_
REQUEST
MSV1_
0_
LM20_
CHALLENGE_
RESPONSE
NETWORK_
APP_
INSTANCE_
ECP_
CONTEXT
NETWORK_
APP_
INSTANCE_
VERSION_
ECP_
CONTEXT
NETWORK_
OPEN_
ECP_
CONTEXT
NETWORK_
OPEN_
ECP_
CONTEXT_
0
NETWORK_
OPEN_
ECP_
CONTEXT_
0_
0
NETWORK_
OPEN_
ECP_
CONTEXT_
0_
1
NETWORK_
OPEN_
ECP_
CONTEXT_
V0
NETWORK_
OPEN_
ECP_
CONTEXT_
V0_
0
NETWORK_
OPEN_
ECP_
CONTEXT_
V0_
0_
0
NETWORK_
OPEN_
ECP_
CONTEXT_
V0_
0_
1
NETWORK_
OPEN_
INTEGRITY_
QUALIFIER
NETWORK_
OPEN_
LOCATION_
QUALIFIER
NFS_
OPEN_
ECP_
CONTEXT
NLSTABLEINFO
NTCREATEFILE_
CREATE_
DISPOSITION
NTCREATEFILE_
CREATE_
OPTIONS
OPEN_
REPARSE_
LIST
OPEN_
REPARSE_
LIST_
ENTRY
OPLOCK_
KEY_
CONTEXT
OPLOCK_
KEY_
ECP_
CONTEXT
OPLOCK_
NOTIFY_
PARAMS
OPLOCK_
NOTIFY_
REASON
PHYSICAL_
EXTENTS_
DESCRIPTOR
PHYSICAL_
MEMORY_
DESCRIPTOR
PHYSICAL_
MEMORY_
RUN
PREFETCH_
OPEN_
ECP_
CONTEXT
PREFIX_
TABLE
PREFIX_
TABLE_
ENTRY
PUBLIC_
BCB
QUERY_
BAD_
RANGES_
INPUT
QUERY_
DIRECT_
ACCESS_
EXTENTS
QUERY_
ON_
CREATE_
EA_
INFORMATION
QUERY_
ON_
CREATE_
ECP_
CONTEXT
QUERY_
ON_
CREATE_
FILE_
LX_
INFORMATION
QUERY_
ON_
CREATE_
FILE_
STAT_
INFORMATION
QUERY_
PATH_
REQUEST
QUERY_
PATH_
REQUEST_
EX
QUERY_
PATH_
RESPONSE
READ_
AHEAD_
PARAMETERS
READ_
LIST
READ_
USN_
JOURNAL_
DATA
REFS_
COMPRESSION_
FORMATS
REFS_
DEALLOCATE_
RANGES_
ALLOCATOR
REFS_
DEALLOCATE_
RANGES_
INPUT_
BUFFER
REFS_
DEALLOCATE_
RANGES_
INPUT_
BUFFER_
EX
REFS_
DEALLOCATE_
RANGES_
RANGE
REFS_
QUERY_
VOLUME_
COMPRESSION_
INFO_
OUTPUT_
BUFFER
REFS_
QUERY_
VOLUME_
DEDUP_
INFO_
OUTPUT_
BUFFER
REFS_
REMOVE_
HARDLINK_
BACKPOINTER
REFS_
SET_
VOLUME_
COMPRESSION_
INFO_
FLAGS
REFS_
SET_
VOLUME_
COMPRESSION_
INFO_
INPUT_
BUFFER
REFS_
SET_
VOLUME_
DEDUP_
INFO_
INPUT_
BUFFER
REFS_
STREAM_
EXTENT
REFS_
STREAM_
SNAPSHOT_
LIST_
OUTPUT_
BUFFER
REFS_
STREAM_
SNAPSHOT_
LIST_
OUTPUT_
BUFFER_
ENTRY
REFS_
STREAM_
SNAPSHOT_
MANAGEMENT_
INPUT_
BUFFER
REFS_
STREAM_
SNAPSHOT_
OPERATION
REFS_
STREAM_
SNAPSHOT_
QUERY_
DELTAS_
INPUT_
BUFFER
REFS_
STREAM_
SNAPSHOT_
QUERY_
DELTAS_
OUTPUT_
BUFFER
REFS_
VOLUME_
COUNTER_
INFO_
INPUT_
BUFFER
REFS_
VOLUME_
DATA_
BUFFER
REMOTE_
LINK_
TRACKING_
INFORMATION
REPARSE_
DATA_
BUFFER
REPARSE_
DATA_
BUFFER_
0_
0
REPARSE_
DATA_
BUFFER_
0_
1
REPARSE_
DATA_
BUFFER_
0_
2
REPARSE_
DATA_
BUFFER_
EX
REPARSE_
INDEX_
KEY
RETRIEVAL_
POINTERS_
AND_
REFCOUNT_
BUFFER
RETRIEVAL_
POINTERS_
AND_
REFCOUNT_
BUFFER_
0
RKF_
BYPASS_
ECP_
CONTEXT
RTL_
HEAP_
MEMORY_
LIMIT_
DATA
RTL_
HEAP_
MEMORY_
LIMIT_
INFO
RTL_
HEAP_
PARAMETERS
RTL_
MEMORY_
TYPE
RTL_
NLS_
STATE
RTL_
SEGMENT_
HEAP_
MEMORY_
SOURCE
RTL_
SEGMENT_
HEAP_
PARAMETERS
RTL_
SEGMENT_
HEAP_
VA_
CALLBACKS
SECURITY_
CLIENT_
CONTEXT
SEC_
APPLICATION_
PROTOCOLS
SEC_
DTLS_
MTU
SEC_
FLAGS
SEC_
NEGOTIATION_
INFO
SEC_
PRESHAREDKEY
SEC_
SRTP_
MASTER_
KEY_
IDENTIFIER
SET_
CACHED_
RUNS_
STATE_
INPUT_
BUFFER
SE_
AUDIT_
INFO
SE_
AUDIT_
OPERATION
SE_
EXPORTS
SRV_
INSTANCE_
TYPE
SRV_
OPEN_
ECP_
CONTEXT
SYSTEM_
PROCESS_
TRUST_
LABEL_
ACE
SecBuffer
SecBuffer
Desc
SecHandle
Shared
Virtual
Disk
Handle
State
Shared
Virtual
Disk
Support
Type
TUNNEL
UNICODE_
PREFIX_
TABLE
UNICODE_
PREFIX_
TABLE_
ENTRY
USN_
JOURNAL_
DATA
USN_
RECORD
VCN_
RANGE_
INPUT_
BUFFER
VIRTUAL_
MEMORY_
INFORMATION_
CLASS
VOLUME_
REFS_
INFO_
BUFFER
_LCN_
WEAK_
REFERENCE_
STATE
_REFS_
STREAM_
EXTENT_
PROPERTIES
Constants
§
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
BEST_
EFFORT
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
EOF_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
FILE_
ATTRIBUTES_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
GEN_
FLAGS_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
MARK_
USN_
SOURCE_
INFO
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
OPERATION_
MASK
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
OP_
FLAGS_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
REPARSE_
POINT_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
SPARSE_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
SUPPRESS_
DIR_
CHANGE_
NOTIFY
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
SUPPRESS_
FILE_
ATTRIBUTE_
INHERITANCE
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
SUPPRESS_
PARENT_
TIMESTAMPS_
UPDATE
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
TIMESTAMPS_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
VDL_
SPECIFIED
ATOMIC_
CREATE_
ECP_
IN_
FLAG_
WRITE_
USN_
CLOSE_
RECORD
ATOMIC_
CREATE_
ECP_
IN_
OP_
FLAG_
CASE_
SENSITIVE_
FLAGS_
SPECIFIED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
EOF_
SET
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
FILE_
ATTRIBUTES_
RETURNED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
FILE_
ATTRIBUTES_
SET
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
FILE_
ATTRIBUTE_
INHERITANCE_
SUPPRESSED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
OPERATION_
MASK
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
OP_
FLAGS_
HONORED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
REPARSE_
POINT_
SET
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
SPARSE_
SET
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
TIMESTAMPS_
RETURNED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
TIMESTAMPS_
SET
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
USN_
CLOSE_
RECORD_
WRITTEN
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
USN_
RETURNED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
USN_
SOURCE_
INFO_
MARKED
ATOMIC_
CREATE_
ECP_
OUT_
FLAG_
VDL_
SET
ATOMIC_
CREATE_
ECP_
OUT_
OP_
FLAG_
CASE_
SENSITIVE_
FLAGS_
SET
Audit
Access
Check
Audit
Close
NonObject
Audit
Close
Object
Audit
Delete
Object
Audit
Handle
Creation
Audit
Object
Reference
Audit
Open
NonObject
Audit
Open
Object
Audit
Open
Object
ForDelete
Audit
Open
Object
ForDelete
With
Transaction
Audit
Open
Object
With
Transaction
Audit
Privilege
Object
Audit
Privilege
Service
CACHE_
MANAGER_
CALLBACKS_
EX_
V1
CACHE_
USE_
DIRECT_
ACCESS_
MAPPING
CACHE_
VALID_
FLAGS
CC_
ACQUIRE_
DONT_
WAIT
CC_
ACQUIRE_
SUPPORTS_
ASYNC_
LAZYWRITE
CC_
AGGRESSIVE_
UNMAP_
BEHIND
CC_
DISABLE_
DIRTY_
PAGE_
TRACKING
CC_
DISABLE_
READ_
AHEAD
CC_
DISABLE_
UNMAP_
BEHIND
CC_
DISABLE_
WRITE_
BEHIND
CC_
ENABLE_
CPU_
CACHE
CC_
ENABLE_
DISK_
IO_
ACCOUNTING
CC_
FLUSH_
AND_
PURGE_
GATHER_
DIRTY_
BITS
CC_
FLUSH_
AND_
PURGE_
NO_
PURGE
CC_
FLUSH_
AND_
PURGE_
WRITEABLE_
VIEWS_
NOTSEEN
COMPRESSION_
ENGINE_
MASK
COMPRESSION_
ENGINE_
MAX
COMPRESSION_
FORMAT_
MASK
COMPRESSION_
FORMAT_
MAX
CREATE_
REDIRECTION_
FLAGS_
SERVICED_
FROM_
LAYER
CREATE_
REDIRECTION_
FLAGS_
SERVICED_
FROM_
REGISTERED_
LAYER
CREATE_
REDIRECTION_
FLAGS_
SERVICED_
FROM_
REMOTE_
LAYER
CREATE_
REDIRECTION_
FLAGS_
SERVICED_
FROM_
SCRATCH
CREATE_
REDIRECTION_
FLAGS_
SERVICED_
FROM_
USER_
MODE
CSV_
SET_
HANDLE_
PROPERTIES_
ECP_
CONTEXT_
FLAGS_
VALID_
ONLY_
IF_
CSV_
COORDINATOR
Change
Data
Control
Area
Change
Image
Control
Area
Change
Shared
Cache
Map
CsvCsv
FsInternal
File
Object
CsvDown
Level
File
Object
DD_
MUP_
DEVICE_
NAME
DEVICE_
RESET_
KEEP_
STACK
DEVICE_
RESET_
RESERVED_
0
DEVICE_
RESET_
RESERVED_
1
DO_
BOOT_
CRITICAL
DO_
BUFFERED_
IO
DO_
BUS_
ENUMERATED_
DEVICE
DO_
DAX_
VOLUME
DO_
DEVICE_
HAS_
NAME
DO_
DEVICE_
INITIALIZING
DO_
DEVICE_
IRP_
REQUIRES_
EXTENSION
DO_
DEVICE_
TO_
BE_
RESET
DO_
DIRECT_
IO
DO_
DISALLOW_
EXECUTE
DO_
EXCLUSIVE
DO_
FORCE_
NEITHER_
IO
DO_
LONG_
TERM_
REQUESTS
DO_
LOW_
PRIORITY_
FILESYSTEM
DO_
MAP_
IO_
BUFFER
DO_
NEVER_
LAST_
DEVICE
DO_
NOT_
PURGE_
DIRTY_
PAGES
DO_
NOT_
RETRY_
PURGE
DO_
POWER_
INRUSH
DO_
POWER_
PAGABLE
DO_
SHUTDOWN_
REGISTERED
DO_
SUPPORTS_
PERSISTENT_
ACLS
DO_
SUPPORTS_
TRANSACTIONS
DO_
SYSTEM_
BOOT_
PARTITION
DO_
SYSTEM_
CRITICAL_
PARTITION
DO_
SYSTEM_
SYSTEM_
PARTITION
DO_
VERIFY_
VOLUME
DO_
VOLUME_
DEVICE_
OBJECT
DfsLink
Tracking
Information
EA_
NAME_
NETWORK_
OPEN_
ECP_
INTEGRITY
EA_
NAME_
NETWORK_
OPEN_
ECP_
INTEGRITY_
U
EA_
NAME_
NETWORK_
OPEN_
ECP_
PRIVACY
EA_
NAME_
NETWORK_
OPEN_
ECP_
PRIVACY_
U
ECP_
OPEN_
PARAMETERS_
FLAG_
FAIL_
ON_
CASE_
SENSITIVE_
DIR
ECP_
OPEN_
PARAMETERS_
FLAG_
IGNORE_
DIR_
CASE_
SENSITIVITY
ECP_
OPEN_
PARAMETERS_
FLAG_
OPEN_
FOR_
DELETE
ECP_
OPEN_
PARAMETERS_
FLAG_
OPEN_
FOR_
READ
ECP_
OPEN_
PARAMETERS_
FLAG_
OPEN_
FOR_
WRITE
ECP_
TYPE_
CLFS_
CREATE_
CONTAINER
ECP_
TYPE_
IO_
STOP_
ON_
SYMLINK_
FILTER_
GUID
ECP_
TYPE_
OPEN_
REPARSE_
GUID
EVENT_
INCREMENT
EqualTo
FILE_
ACTION_
ADDED_
STREAM
FILE_
ACTION_
ID_
NOT_
TUNNELLED
FILE_
ACTION_
MODIFIED_
STREAM
FILE_
ACTION_
REMOVED_
BY_
DELETE
FILE_
ACTION_
REMOVED_
STREAM
FILE_
ACTION_
TUNNELLED_
ID_
COLLISION
FILE_
CLEANUP_
FILE_
DELETED
FILE_
CLEANUP_
FILE_
REMAINS
FILE_
CLEANUP_
LINK_
DELETED
FILE_
CLEANUP_
POSIX_
STYLE_
DELETE
FILE_
CLEANUP_
STREAM_
DELETED
FILE_
CLEANUP_
UNKNOWN
FILE_
CLEANUP_
WRONG_
DEVICE
FILE_
COMPLETE_
IF_
OPLOCKED
FILE_
CONTAINS_
EXTENDED_
CREATE_
INFORMATION
FILE_
CREATE
FILE_
CREATE_
TREE_
CONNECTION
FILE_
DELETE_
ON_
CLOSE
FILE_
DIRECTORY_
FILE
FILE_
DISALLOW_
EXCLUSIVE
FILE_
DISPOSITION_
DELETE
FILE_
DISPOSITION_
DO_
NOT_
DELETE
FILE_
DISPOSITION_
FORCE_
IMAGE_
SECTION_
CHECK
FILE_
DISPOSITION_
IGNORE_
READONLY_
ATTRIBUTE
FILE_
DISPOSITION_
ON_
CLOSE
FILE_
DISPOSITION_
POSIX_
SEMANTICS
FILE_
EA_
TYPE_
ASCII
FILE_
EA_
TYPE_
ASN1
FILE_
EA_
TYPE_
BINARY
FILE_
EA_
TYPE_
BITMAP
FILE_
EA_
TYPE_
EA
FILE_
EA_
TYPE_
FAMILY_
IDS
FILE_
EA_
TYPE_
ICON
FILE_
EA_
TYPE_
METAFILE
FILE_
EA_
TYPE_
MVMT
FILE_
EA_
TYPE_
MVST
FILE_
ID_
GLOBAL_
TX_
DIR_
INFO_
FLAG_
VISIBLE_
OUTSIDE_
TX
FILE_
ID_
GLOBAL_
TX_
DIR_
INFO_
FLAG_
VISIBLE_
TO_
TX
FILE_
ID_
GLOBAL_
TX_
DIR_
INFO_
FLAG_
WRITELOCKED
FILE_
LINK_
FORCE_
RESIZE_
SOURCE_
SR
FILE_
LINK_
FORCE_
RESIZE_
SR
FILE_
LINK_
FORCE_
RESIZE_
TARGET_
SR
FILE_
LINK_
IGNORE_
READONLY_
ATTRIBUTE
FILE_
LINK_
NO_
DECREASE_
AVAILABLE_
SPACE
FILE_
LINK_
NO_
INCREASE_
AVAILABLE_
SPACE
FILE_
LINK_
POSIX_
SEMANTICS
FILE_
LINK_
PRESERVE_
AVAILABLE_
SPACE
FILE_
LINK_
REPLACE_
IF_
EXISTS
FILE_
LINK_
SUPPRESS_
STORAGE_
RESERVE_
INHERITANCE
FILE_
NEED_
EA
FILE_
NON_
DIRECTORY_
FILE
FILE_
NOTIFY_
CHANGE_
EA
FILE_
NOTIFY_
CHANGE_
NAME
FILE_
NOTIFY_
CHANGE_
STREAM_
NAME
FILE_
NOTIFY_
CHANGE_
STREAM_
SIZE
FILE_
NOTIFY_
CHANGE_
STREAM_
WRITE
FILE_
NOTIFY_
VALID_
MASK
FILE_
NO_
COMPRESSION
FILE_
NO_
EA_
KNOWLEDGE
FILE_
NO_
INTERMEDIATE_
BUFFERING
FILE_
OPBATCH_
BREAK_
UNDERWAY
FILE_
OPEN
FILE_
OPEN_
BY_
FILE_
ID
FILE_
OPEN_
FOR_
BACKUP_
INTENT
FILE_
OPEN_
FOR_
FREE_
SPACE_
QUERY
FILE_
OPEN_
IF
FILE_
OPEN_
NO_
RECALL
FILE_
OPEN_
REPARSE_
POINT
FILE_
OPEN_
REQUIRING_
OPLOCK
FILE_
OPLOCK_
BROKEN_
TO_
LEVEL_
2
FILE_
OPLOCK_
BROKEN_
TO_
NONE
FILE_
OVERWRITE
FILE_
OVERWRITE_
IF
FILE_
PIPE_
ACCEPT_
REMOTE_
CLIENTS
FILE_
PIPE_
BYTE_
STREAM_
MODE
FILE_
PIPE_
BYTE_
STREAM_
TYPE
FILE_
PIPE_
CLIENT_
END
FILE_
PIPE_
CLOSING_
STATE
FILE_
PIPE_
COMPLETE_
OPERATION
FILE_
PIPE_
COMPUTER_
NAME_
LENGTH
FILE_
PIPE_
CONNECTED_
STATE
FILE_
PIPE_
DISCONNECTED_
STATE
FILE_
PIPE_
FULL_
DUPLEX
FILE_
PIPE_
INBOUND
FILE_
PIPE_
LISTENING_
STATE
FILE_
PIPE_
MESSAGE_
MODE
FILE_
PIPE_
MESSAGE_
TYPE
FILE_
PIPE_
OUTBOUND
FILE_
PIPE_
QUEUE_
OPERATION
FILE_
PIPE_
READ_
DATA
FILE_
PIPE_
REJECT_
REMOTE_
CLIENTS
FILE_
PIPE_
SERVER_
END
FILE_
PIPE_
SYMLINK_
FLAG_
GLOBAL
FILE_
PIPE_
SYMLINK_
FLAG_
RELATIVE
FILE_
PIPE_
TYPE_
VALID_
MASK
FILE_
PIPE_
WRITE_
SPACE
FILE_
RANDOM_
ACCESS
FILE_
RENAME_
FORCE_
RESIZE_
SOURCE_
SR
FILE_
RENAME_
FORCE_
RESIZE_
SR
FILE_
RENAME_
FORCE_
RESIZE_
TARGET_
SR
FILE_
RENAME_
IGNORE_
READONLY_
ATTRIBUTE
FILE_
RENAME_
NO_
DECREASE_
AVAILABLE_
SPACE
FILE_
RENAME_
NO_
INCREASE_
AVAILABLE_
SPACE
FILE_
RENAME_
POSIX_
SEMANTICS
FILE_
RENAME_
PRESERVE_
AVAILABLE_
SPACE
FILE_
RENAME_
REPLACE_
IF_
EXISTS
FILE_
RENAME_
SUPPRESS_
PIN_
STATE_
INHERITANCE
FILE_
RENAME_
SUPPRESS_
STORAGE_
RESERVE_
INHERITANCE
FILE_
RESERVE_
OPFILTER
FILE_
SEQUENTIAL_
ONLY
FILE_
SESSION_
AWARE
FILE_
SUPERSEDE
FILE_
SYNCHRONOUS_
IO_
ALERT
FILE_
SYNCHRONOUS_
IO_
NONALERT
FILE_
VC_
CONTENT_
INDEX_
DISABLED
FILE_
VC_
LOG_
QUOTA_
LIMIT
FILE_
VC_
LOG_
QUOTA_
THRESHOLD
FILE_
VC_
LOG_
VOLUME_
LIMIT
FILE_
VC_
LOG_
VOLUME_
THRESHOLD
FILE_
VC_
QUOTAS_
INCOMPLETE
FILE_
VC_
QUOTAS_
REBUILDING
FILE_
VC_
QUOTA_
ENFORCE
FILE_
VC_
QUOTA_
MASK
FILE_
VC_
QUOTA_
NONE
FILE_
VC_
QUOTA_
TRACK
FILE_
VC_
VALID_
MASK
FILE_
WRITE_
THROUGH
FLAGS_
DELAY_
REASONS_
BITMAP_
SCANNED
FLAGS_
DELAY_
REASONS_
LOG_
FILE_
FULL
FLAGS_
END_
OF_
FILE_
INFO_
EX_
EXTEND_
PAGING
FLAGS_
END_
OF_
FILE_
INFO_
EX_
NO_
EXTRA_
PAGING_
EXTEND
FLAGS_
END_
OF_
FILE_
INFO_
EX_
TIME_
CONSTRAINED
FSCTL_
LMR_
GET_
LINK_
TRACKING_
INFORMATION
FSCTL_
LMR_
SET_
LINK_
TRACKING_
INFORMATION
FSCTL_
MAILSLOT_
PEEK
FSCTL_
PIPE_
ASSIGN_
EVENT
FSCTL_
PIPE_
CREATE_
SYMLINK
FSCTL_
PIPE_
DELETE_
SYMLINK
FSCTL_
PIPE_
DISABLE_
IMPERSONATE
FSCTL_
PIPE_
DISCONNECT
FSCTL_
PIPE_
FLUSH
FSCTL_
PIPE_
GET_
CONNECTION_
ATTRIBUTE
FSCTL_
PIPE_
GET_
HANDLE_
ATTRIBUTE
FSCTL_
PIPE_
GET_
PIPE_
ATTRIBUTE
FSCTL_
PIPE_
IMPERSONATE
FSCTL_
PIPE_
INTERNAL_
READ
FSCTL_
PIPE_
INTERNAL_
READ_
OVFLOW
FSCTL_
PIPE_
INTERNAL_
TRANSCEIVE
FSCTL_
PIPE_
INTERNAL_
WRITE
FSCTL_
PIPE_
LISTEN
FSCTL_
PIPE_
PEEK
FSCTL_
PIPE_
QUERY_
CLIENT_
PROCESS
FSCTL_
PIPE_
QUERY_
CLIENT_
PROCESS_
V2
FSCTL_
PIPE_
QUERY_
EVENT
FSCTL_
PIPE_
SET_
CLIENT_
PROCESS
FSCTL_
PIPE_
SET_
CONNECTION_
ATTRIBUTE
FSCTL_
PIPE_
SET_
HANDLE_
ATTRIBUTE
FSCTL_
PIPE_
SET_
PIPE_
ATTRIBUTE
FSCTL_
PIPE_
SILO_
ARRIVAL
FSCTL_
PIPE_
TRANSCEIVE
FSCTL_
PIPE_
WAIT
FSRTL_
ADD_
TC_
CASE_
SENSITIVE
FSRTL_
ADD_
TC_
KEY_
BY_
SHORT_
NAME
FSRTL_
ALLOCATE_
ECPLIST_
FLAG_
CHARGE_
QUOTA
FSRTL_
ALLOCATE_
ECP_
FLAG_
CHARGE_
QUOTA
FSRTL_
ALLOCATE_
ECP_
FLAG_
NONPAGED_
POOL
FSRTL_
AUXILIARY_
FLAG_
DEALLOCATE
FSRTL_
CC_
FLUSH_
ERROR_
FLAG_
NO_
HARD_
ERROR
FSRTL_
CC_
FLUSH_
ERROR_
FLAG_
NO_
LOG_
ENTRY
FSRTL_
DRIVER_
BACKING_
FLAG_
USE_
PAGE_
FILE
FSRTL_
ECP_
LOOKASIDE_
FLAG_
NONPAGED_
POOL
FSRTL_
FAT_
LEGAL
FSRTL_
FCB_
HEADER_
V0
FSRTL_
FCB_
HEADER_
V1
FSRTL_
FCB_
HEADER_
V2
FSRTL_
FCB_
HEADER_
V3
FSRTL_
FCB_
HEADER_
V4
FSRTL_
FIND_
TC_
CASE_
SENSITIVE
FSRTL_
FLAG2_
BYPASSIO_
STREAM_
PAUSED
FSRTL_
FLAG2_
DO_
MODIFIED_
WRITE
FSRTL_
FLAG2_
IS_
PAGING_
FILE
FSRTL_
FLAG2_
PURGE_
WHEN_
MAPPED
FSRTL_
FLAG2_
SUPPORTS_
FILTER_
CONTEXTS
FSRTL_
FLAG2_
WRITABLE_
USER_
MAPPED_
FILE
FSRTL_
FLAG_
ACQUIRE_
MAIN_
RSRC_
EX
FSRTL_
FLAG_
ACQUIRE_
MAIN_
RSRC_
SH
FSRTL_
FLAG_
ADVANCED_
HEADER
FSRTL_
FLAG_
EOF_
ADVANCE_
ACTIVE
FSRTL_
FLAG_
FILE_
LENGTH_
CHANGED
FSRTL_
FLAG_
FILE_
MODIFIED
FSRTL_
FLAG_
LIMIT_
MODIFIED_
PAGES
FSRTL_
FLAG_
USER_
MAPPED_
FILE
FSRTL_
HPFS_
LEGAL
FSRTL_
NTFS_
LEGAL
FSRTL_
OLE_
LEGAL
FSRTL_
UNC_
HARDENING_
CAPABILITIES_
INTEGRITY
FSRTL_
UNC_
HARDENING_
CAPABILITIES_
MUTUAL_
AUTH
FSRTL_
UNC_
HARDENING_
CAPABILITIES_
PRIVACY
FSRTL_
UNC_
PROVIDER_
FLAGS_
CONTAINER_
AWARE
FSRTL_
UNC_
PROVIDER_
FLAGS_
CSC_
ENABLED
FSRTL_
UNC_
PROVIDER_
FLAGS_
DOMAIN_
SVC_
AWARE
FSRTL_
UNC_
PROVIDER_
FLAGS_
MAILSLOTS_
SUPPORTED
FSRTL_
UNC_
REGISTRATION_
CURRENT_
VERSION
FSRTL_
UNC_
REGISTRATION_
VERSION_
0200
FSRTL_
UNC_
REGISTRATION_
VERSION_
0201
FSRTL_
VIRTDISK_
FULLY_
ALLOCATED
FSRTL_
VIRTDISK_
NO_
DRIVE_
LETTER
FSRTL_
VOLUME_
BACKGROUND_
FORMAT
FSRTL_
VOLUME_
CHANGE_
SIZE
FSRTL_
VOLUME_
DISMOUNT
FSRTL_
VOLUME_
DISMOUNT_
FAILED
FSRTL_
VOLUME_
FORCED_
CLOSED
FSRTL_
VOLUME_
INFO_
MAKE_
COMPAT
FSRTL_
VOLUME_
LOCK
FSRTL_
VOLUME_
LOCK_
FAILED
FSRTL_
VOLUME_
MOUNT
FSRTL_
VOLUME_
NEEDS_
CHKDSK
FSRTL_
VOLUME_
PREPARING_
EJECT
FSRTL_
VOLUME_
UNLOCK
FSRTL_
VOLUME_
WEARING_
OUT
FSRTL_
VOLUME_
WORM_
NEAR_
FULL
FSRTL_
WILD_
CHARACTER
FS_
FILTER_
ACQUIRE_
FOR_
CC_
FLUSH
FS_
FILTER_
ACQUIRE_
FOR_
MOD_
WRITE
FS_
FILTER_
ACQUIRE_
FOR_
SECTION_
SYNCHRONIZATION
FS_
FILTER_
QUERY_
OPEN
FS_
FILTER_
RELEASE_
FOR_
CC_
FLUSH
FS_
FILTER_
RELEASE_
FOR_
MOD_
WRITE
FS_
FILTER_
RELEASE_
FOR_
SECTION_
SYNCHRONIZATION
FS_
FILTER_
SECTION_
SYNC_
IMAGE_
EXTENTS_
ARE_
NOT_
RVA
FS_
FILTER_
SECTION_
SYNC_
IN_
FLAG_
DONT_
UPDATE_
LAST_
ACCESS
FS_
FILTER_
SECTION_
SYNC_
IN_
FLAG_
DONT_
UPDATE_
LAST_
WRITE
FS_
FILTER_
SECTION_
SYNC_
SUPPORTS_
ASYNC_
PARALLEL_
IO
FS_
FILTER_
SECTION_
SYNC_
SUPPORTS_
DIRECT_
MAP_
DATA
FS_
FILTER_
SECTION_
SYNC_
SUPPORTS_
DIRECT_
MAP_
IMAGE
Fast
IoIs
NotPossible
Fast
IoIs
Possible
Fast
IoIs
Questionable
File
Access
Information
File
Alignment
Information
File
AllInformation
File
Allocation
Information
File
Alternate
Name
Information
File
Attribute
TagInformation
File
Basic
Information
File
Both
Directory
Information
File
Case
Sensitive
Information
File
Case
Sensitive
Information
Force
Access
Check
File
Completion
Information
File
Compression
Information
File
Desired
Storage
Class
Information
File
Directory
Information
File
Disposition
Information
File
Disposition
Information
Ex
File
EaInformation
File
EndOf
File
Information
File
FsAttribute
Information
File
FsControl
Information
File
FsData
Copy
Information
File
FsDevice
Information
File
FsDriver
Path
Information
File
FsFull
Size
Information
File
FsFull
Size
Information
Ex
File
FsLabel
Information
File
FsMaximum
Information
File
FsMetadata
Size
Information
File
FsObject
IdInformation
File
FsSector
Size
Information
File
FsSize
Information
File
FsVolume
Flags
Information
File
FsVolume
Information
File
Full
Directory
Information
File
Full
EaInformation
File
Hard
Link
Full
IdInformation
File
Hard
Link
Information
File
IdBoth
Directory
Information
File
IdExtd
Both
Directory
Information
File
IdExtd
Directory
Information
File
IdFull
Directory
Information
File
IdGlobal
TxDirectory
Information
File
IdInformation
File
Internal
Information
File
IoCompletion
Notification
Information
File
IoPriority
Hint
Information
File
IoStatus
Block
Range
Information
File
IsRemote
Device
Information
File
Known
Folder
Information
File
Link
Information
File
Link
Information
Bypass
Access
Check
File
Link
Information
Ex
File
Link
Information
ExBypass
Access
Check
File
Mailslot
Query
Information
File
Mailslot
SetInformation
File
Maximum
Information
File
Memory
Partition
Information
File
Mode
Information
File
Move
Cluster
Information
File
Name
Information
File
Names
Information
File
Network
Open
Information
File
Network
Physical
Name
Information
File
Normalized
Name
Information
File
Numa
Node
Information
File
Object
IdInformation
File
Pipe
Information
File
Pipe
Local
Information
File
Pipe
Remote
Information
File
Position
Information
File
Process
IdsUsing
File
Information
File
Quota
Information
File
Remote
Protocol
Information
File
Rename
Information
File
Rename
Information
Bypass
Access
Check
File
Rename
Information
Ex
File
Rename
Information
ExBypass
Access
Check
File
Reparse
Point
Information
File
Replace
Completion
Information
File
Sfio
Reserve
Information
File
Sfio
Volume
Information
File
Short
Name
Information
File
Standard
Information
File
Standard
Link
Information
File
Stat
Information
File
Stat
LxInformation
File
Storage
Reserve
IdInformation
File
Stream
Information
File
Tracking
Information
File
Unused
Information
File
Valid
Data
Length
Information
File
Volume
Name
Information
GCR_
ALLOW_
LM
GCR_
ALLOW_
NO_
TARGET
GCR_
ALLOW_
NTLM
GCR_
MACHINE_
CREDENTIAL
GCR_
NTLM3_
PARMS
GCR_
TARGET_
INFO
GCR_
USE_
OEM_
SET
GCR_
USE_
OWF_
PASSWORD
GCR_
VSM_
PROTECTED_
PASSWORD
GENERATE_
CLIENT_
CHALLENGE
GUID_
ECP_
ATOMIC_
CREATE
GUID_
ECP_
CLOUDFILES_
ATTRIBUTION
GUID_
ECP_
CREATE_
REDIRECTION
GUID_
ECP_
CSV_
DOWN_
LEVEL_
OPEN
GUID_
ECP_
CSV_
QUERY_
FILE_
REVISION
GUID_
ECP_
CSV_
QUERY_
FILE_
REVISION_
FILE_
ID_
128
GUID_
ECP_
CSV_
SET_
HANDLE_
PROPERTIES
GUID_
ECP_
DUAL_
OPLOCK_
KEY
GUID_
ECP_
IO_
DEVICE_
HINT
GUID_
ECP_
NETWORK_
APP_
INSTANCE
GUID_
ECP_
NETWORK_
APP_
INSTANCE_
VERSION
GUID_
ECP_
NETWORK_
OPEN_
CONTEXT
GUID_
ECP_
NFS_
OPEN
GUID_
ECP_
OPEN_
PARAMETERS
GUID_
ECP_
OPLOCK_
KEY
GUID_
ECP_
PREFETCH_
OPEN
GUID_
ECP_
QUERY_
ON_
CREATE
GUID_
ECP_
RKF_
BYPASS
GUID_
ECP_
SRV_
OPEN
Greater
Than
HEAP_
CLASS_
0
HEAP_
CLASS_
1
HEAP_
CLASS_
2
HEAP_
CLASS_
3
HEAP_
CLASS_
4
HEAP_
CLASS_
5
HEAP_
CLASS_
6
HEAP_
CLASS_
7
HEAP_
CLASS_
8
HEAP_
CLASS_
MASK
HEAP_
CREATE_
ALIGN_
16
HEAP_
CREATE_
ENABLE_
EXECUTE
HEAP_
CREATE_
ENABLE_
TRACING
HEAP_
CREATE_
HARDENED
HEAP_
CREATE_
SEGMENT_
HEAP
HEAP_
DISABLE_
COALESCE_
ON_
FREE
HEAP_
FREE_
CHECKING_
ENABLED
HEAP_
GENERATE_
EXCEPTIONS
HEAP_
GLOBAL_
TAG
HEAP_
GROWABLE
HEAP_
MAXIMUM_
TAG
HEAP_
NO_
SERIALIZE
HEAP_
PSEUDO_
TAG_
FLAG
HEAP_
REALLOC_
IN_
PLACE_
ONLY
HEAP_
SETTABLE_
USER_
FLAG1
HEAP_
SETTABLE_
USER_
FLAG2
HEAP_
SETTABLE_
USER_
FLAG3
HEAP_
SETTABLE_
USER_
FLAGS
HEAP_
SETTABLE_
USER_
VALUE
HEAP_
TAG_
SHIFT
HEAP_
TAIL_
CHECKING_
ENABLED
HEAP_
ZERO_
MEMORY
Heap
Memory
Basic
Information
INVALID_
PROCESSOR_
INDEX
IOCTL_
LMR_
ARE_
FILE_
OBJECTS_
ON_
SAME_
SERVER
IOCTL_
REDIR_
QUERY_
PATH
IOCTL_
REDIR_
QUERY_
PATH_
EX
IOCTL_
VOLSNAP_
FLUSH_
AND_
HOLD_
WRITES
IO_
CD_
ROM_
INCREMENT
IO_
CREATE_
STREAM_
FILE_
LITE
IO_
CREATE_
STREAM_
FILE_
RAISE_
ON_
ERROR
IO_
DISK_
INCREMENT
IO_
FILE_
OBJECT_
NON_
PAGED_
POOL_
CHARGE
IO_
FILE_
OBJECT_
PAGED_
POOL_
CHARGE
IO_
IGNORE_
READONLY_
ATTRIBUTE
IO_
MAILSLOT_
INCREMENT
IO_
MM_
PAGING_
FILE
IO_
NAMED_
PIPE_
INCREMENT
IO_
NETWORK_
INCREMENT
IO_
NO_
INCREMENT
IO_
OPEN_
PAGING_
FILE
IO_
OPEN_
TARGET_
DIRECTORY
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
0
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
1
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
2
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
3
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
4
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
5
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
6
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
7
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
8
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
9
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
A
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
B
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
C
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
D
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
E
IO_
REPARSE_
TAG_
ACRONIS_
HSM_
F
IO_
REPARSE_
TAG_
ACTIVISION_
HSM
IO_
REPARSE_
TAG_
ADA_
HSM
IO_
REPARSE_
TAG_
ADOBE_
HSM
IO_
REPARSE_
TAG_
ALERTBOOT
IO_
REPARSE_
TAG_
ALTIRIS_
HSM
IO_
REPARSE_
TAG_
APPXSTRM
IO_
REPARSE_
TAG_
ARCO_
BACKUP
IO_
REPARSE_
TAG_
ARKIVIO
IO_
REPARSE_
TAG_
AURISTOR_
FS
IO_
REPARSE_
TAG_
AUTN_
HSM
IO_
REPARSE_
TAG_
BRIDGEHEAD_
HSM
IO_
REPARSE_
TAG_
C2CSYSTEMS_
HSM
IO_
REPARSE_
TAG_
CARINGO_
HSM
IO_
REPARSE_
TAG_
CARROLL_
HSM
IO_
REPARSE_
TAG_
CITRIX_
PM
IO_
REPARSE_
TAG_
COMMVAULT
IO_
REPARSE_
TAG_
COMMVAULT_
HSM
IO_
REPARSE_
TAG_
COMTRADE_
HSM
IO_
REPARSE_
TAG_
CTERA_
HSM
IO_
REPARSE_
TAG_
DATAFIRST_
HSM
IO_
REPARSE_
TAG_
DATAGLOBAL_
HSM
IO_
REPARSE_
TAG_
DATASTOR_
SIS
IO_
REPARSE_
TAG_
DFM
IO_
REPARSE_
TAG_
DOR_
HSM
IO_
REPARSE_
TAG_
DOUBLE_
TAKE_
HSM
IO_
REPARSE_
TAG_
DOUBLE_
TAKE_
SIS
IO_
REPARSE_
TAG_
DRIVE_
EXTENDER
IO_
REPARSE_
TAG_
DROPBOX_
HSM
IO_
REPARSE_
TAG_
EASEFILTER_
HSM
IO_
REPARSE_
TAG_
EASEVAULT_
HSM
IO_
REPARSE_
TAG_
EDSI_
HSM
IO_
REPARSE_
TAG_
ELTAN_
HSM
IO_
REPARSE_
TAG_
EMC_
HSM
IO_
REPARSE_
TAG_
ENIGMA_
HSM
IO_
REPARSE_
TAG_
FILTER_
MANAGER
IO_
REPARSE_
TAG_
GLOBA
L360_
HSM
IO_
REPARSE_
TAG_
GOOGLE_
HSM
IO_
REPARSE_
TAG_
GRAU_
DATASTORAGE_
HSM
IO_
REPARSE_
TAG_
HDS_
HCP_
HSM
IO_
REPARSE_
TAG_
HDS_
HSM
IO_
REPARSE_
TAG_
HERMES_
HSM
IO_
REPARSE_
TAG_
HP_
BACKUP
IO_
REPARSE_
TAG_
HP_
DATA_
PROTECT
IO_
REPARSE_
TAG_
HP_
HSM
IO_
REPARSE_
TAG_
HSAG_
HSM
IO_
REPARSE_
TAG_
HUBSTOR_
HSM
IO_
REPARSE_
TAG_
IFSTEST_
CONGRUENT
IO_
REPARSE_
TAG_
IIS_
CACHE
IO_
REPARSE_
TAG_
IMANAGE_
HSM
IO_
REPARSE_
TAG_
INTERCOPE_
HSM
IO_
REPARSE_
TAG_
ITSTATION
IO_
REPARSE_
TAG_
KOM_
NETWORKS_
HSM
IO_
REPARSE_
TAG_
LX_
BLK
IO_
REPARSE_
TAG_
LX_
CHR
IO_
REPARSE_
TAG_
LX_
FIFO
IO_
REPARSE_
TAG_
LX_
SYMLINK
IO_
REPARSE_
TAG_
MAGINATICS_
RDR
IO_
REPARSE_
TAG_
MAXISCALE_
HSM
IO_
REPARSE_
TAG_
MEMORY_
TECH_
HSM
IO_
REPARSE_
TAG_
MIMOSA_
HSM
IO_
REPARSE_
TAG_
MOONWALK_
HSM
IO_
REPARSE_
TAG_
MTALOS
IO_
REPARSE_
TAG_
NEUSHIELD
IO_
REPARSE_
TAG_
NEXSAN_
HSM
IO_
REPARSE_
TAG_
NIPPON_
HSM
IO_
REPARSE_
TAG_
NVIDIA_
UNIONFS
IO_
REPARSE_
TAG_
OPENAFS_
DFS
IO_
REPARSE_
TAG_
OSR_
SAMPLE
IO_
REPARSE_
TAG_
OVERTONE
IO_
REPARSE_
TAG_
POINTSOFT_
HSM
IO_
REPARSE_
TAG_
QI_
TECH_
HSM
IO_
REPARSE_
TAG_
QUADDRA_
HSM
IO_
REPARSE_
TAG_
QUEST_
HSM
IO_
REPARSE_
TAG_
REDSTOR_
HSM
IO_
REPARSE_
TAG_
RIVERBED_
HSM
IO_
REPARSE_
TAG_
SER_
HSM
IO_
REPARSE_
TAG_
SHX_
BACKUP
IO_
REPARSE_
TAG_
SOLUTIONSOFT
IO_
REPARSE_
TAG_
SONY_
HSM
IO_
REPARSE_
TAG_
SPHARSOFT
IO_
REPARSE_
TAG_
SYMANTEC_
HSM
IO_
REPARSE_
TAG_
SYMANTEC_
HSM2
IO_
REPARSE_
TAG_
TSINGHUA_
UNIVERSITY_
RESEARCH
IO_
REPARSE_
TAG_
UTIXO_
HSM
IO_
REPARSE_
TAG_
VALID_
VALUES
IO_
REPARSE_
TAG_
VMWARE_
PM
IO_
REPARSE_
TAG_
WATERFORD
IO_
REPARSE_
TAG_
WISDATA_
HSM
IO_
REPARSE_
TAG_
ZLTI_
HSM
IO_
STOP_
ON_
SYMLINK
Known
Folder
Desktop
Known
Folder
Documents
Known
Folder
Downloads
Known
Folder
Max
Known
Folder
Music
Known
Folder
None
Known
Folder
Other
Known
Folder
Pictures
Known
Folder
Videos
LCN_
CHECKSUM_
VALID
LCN_
WEAK_
REFERENCE_
VALID
LX_
FILE_
CASE_
SENSITIVE_
DIR
LX_
FILE_
METADATA_
DEVICE_
ID_
EA_
NAME
LX_
FILE_
METADATA_
GID_
EA_
NAME
LX_
FILE_
METADATA_
HAS_
DEVICE_
ID
LX_
FILE_
METADATA_
HAS_
GID
LX_
FILE_
METADATA_
HAS_
MODE
LX_
FILE_
METADATA_
HAS_
UID
LX_
FILE_
METADATA_
MODE_
EA_
NAME
LX_
FILE_
METADATA_
UID_
EA_
NAME
Less
Than
MAP_
DISABLE_
PAGEFAULT_
CLUSTERING
MAP_
HIGH_
PRIORITY
MAP_
NO_
READ
MAP_
WAIT
MAXIMUM_
LEADBYTES
MAX_
UNICODE_
STACK_
BUFFER_
LENGTH
MCB_
FLAG_
RAISE_
ON_
ALLOCATION_
FAILURE
MM_
FORCE_
CLOSED_
DATA
MM_
FORCE_
CLOSED_
IMAGE
MM_
FORCE_
CLOSED_
LATER_
OK
MM_
IS_
FILE_
SECTION_
ACTIVE_
DATA
MM_
IS_
FILE_
SECTION_
ACTIVE_
IMAGE
MM_
IS_
FILE_
SECTION_
ACTIVE_
USER
Memory
Basic
Information
Memory
Type64K
Page
Memory
Type
Custom
Memory
Type
Huge
Page
Memory
Type
Large
Page
Memory
Type
Max
Memory
Type
NonPaged
Memory
Type
Paged
MmFlush
ForDelete
MmFlush
ForWrite
MsvAv
Channel
Bindings
MsvAv
DnsComputer
Name
MsvAv
DnsDomain
Name
MsvAv
DnsTree
Name
MsvAvEOL
MsvAv
Flags
MsvAv
NbComputer
Name
MsvAv
NbDomain
Name
MsvAv
Restrictions
MsvAv
Target
Name
MsvAv
Timestamp
NETWORK_
OPEN_
ECP_
IN_
FLAG_
DISABLE_
HANDLE_
COLLAPSING
NETWORK_
OPEN_
ECP_
IN_
FLAG_
DISABLE_
HANDLE_
DURABILITY
NETWORK_
OPEN_
ECP_
IN_
FLAG_
DISABLE_
OPLOCKS
NETWORK_
OPEN_
ECP_
IN_
FLAG_
FORCE_
BUFFERED_
SYNCHRONOUS_
IO_
HACK
NETWORK_
OPEN_
ECP_
IN_
FLAG_
FORCE_
MAX_
EOF_
HACK
NETWORK_
OPEN_
ECP_
IN_
FLAG_
REQ_
MUTUAL_
AUTH
NETWORK_
OPEN_
ECP_
OUT_
FLAG_
RET_
MUTUAL_
AUTH
NO_
8DOT3_
NAME_
PRESENT
Network
Open
Integrity
Any
Network
Open
Integrity
Encrypted
Network
Open
Integrity
Maximum
Network
Open
Integrity
None
Network
Open
Integrity
Signed
Network
Open
Location
Any
Network
Open
Location
Loopback
Network
Open
Location
Remote
Notify
Type
Create
Notify
Type
Retired
Ntfs
Link
Tracking
Information
OPEN_
REPARSE_
POINT_
OVERRIDE_
CREATE_
OPTION
OPEN_
REPARSE_
POINT_
REPARSE_
ALWAYS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
CHILD_
EXISTS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
CHILD_
NOT_
EXISTS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
DIRECTORY_
FINAL_
COMPONENT
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
DIRECTORY_
FINAL_
COMPONENT_
ALWAYS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
FINAL_
COMPONENT
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
FINAL_
COMPONENT_
ALWAYS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
NON_
DIRECTORY_
FINAL_
COMPONENT
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
NON_
DIRECTORY_
FINAL_
COMPONENT_
ALWAYS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
NON_
DIRECTORY_
NON_
FINAL_
COMPONENT
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
NON_
DIRECTORY_
NON_
FINAL_
COMPONENT_
ALWAYS
OPEN_
REPARSE_
POINT_
REPARSE_
IF_
NON_
FINAL_
COMPONENT
OPEN_
REPARSE_
POINT_
RETURN_
REPARSE_
DATA_
BUFFER
OPEN_
REPARSE_
POINT_
TAG_
ENCOUNTERED
OPEN_
REPARSE_
POINT_
VERSION_
EX
OPLOCK_
FLAG_
BACK_
OUT_
ATOMIC_
OPLOCK
OPLOCK_
FLAG_
BREAKING_
FOR_
SHARING_
VIOLATION
OPLOCK_
FLAG_
CLOSING_
DELETE_
ON_
CLOSE
OPLOCK_
FLAG_
COMPLETE_
IF_
OPLOCKED
OPLOCK_
FLAG_
IGNORE_
OPLOCK_
KEYS
OPLOCK_
FLAG_
OPLOCK_
KEY_
CHECK_
ONLY
OPLOCK_
FLAG_
PARENT_
OBJECT
OPLOCK_
FLAG_
REMOVING_
FILE_
OR_
LINK
OPLOCK_
FSCTRL_
FLAG_
ALL_
KEYS_
MATCH
OPLOCK_
NOTIFY_
BREAK_
WAIT_
INTERIM_
TIMEOUT
OPLOCK_
NOTIFY_
BREAK_
WAIT_
TERMINATED
OPLOCK_
UPPER_
FLAG_
CHECK_
NO_
BREAK
OPLOCK_
UPPER_
FLAG_
NOTIFY_
REFRESH_
READ
PIN_
CALLER_
TRACKS_
DIRTY_
DATA
PIN_
EXCLUSIVE
PIN_
HIGH_
PRIORITY
PIN_
IF_
BCB
PIN_
NO_
READ
PIN_
VERIFY_
REQUIRED
PIN_
WAIT
POLICY_
AUDIT_
SUBCATEGORY_
COUNT
PO_
CB_
AC_
STATUS
PO_
CB_
BUTTON_
COLLISION
PO_
CB_
LID_
SWITCH_
STATE
PO_
CB_
PROCESSOR_
POWER_
POLICY
PO_
CB_
SYSTEM_
POWER_
POLICY
PO_
CB_
SYSTEM_
STATE_
LOCK
PSMP_
MAXIMUM_
SYSAPP_
CLAIM_
VALUES
PSMP_
MINIMUM_
SYSAPP_
CLAIM_
VALUES
PURGE_
WITH_
ACTIVE_
VIEWS
QUERY_
DIRECT_
ACCESS_
DATA_
EXTENTS
QUERY_
DIRECT_
ACCESS_
IMAGE_
EXTENTS
QoCFile
EaInformation
QoCFile
LxInformation
QoCFile
Stat
Information
REFS_
COMPRESSION_
FORMAT_
LZ4
REFS_
COMPRESSION_
FORMAT_
MAX
REFS_
COMPRESSION_
FORMAT_
UNCOMPRESSED
REFS_
COMPRESSION_
FORMAT_
ZSTD
REFS_
DEALLOCATE_
RANGES_
ALLOCATOR_
CAA
REFS_
DEALLOCATE_
RANGES_
ALLOCATOR_
MAA
REFS_
DEALLOCATE_
RANGES_
ALLOCATOR_
NONE
REFS_
DEALLOCATE_
RANGES_
ALLOCATOR_
SAA
REFS_
SET_
VOLUME_
COMPRESSION_
INFO_
FLAG_
COMPRESS_
SYNC
REFS_
SET_
VOLUME_
COMPRESSION_
INFO_
FLAG_
MAX
REFS_
STREAM_
EXTENT_
PROPERTY_
CRC32
REFS_
STREAM_
EXTENT_
PROPERTY_
CRC64
REFS_
STREAM_
EXTENT_
PROPERTY_
GHOSTED
REFS_
STREAM_
EXTENT_
PROPERTY_
READONLY
REFS_
STREAM_
EXTENT_
PROPERTY_
SPARSE
REFS_
STREAM_
EXTENT_
PROPERTY_
STREAM_
RESERVED
REFS_
STREAM_
EXTENT_
PROPERTY_
VALID
REFS_
STREAM_
SNAPSHOT_
OPERATION_
CLEAR_
SHADOW_
BTREE
REFS_
STREAM_
SNAPSHOT_
OPERATION_
CREATE
REFS_
STREAM_
SNAPSHOT_
OPERATION_
INVALID
REFS_
STREAM_
SNAPSHOT_
OPERATION_
LIST
REFS_
STREAM_
SNAPSHOT_
OPERATION_
MAX
REFS_
STREAM_
SNAPSHOT_
OPERATION_
QUERY_
DELTAS
REFS_
STREAM_
SNAPSHOT_
OPERATION_
REVERT
REFS_
STREAM_
SNAPSHOT_
OPERATION_
SET_
SHADOW_
BTREE
REMOTE_
PROTOCOL_
FLAG_
INTEGRITY
REMOTE_
PROTOCOL_
FLAG_
LOOPBACK
REMOTE_
PROTOCOL_
FLAG_
MUTUAL_
AUTH
REMOTE_
PROTOCOL_
FLAG_
OFFLINE
REMOTE_
PROTOCOL_
FLAG_
PERSISTENT_
HANDLE
REMOTE_
PROTOCOL_
FLAG_
PRIVACY
REMOVED_
8DOT3_
NAME
REPARSE_
DATA_
EX_
FLAG_
GIVEN_
TAG_
OR_
NONE
RETURN_
NON_
NT_
USER_
SESSION_
KEY
RETURN_
PRIMARY_
LOGON_
DOMAINNAME
RETURN_
PRIMARY_
USERNAME
RETURN_
RESERVED_
PARAMETER
RPI_
SMB2_
SERVERCAP_
DFS
RPI_
SMB2_
SERVERCAP_
DIRECTORY_
LEASING
RPI_
SMB2_
SERVERCAP_
ENCRYPTION_
AWARE
RPI_
SMB2_
SERVERCAP_
LARGEMTU
RPI_
SMB2_
SERVERCAP_
LEASING
RPI_
SMB2_
SERVERCAP_
MULTICHANNEL
RPI_
SMB2_
SERVERCAP_
PERSISTENT_
HANDLES
RPI_
SMB2_
SHARECAP_
ACCESS_
BASED_
DIRECTORY_
ENUM
RPI_
SMB2_
SHARECAP_
ASYMMETRIC_
SCALEOUT
RPI_
SMB2_
SHARECAP_
CLUSTER
RPI_
SMB2_
SHARECAP_
CONTINUOUS_
AVAILABILITY
RPI_
SMB2_
SHARECAP_
DFS
RPI_
SMB2_
SHARECAP_
ENCRYPTED
RPI_
SMB2_
SHARECAP_
IDENTITY_
REMOTING
RPI_
SMB2_
SHARECAP_
SCALEOUT
RPI_
SMB2_
SHARECAP_
TIMEWARP
RPI_
SMB2_
SHARETYPE_
DISK
RPI_
SMB2_
SHARETYPE_
PIPE
RPI_
SMB2_
SHARETYPE_
PRINT
RTL_
DUPLICATE_
UNICODE_
STRING_
ALLOCATE_
NULL_
STRING
RTL_
DUPLICATE_
UNICODE_
STRING_
NULL_
TERMINATE
RTL_
HEAP_
MEMORY_
LIMIT_
CURRENT_
VERSION
RTL_
SYSTEM_
VOLUME_
INFORMATION_
FOLDER
SECURITY_
ANONYMOUS_
LOGON_
RID
SEGMENT_
HEAP_
FLG_
USE_
PAGE_
HEAP
SEGMENT_
HEAP_
PARAMETERS_
VERSION
SEGMENT_
HEAP_
PARAMS_
VALID_
FLAGS
SEMAPHORE_
INCREMENT
SET_
PURGE_
FAILURE_
MODE_
DISABLED
SE_
BACKUP_
PRIVILEGES_
CHECKED
SE_
DACL_
UNTRUSTED
SE_
SERVER_
SECURITY
SPECIAL_
ENCRYPTED_
OPEN
SRV_
OPEN_
ECP_
CONTEXT_
VERSION_
2
SUPPORTED_
FS_
FEATURES_
BYPASS_
IO
SUPPORTED_
FS_
FEATURES_
OFFLOAD_
READ
SUPPORTED_
FS_
FEATURES_
OFFLOAD_
WRITE
SUPPORTED_
FS_
FEATURES_
QUERY_
OPEN
SYMLINK_
DIRECTORY
SYMLINK_
FILE
SYMLINK_
FLAG_
RELATIVE
SYMLINK_
RESERVED_
MASK
SYSTEM_
PAGE_
PRIORITY_
BITS
Shared
Virtual
DiskCDP
Snapshots
Supported
Shared
Virtual
Disk
Handle
State
File
Shared
Shared
Virtual
Disk
Handle
State
Handle
Shared
Shared
Virtual
Disk
Handle
State
None
Shared
Virtual
Disk
Snapshots
Supported
Shared
Virtual
Disks
Supported
Shared
Virtual
Disks
Unsupported
SrvInstance
Type
Csv
SrvInstance
Type
Primary
SrvInstance
TypeSBL
SrvInstance
TypeSR
SrvInstance
Type
Undefined
SrvInstance
TypeVSMB
Sync
Type
Create
Section
Sync
Type
Other
TOKEN_
AUDIT_
NO_
CHILD_
PROCESS
TOKEN_
AUDIT_
REDIRECTION_
TRUST
TOKEN_
DO_
NOT_
USE_
GLOBAL_
ATTRIBS_
FOR_
QUERY
TOKEN_
ENFORCE_
REDIRECTION_
TRUST
TOKEN_
HAS_
BACKUP_
PRIVILEGE
TOKEN_
HAS_
IMPERSONATE_
PRIVILEGE
TOKEN_
HAS_
OWN_
CLAIM_
ATTRIBUTES
TOKEN_
HAS_
RESTORE_
PRIVILEGE
TOKEN_
HAS_
TRAVERSE_
PRIVILEGE
TOKEN_
IS_
FILTERED
TOKEN_
IS_
RESTRICTED
TOKEN_
LEARNING_
MODE_
LOGGING
TOKEN_
LOWBOX
TOKEN_
NOT_
LOW
TOKEN_
NO_
CHILD_
PROCESS
TOKEN_
NO_
CHILD_
PROCESS_
UNLESS_
SECURE
TOKEN_
PERMISSIVE_
LEARNING_
MODE
TOKEN_
PRIVATE_
NAMESPACE
TOKEN_
SANDBOX_
INERT
TOKEN_
SESSION_
NOT_
REFERENCED
TOKEN_
UIACCESS
TOKEN_
VIRTUALIZE_
ALLOWED
TOKEN_
VIRTUALIZE_
ENABLED
TOKEN_
WRITE_
RESTRICTED
UNINITIALIZE_
CACHE_
MAPS
USE_
PRIMARY_
PASSWORD
USN_
DELETE_
FLAG_
DELETE
VACB_
MAPPING_
GRANULARITY
VACB_
OFFSET_
SHIFT
VALID_
INHERIT_
FLAGS
VOLSNAPCONTROLTYPE
VmPrefetch
Information
WCIFS_
REDIRECTION_
FLAGS_
CREATE_
SERVICED_
FROM_
LAYER
WCIFS_
REDIRECTION_
FLAGS_
CREATE_
SERVICED_
FROM_
REGISTERED_
LAYER
WCIFS_
REDIRECTION_
FLAGS_
CREATE_
SERVICED_
FROM_
REMOTE_
LAYER
WCIFS_
REDIRECTION_
FLAGS_
CREATE_
SERVICED_
FROM_
SCRATCH
Functions
§
Apply
Control
Token
⚠
CcAsync
Copy
Read
⚠
CcCanI
Write
⚠
CcCoherency
Flush
AndPurge
Cache
⚠
CcCopy
Read
⚠
CcCopy
Read
Ex
⚠
CcCopy
Write
⚠
CcCopy
Write
Ex
⚠
CcCopy
Write
Wont
Flush
⚠
CcDefer
Write
⚠
CcError
Callback
Routine
⚠
CcFast
Copy
Read
⚠
CcFast
Copy
Write
⚠
CcFlush
Cache
⚠
CcGet
Dirty
Pages
⚠
CcGet
File
Object
From
Bcb
⚠
CcGet
File
Object
From
Section
Ptrs
⚠
CcGet
File
Object
From
Section
Ptrs
Ref
⚠
CcGet
Flushed
Valid
Data
⚠
CcInitialize
Cache
Map
⚠
CcInitialize
Cache
MapEx
⚠
CcIs
Cache
Manager
Callback
Needed
⚠
CcIs
There
Dirty
Data
⚠
CcIs
There
Dirty
Data
Ex
⚠
CcMap
Data
⚠
CcMdl
Read
⚠
CcMdl
Read
Complete
⚠
CcMdl
Write
Abort
⚠
CcMdl
Write
Complete
⚠
CcPin
Mapped
Data
⚠
CcPin
Read
⚠
CcPrepare
MdlWrite
⚠
CcPrepare
PinWrite
⚠
CcPurge
Cache
Section
⚠
CcRemap
Bcb
⚠
CcRepin
Bcb
⚠
CcSchedule
Read
Ahead
⚠
CcSchedule
Read
Ahead
Ex
⚠
CcSet
Additional
Cache
Attributes
⚠
CcSet
Additional
Cache
Attributes
Ex
⚠
CcSet
BcbOwner
Pointer
⚠
CcSet
Dirty
Page
Threshold
⚠
CcSet
Dirty
Pinned
Data
⚠
CcSet
File
Sizes
⚠
CcSet
File
Sizes
Ex
⚠
CcSet
LogHandle
ForFile
⚠
CcSet
Parallel
Flush
File
⚠
CcSet
Read
Ahead
Granularity
⚠
CcUninitialize
Cache
Map
⚠
CcUnpin
Data
⚠
CcUnpin
Data
ForThread
⚠
CcUnpin
Repinned
Bcb
⚠
CcWait
ForCurrent
Lazy
Writer
Activity
⚠
CcZero
Data
⚠
Complete
Auth
Token
⚠
ExDisable
Resource
Boost
Lite
⚠
ExQuery
Pool
Block
Size
⚠
Export
Security
Context
⚠
FsRtl
Acknowledge
Ecp
⚠
FsRtl
Acquire
File
Exclusive
⚠
FsRtl
AddBase
McbEntry
⚠
FsRtl
AddBase
McbEntry
Ex
⚠
FsRtl
AddLarge
McbEntry
⚠
FsRtl
AddMcb
Entry
⚠
FsRtl
AddTo
Tunnel
Cache
⚠
FsRtl
AddTo
Tunnel
Cache
Ex
⚠
FsRtl
Allocate
AePush
Lock
⚠
FsRtl
Allocate
Extra
Create
Parameter
⚠
FsRtl
Allocate
Extra
Create
Parameter
From
Lookaside
List
⚠
FsRtl
Allocate
Extra
Create
Parameter
List
⚠
FsRtl
Allocate
File
Lock
⚠
FsRtl
Allocate
Resource
⚠
FsRtl
AreNames
Equal
⚠
FsRtl
AreThere
Current
OrIn
Progress
File
Locks
⚠
FsRtl
AreThere
Waiting
File
Locks
⚠
FsRtl
AreVolume
Startup
Applications
Complete
⚠
FsRtl
Balance
Reads
⚠
FsRtl
Cancellable
Wait
ForMultiple
Objects
⚠
FsRtl
Cancellable
Wait
ForSingle
Object
⚠
FsRtl
Change
Backing
File
Object
⚠
FsRtl
Check
Lock
ForOplock
Request
⚠
FsRtl
Check
Lock
ForRead
Access
⚠
FsRtl
Check
Lock
ForWrite
Access
⚠
FsRtl
Check
Oplock
⚠
FsRtl
Check
Oplock
Ex
⚠
FsRtl
Check
Oplock
Ex2
⚠
FsRtl
Check
Upper
Oplock
⚠
FsRtl
Copy
Read
⚠
FsRtl
Copy
Write
⚠
FsRtl
Create
Section
ForData
Scan
⚠
FsRtl
Current
Batch
Oplock
⚠
FsRtl
Current
Oplock
⚠
FsRtl
Current
OplockH
⚠
FsRtl
Delete
Extra
Create
Parameter
Lookaside
List
⚠
FsRtl
Delete
KeyFrom
Tunnel
Cache
⚠
FsRtl
Delete
Tunnel
Cache
⚠
FsRtl
Deregister
UncProvider
⚠
FsRtl
Dismount
Complete
⚠
FsRtl
Dissect
Dbcs
⚠
FsRtl
Dissect
Name
⚠
FsRtl
Does
Dbcs
Contain
Wild
Cards
⚠
FsRtl
Does
Name
Contain
Wild
Cards
⚠
FsRtl
Fast
Check
Lock
ForRead
⚠
FsRtl
Fast
Check
Lock
ForWrite
⚠
FsRtl
Fast
Unlock
All
⚠
FsRtl
Fast
Unlock
AllBy
Key
⚠
FsRtl
Fast
Unlock
Single
⚠
FsRtl
Find
Extra
Create
Parameter
⚠
FsRtl
Find
InTunnel
Cache
⚠
FsRtl
Find
InTunnel
Cache
Ex
⚠
FsRtl
Free
AePush
Lock
⚠
FsRtl
Free
Extra
Create
Parameter
⚠
FsRtl
Free
Extra
Create
Parameter
List
⚠
FsRtl
Free
File
Lock
⚠
FsRtl
GetCurrent
Process
Loader
List
⚠
FsRtl
GetEcp
List
From
Irp
⚠
FsRtl
GetFile
Size
⚠
FsRtl
GetNext
Base
McbEntry
⚠
FsRtl
GetNext
Extra
Create
Parameter
⚠
FsRtl
GetNext
File
Lock
⚠
FsRtl
GetNext
Large
McbEntry
⚠
FsRtl
GetNext
McbEntry
⚠
FsRtl
GetSector
Size
Information
⚠
FsRtl
GetSupported
Features
⚠
FsRtl
GetVirtual
Disk
Nesting
Level
⚠
FsRtl
Increment
CcFast
MdlRead
Wait
⚠
FsRtl
Increment
CcFast
Read
NoWait
⚠
FsRtl
Increment
CcFast
Read
NotPossible
⚠
FsRtl
Increment
CcFast
Read
Resource
Miss
⚠
FsRtl
Increment
CcFast
Read
Wait
⚠
FsRtl
Init
Extra
Create
Parameter
Lookaside
List
⚠
FsRtl
Initialize
Base
Mcb
⚠
FsRtl
Initialize
Base
McbEx
⚠
FsRtl
Initialize
Extra
Create
Parameter
⚠
FsRtl
Initialize
Extra
Create
Parameter
List
⚠
FsRtl
Initialize
File
Lock
⚠
FsRtl
Initialize
Large
Mcb
⚠
FsRtl
Initialize
Mcb
⚠
FsRtl
Initialize
Oplock
⚠
FsRtl
Initialize
Tunnel
Cache
⚠
FsRtl
Insert
Extra
Create
Parameter
⚠
FsRtl
Insert
PerFile
Context
⚠
FsRtl
Insert
PerFile
Object
Context
⚠
FsRtl
Insert
PerStream
Context
⚠
FsRtl
Is32
BitProcess
⚠
FsRtl
IsDax
Volume
⚠
FsRtl
IsDbcs
InExpression
⚠
FsRtl
IsEcp
Acknowledged
⚠
FsRtl
IsEcp
From
User
Mode
⚠
FsRtl
IsExtent
Dangling
⚠
FsRtl
IsFat
Dbcs
Legal
⚠
FsRtl
IsHpfs
Dbcs
Legal
⚠
FsRtl
IsMobileOS
⚠
FsRtl
IsName
InExpression
⚠
FsRtl
IsName
InUn
Upcased
Expression
⚠
FsRtl
IsNon
Empty
Directory
Reparse
Point
Allowed
⚠
FsRtl
IsNtstatus
Expected
⚠
FsRtl
IsPaging
File
⚠
FsRtl
IsSystem
Paging
File
⚠
FsRtl
Issue
Device
IoControl
⚠
FsRtl
Kernel
FsControl
File
⚠
FsRtl
LogCc
Flush
Error
⚠
FsRtl
Lookup
Base
McbEntry
⚠
FsRtl
Lookup
Large
McbEntry
⚠
FsRtl
Lookup
Last
Base
McbEntry
⚠
FsRtl
Lookup
Last
Base
McbEntry
AndIndex
⚠
FsRtl
Lookup
Last
Large
McbEntry
⚠
FsRtl
Lookup
Last
Large
McbEntry
AndIndex
⚠
FsRtl
Lookup
Last
McbEntry
⚠
FsRtl
Lookup
McbEntry
⚠
FsRtl
Lookup
PerFile
Context
⚠
FsRtl
Lookup
PerFile
Object
Context
⚠
FsRtl
Lookup
PerStream
Context
Internal
⚠
FsRtl
MdlRead
Complete
Dev
⚠
FsRtl
MdlRead
Dev
⚠
FsRtl
MdlRead
Ex
⚠
FsRtl
MdlWrite
Complete
Dev
⚠
FsRtl
MupGet
Provider
IdFrom
Name
⚠
FsRtl
MupGet
Provider
Info
From
File
Object
⚠
FsRtl
Normalize
Ntstatus
⚠
FsRtl
Notify
Cleanup
⚠
FsRtl
Notify
Cleanup
All
⚠
FsRtl
Notify
Filter
Change
Directory
⚠
FsRtl
Notify
Filter
Report
Change
⚠
FsRtl
Notify
Full
Change
Directory
⚠
FsRtl
Notify
Full
Report
Change
⚠
FsRtl
Notify
Initialize
Sync
⚠
FsRtl
Notify
Uninitialize
Sync
⚠
FsRtl
Notify
Volume
Event
⚠
FsRtl
Notify
Volume
Event
Ex
⚠
FsRtl
Number
OfRuns
InBase
Mcb
⚠
FsRtl
Number
OfRuns
InLarge
Mcb
⚠
FsRtl
Number
OfRuns
InMcb
⚠
FsRtl
Oplock
BreakH
⚠
FsRtl
Oplock
Break
H2
⚠
FsRtl
Oplock
Break
ToNone
⚠
FsRtl
Oplock
Break
ToNone
Ex
⚠
FsRtl
Oplock
Fsctrl
⚠
FsRtl
Oplock
Fsctrl
Ex
⚠
FsRtl
Oplock
GetAny
Break
Owner
Process
⚠
FsRtl
Oplock
IsFast
IoPossible
⚠
FsRtl
Oplock
IsShared
Request
⚠
FsRtl
Oplock
Keys
Equal
⚠
FsRtl
Post
Paging
File
Stack
Overflow
⚠
FsRtl
Post
Stack
Overflow
⚠
FsRtl
Prepare
MdlWrite
Dev
⚠
FsRtl
Prepare
MdlWrite
Ex
⚠
FsRtl
Prepare
ToReuse
Ecp
⚠
FsRtl
Private
Lock
⚠
FsRtl
Process
File
Lock
⚠
FsRtl
Query
Cached
Vdl
⚠
FsRtl
Query
Information
File
⚠
FsRtl
Query
Kernel
EaFile
⚠
FsRtl
Query
Maximum
Virtual
Disk
Nesting
Level
⚠
FsRtl
Register
File
System
Filter
Callbacks
⚠
FsRtl
Register
UncProvider
⚠
FsRtl
Register
UncProvider
Ex
⚠
FsRtl
Register
UncProvider
Ex2
⚠
FsRtl
Release
File
⚠
FsRtl
Remove
Base
McbEntry
⚠
FsRtl
Remove
Dots
From
Path
⚠
FsRtl
Remove
Extra
Create
Parameter
⚠
FsRtl
Remove
Large
McbEntry
⚠
FsRtl
Remove
McbEntry
⚠
FsRtl
Remove
PerFile
Context
⚠
FsRtl
Remove
PerFile
Object
Context
⚠
FsRtl
Remove
PerStream
Context
⚠
FsRtl
Reset
Base
Mcb
⚠
FsRtl
Reset
Large
Mcb
⚠
FsRtl
SetDriver
Backing
⚠
FsRtl
SetEcp
List
Into
Irp
⚠
FsRtl
SetKernel
EaFile
⚠
FsRtl
Split
Base
Mcb
⚠
FsRtl
Split
Large
Mcb
⚠
FsRtl
Teardown
PerFile
Contexts
⚠
FsRtl
Teardown
PerStream
Contexts
⚠
FsRtl
Truncate
Base
Mcb
⚠
FsRtl
Truncate
Large
Mcb
⚠
FsRtl
Truncate
Mcb
⚠
FsRtl
Uninitialize
Base
Mcb
⚠
FsRtl
Uninitialize
File
Lock
⚠
FsRtl
Uninitialize
Large
Mcb
⚠
FsRtl
Uninitialize
Mcb
⚠
FsRtl
Uninitialize
Oplock
⚠
FsRtl
Update
Disk
Counters
⚠
FsRtl
Upper
Oplock
Fsctrl
⚠
FsRtl
Validate
Reparse
Point
Buffer
⚠
FsRtl
Volume
Device
ToCorrelation
Id
⚠
GetSecurity
User
Info
⚠
IoAcquire
VpbSpin
Lock
⚠
IoApply
Priority
Info
Thread
⚠
IoCheck
Desired
Access
⚠
IoCheck
EaBuffer
Validity
⚠
IoCheck
Function
Access
⚠
IoCheck
Query
SetFile
Information
⚠
IoCheck
Query
SetVolume
Information
⚠
IoCheck
Quota
Buffer
Validity
⚠
IoClear
FsTrack
Offset
State
⚠
IoCreate
Stream
File
Object
⚠
IoCreate
Stream
File
Object
Ex
⚠
IoCreate
Stream
File
Object
Ex2
⚠
IoCreate
Stream
File
Object
Lite
⚠
IoEnumerate
Device
Object
List
⚠
IoEnumerate
Registered
Filters
List
⚠
IoFast
Query
Network
Attributes
⚠
IoGet
Attached
Device
⚠
IoGet
Base
File
System
Device
Object
⚠
IoGet
Device
Attachment
Base
Ref
⚠
IoGet
Device
ToVerify
⚠
IoGet
Disk
Device
Object
⚠
IoGet
FsTrack
Offset
State
⚠
IoGet
Lower
Device
Object
⚠
IoGet
Oplock
KeyContext
⚠
IoGet
Oplock
KeyContext
Ex
⚠
IoGet
Requestor
Process
⚠
IoGet
Requestor
Process
Id
⚠
IoGet
Requestor
Session
Id
⚠
IoIrp
HasFs
Track
Offset
Extension
Type
⚠
IoIs
Operation
Synchronous
⚠
IoIs
System
Thread
⚠
IoIs
Valid
Name
Grafting
Buffer
⚠
IoPage
Read
⚠
IoQuery
File
DosDevice
Name
⚠
IoQuery
File
Information
⚠
IoQuery
Volume
Information
⚠
IoQueue
Thread
Irp
⚠
IoRegister
File
System
⚠
IoRegister
FsRegistration
Change
⚠
IoRegister
FsRegistration
Change
Mount
Aware
⚠
IoRelease
VpbSpin
Lock
⚠
IoReplace
File
Object
Name
⚠
IoRequest
Device
Removal
ForReset
⚠
IoRetrieve
Priority
Info
⚠
IoSet
Device
ToVerify
⚠
IoSet
FsTrack
Offset
State
⚠
IoSet
Information
⚠
IoSynchronous
Page
Write
⚠
IoThread
ToProcess
⚠
IoUnregister
File
System
⚠
IoUnregister
FsRegistration
Change
⚠
IoVerify
Volume
⚠
KeAcquire
Queued
Spin
Lock
⚠
KeAcquire
Spin
Lock
Raise
ToSynch
⚠
KeAttach
Process
⚠
KeDetach
Process
⚠
KeInitialize
Mutant
⚠
KeInitialize
Queue
⚠
KeInsert
Head
Queue
⚠
KeInsert
Queue
⚠
KeRead
State
Mutant
⚠
KeRead
State
Queue
⚠
KeRelease
Mutant
⚠
KeRelease
Queued
Spin
Lock
⚠
KeRemove
Queue
⚠
KeRemove
Queue
Ex
⚠
KeRundown
Queue
⚠
KeSet
Ideal
Processor
Thread
⚠
KeSet
Kernel
Stack
Swap
Enable
⚠
KeStack
Attach
Process
⚠
KeTry
ToAcquire
Queued
Spin
Lock
⚠
KeUnstack
Detach
Process
⚠
Make
Signature
⚠
MapSecurity
Error
⚠
MmCan
File
BeTruncated
⚠
MmDoes
File
Have
User
Writable
References
⚠
MmFlush
Image
Section
⚠
MmForce
Section
Closed
⚠
MmForce
Section
Closed
Ex
⚠
MmGet
Maximum
File
Section
Size
⚠
MmIs
File
Section
Active
⚠
MmIs
Recursive
IoFault
⚠
MmMdl
Pages
AreZero
⚠
MmPrefetch
Pages
⚠
MmSet
Address
Range
Modified
⚠
NtAccess
Check
AndAudit
Alarm
⚠
NtAccess
Check
ByType
AndAudit
Alarm
⚠
NtAccess
Check
ByType
Result
List
AndAudit
Alarm
⚠
NtAccess
Check
ByType
Result
List
AndAudit
Alarm
ByHandle
⚠
NtAdjust
Groups
Token
⚠
NtAdjust
Privileges
Token
⚠
NtAllocate
Virtual
Memory
⚠
NtAllocate
Virtual
Memory
Ex
⚠
NtCancel
IoFile
Ex
⚠
NtClose
Object
Audit
Alarm
⚠
NtCreate
Directory
Object
⚠
NtCreate
Event
⚠
NtCreate
File
⚠
NtCreate
Section
⚠
NtCreate
Section
Ex
⚠
NtDelete
File
⚠
NtDelete
Object
Audit
Alarm
⚠
NtDuplicate
Object
⚠
NtDuplicate
Token
⚠
NtFilter
Token
⚠
NtFlush
Buffers
File
⚠
NtFlush
Buffers
File
Ex
⚠
NtFlush
Virtual
Memory
⚠
NtFree
Virtual
Memory
⚠
NtFs
Control
File
⚠
NtImpersonate
Anonymous
Token
⚠
NtLock
File
⚠
NtNotify
Change
Key
⚠
NtOpen
Directory
Object
⚠
NtOpen
File
⚠
NtOpen
Object
Audit
Alarm
⚠
NtOpen
Process
Token
⚠
NtOpen
Process
Token
Ex
⚠
NtOpen
Symbolic
Link
Object
⚠
NtOpen
Thread
Token
⚠
NtOpen
Thread
Token
Ex
⚠
NtPrivilege
Check
⚠
NtPrivilege
Object
Audit
Alarm
⚠
NtPrivileged
Service
Audit
Alarm
⚠
NtQuery
Directory
File
⚠
NtQuery
Directory
File
Ex
⚠
NtQuery
Directory
Object
⚠
NtQuery
EaFile
⚠
NtQuery
Full
Attributes
File
⚠
NtQuery
Information
ByName
⚠
NtQuery
Information
File
⚠
NtQuery
Information
Token
⚠
NtQuery
Quota
Information
File
⚠
NtQuery
Security
Object
⚠
NtQuery
Symbolic
Link
Object
⚠
NtQuery
Virtual
Memory
⚠
NtQuery
Volume
Information
File
⚠
NtRead
File
⚠
NtSet
EaFile
⚠
NtSet
Event
⚠
NtSet
Information
File
⚠
NtSet
Information
Token
⚠
NtSet
Information
Virtual
Memory
⚠
NtSet
Quota
Information
File
⚠
NtSet
Security
Object
⚠
NtSet
Volume
Information
File
⚠
NtUnlock
File
⚠
NtWrite
File
⚠
ObInsert
Object
⚠
ObIs
Kernel
Handle
⚠
ObMake
Temporary
Object
⚠
ObOpen
Object
ByPointer
⚠
ObOpen
Object
ByPointer
With
Tag
⚠
ObQuery
Name
String
⚠
ObQuery
Object
Auditing
ByHandle
⚠
PfxFind
Prefix
⚠
PfxInitialize
⚠
PfxInsert
Prefix
⚠
PfxRemove
Prefix
⚠
PoQueue
Shutdown
Work
Item
⚠
PsAssign
Impersonation
Token
⚠
PsCharge
Pool
Quota
⚠
PsCharge
Process
Pool
Quota
⚠
PsDereference
Impersonation
Token
⚠
PsDereference
Primary
Token
⚠
PsDisable
Impersonation
⚠
PsGet
Process
Exit
Time
⚠
PsGet
Thread
Process
⚠
PsImpersonate
Client
⚠
PsIs
Disk
Counters
Enabled
⚠
PsIs
System
Thread
⚠
PsIs
Thread
Terminating
⚠
PsLookup
Process
ByProcess
Id
⚠
PsLookup
Thread
ByThread
Id
⚠
PsReference
Impersonation
Token
⚠
PsReference
Primary
Token
⚠
PsRestore
Impersonation
⚠
PsReturn
Pool
Quota
⚠
PsRevert
ToSelf
⚠
PsUpdate
Disk
Counters
⚠
Query
Security
Context
Token
⚠
RtlAbsolute
ToSelf
RelativeSD
⚠
RtlAdd
Access
Allowed
Ace
⚠
RtlAdd
Access
Allowed
AceEx
⚠
RtlAdd
Ace
⚠
RtlAllocate
AndInitialize
Sid
⚠
RtlAllocate
AndInitialize
SidEx
⚠
RtlAllocate
Heap
⚠
RtlAppend
String
ToString
⚠
RtlCompare
Altitudes
⚠
RtlCompare
Memory
Ulong
⚠
RtlCompress
Buffer
⚠
RtlCompress
Chunks
⚠
RtlCopy
Luid
⚠
RtlCopy
Sid
⚠
RtlCreate
Acl
⚠
RtlCreate
Heap
⚠
RtlCreate
Service
Sid
⚠
RtlCreate
System
Volume
Information
Folder
⚠
RtlCreate
Unicode
String
⚠
RtlCreate
Virtual
Account
Sid
⚠
RtlCustomCP
ToUnicodeN
⚠
RtlDecompress
Buffer
⚠
RtlDecompress
Buffer
Ex
⚠
RtlDecompress
Buffer
Ex2
⚠
RtlDecompress
Chunks
⚠
RtlDecompress
Fragment
⚠
RtlDecompress
Fragment
Ex
⚠
RtlDelete
Ace
⚠
RtlDescribe
Chunk
⚠
RtlDestroy
Heap
⚠
RtlDos
Path
Name
ToNt
Path
Name_
U_
With
Status
⚠
RtlDowncase
Unicode
String
⚠
RtlDuplicate
Unicode
String
⚠
RtlEqual
Prefix
Sid
⚠
RtlEqual
Sid
⚠
RtlFind
Unicode
Prefix
⚠
RtlFree
Heap
⚠
RtlFree
Sid
⚠
RtlGenerate8dot3
Name
⚠
RtlGet
Ace
⚠
RtlGet
Compression
Work
Space
Size
⚠
RtlGet
Dacl
Security
Descriptor
⚠
RtlGet
Group
Security
Descriptor
⚠
RtlGet
Owner
Security
Descriptor
⚠
RtlGet
Sacl
Security
Descriptor
⚠
RtlIdentifier
Authority
Sid
⚠
RtlIdn
ToAscii
⚠
RtlIdn
ToNameprep
Unicode
⚠
RtlIdn
ToUnicode
⚠
RtlInit
Code
Page
Table
⚠
RtlInit
Unicode
String
Ex
⚠
RtlInitialize
Sid
⚠
RtlInitialize
SidEx
⚠
RtlInitialize
Unicode
Prefix
⚠
RtlInsert
Unicode
Prefix
⚠
RtlIs
Cloud
Files
Placeholder
⚠
RtlIs
DosDevice
Name_
U
⚠
RtlIs
NonEmpty
Directory
Reparse
Point
Allowed
⚠
RtlIs
Normalized
String
⚠
RtlIs
Partial
Placeholder
⚠
RtlIs
Partial
Placeholder
File
Handle
⚠
RtlIs
Partial
Placeholder
File
Info
⚠
RtlIs
Sandboxed
Token
⚠
RtlIs
Valid
OemCharacter
⚠
RtlLength
Required
Sid
⚠
RtlLength
Sid
⚠
RtlMulti
Byte
ToUnicodeN
⚠
RtlMulti
Byte
ToUnicode
Size
⚠
RtlNext
Unicode
Prefix
⚠
RtlNormalize
String
⚠
RtlNt
Status
ToDos
Error
NoTeb
⚠
RtlOem
String
ToCounted
Unicode
String
⚠
RtlOem
String
ToUnicode
String
⚠
RtlOem
ToUnicodeN
⚠
RtlPrefix
String
⚠
RtlQuery
Package
Identity
⚠
RtlQuery
Package
Identity
Ex
⚠
RtlQuery
Process
Placeholder
Compatibility
Mode
⚠
RtlQuery
Thread
Placeholder
Compatibility
Mode
⚠
RtlRandom
⚠
RtlRandom
Ex
⚠
RtlRemove
Unicode
Prefix
⚠
RtlReplace
SidIn
Sd
⚠
RtlReserve
Chunk
⚠
RtlSeconds
Since1970
ToTime
⚠
RtlSeconds
Since1980
ToTime
⚠
RtlSelf
Relative
ToAbsoluteSD
⚠
RtlSet
Group
Security
Descriptor
⚠
RtlSet
Owner
Security
Descriptor
⚠
RtlSet
Process
Placeholder
Compatibility
Mode
⚠
RtlSet
Thread
Placeholder
Compatibility
Mode
⚠
RtlSub
Authority
Count
Sid
⚠
RtlSub
Authority
Sid
⚠
RtlTime
ToSeconds
Since1980
⚠
RtlUnicode
String
ToCounted
OemString
⚠
RtlUnicode
ToCustomCPN
⚠
RtlUnicode
ToMulti
ByteN
⚠
RtlUnicode
ToOemN
⚠
RtlUpcase
Unicode
String
ToCounted
OemString
⚠
RtlUpcase
Unicode
String
ToOem
String
⚠
RtlUpcase
Unicode
ToCustomCPN
⚠
RtlUpcase
Unicode
ToMulti
ByteN
⚠
RtlUpcase
Unicode
ToOemN
⚠
RtlValid
Sid
⚠
RtlValidate
Unicode
String
⚠
Rtlx
OemString
ToUnicode
Size
⚠
Rtlx
Unicode
String
ToOem
Size
⚠
SeAccess
Check
From
State
⚠
SeAccess
Check
From
State
Ex
⚠
SeAdjust
Access
State
ForAccess
Constraints
⚠
SeAdjust
Access
State
ForTrust
Label
⚠
SeAdjust
Object
Security
⚠
SeAppend
Privileges
⚠
SeAudit
Fips
Crypto
Selftests
⚠
SeAudit
Hard
Link
Creation
⚠
SeAudit
Hard
Link
Creation
With
Transaction
⚠
SeAudit
Transaction
State
Change
⚠
SeAuditing
AnyFile
Events
With
Context
⚠
SeAuditing
AnyFile
Events
With
Context
Ex
⚠
SeAuditing
File
Events
⚠
SeAuditing
File
Events
With
Context
⚠
SeAuditing
File
Events
With
Context
Ex
⚠
SeAuditing
File
OrGlobal
Events
⚠
SeAuditing
Hard
Link
Events
⚠
SeAuditing
Hard
Link
Events
With
Context
⚠
SeCapture
Subject
Context
Ex
⚠
SeCheck
ForCritical
AceRemoval
⚠
SeCreate
Client
Security
⚠
SeCreate
Client
Security
From
Subject
Context
⚠
SeDelete
Client
Security
⚠
SeDelete
Object
Audit
Alarm
⚠
SeDelete
Object
Audit
Alarm
With
Transaction
⚠
SeExamine
Sacl
⚠
SeFilter
Token
⚠
SeFree
Privileges
⚠
SeImpersonate
Client
⚠
SeImpersonate
Client
Ex
⚠
SeLocate
Process
Image
Name
⚠
SeMark
Logon
Session
ForTermination
Notification
⚠
SeMark
Logon
Session
ForTermination
Notification
Ex
⚠
SeOpen
Object
Audit
Alarm
⚠
SeOpen
Object
Audit
Alarm
With
Transaction
⚠
SeOpen
Object
ForDelete
Audit
Alarm
⚠
SeOpen
Object
ForDelete
Audit
Alarm
With
Transaction
⚠
SePrivilege
Check
⚠
SeQuery
Authentication
IdToken
⚠
SeQuery
Information
Token
⚠
SeQuery
Security
Descriptor
Info
⚠
SeQuery
Server
Silo
Token
⚠
SeQuery
Session
IdToken
⚠
SeQuery
Session
IdToken
Ex
⚠
SeRegister
Logon
Session
Terminated
Routine
⚠
SeRegister
Logon
Session
Terminated
Routine
Ex
⚠
SeReport
Security
Event
With
SubCategory
⚠
SeSet
Access
State
Generic
Mapping
⚠
SeSet
Security
Descriptor
Info
⚠
SeSet
Security
Descriptor
Info
Ex
⚠
SeShould
Check
ForAccess
Rights
From
Parent
⚠
SeToken
From
Access
Information
⚠
SeToken
IsAdmin
⚠
SeToken
IsRestricted
⚠
SeToken
IsWrite
Restricted
⚠
SeToken
Type
⚠
SeUnregister
Logon
Session
Terminated
Routine
⚠
SeUnregister
Logon
Session
Terminated
Routine
Ex
⚠
SecLookup
Account
Name
⚠
SecLookup
Account
Sid
⚠
SecLookup
Well
Known
Sid
⚠
SecMakeSPN
⚠
SecMakeSPN
Ex
⚠
SecMakeSPN
Ex2
⚠
SetContext
AttributesW
⚠
Sspi
Accept
Security
Context
Async
⚠
Sspi
Acquire
Credentials
Handle
AsyncA
⚠
Sspi
Acquire
Credentials
Handle
AsyncW
⚠
Sspi
Create
Async
Context
⚠
Sspi
Delete
Security
Context
Async
⚠
Sspi
Free
Async
Context
⚠
Sspi
Free
Credentials
Handle
Async
⚠
Sspi
GetAsync
Call
Status
⚠
Sspi
Initialize
Security
Context
AsyncA
⚠
Sspi
Initialize
Security
Context
AsyncW
⚠
Sspi
Reinit
Async
Context
⚠
Sspi
SetAsync
Notify
Callback
⚠
Verify
Signature
⚠
ZwAccess
Check
AndAudit
Alarm
⚠
ZwAccess
Check
ByType
AndAudit
Alarm
⚠
ZwAccess
Check
ByType
Result
List
AndAudit
Alarm
⚠
ZwAccess
Check
ByType
Result
List
AndAudit
Alarm
ByHandle
⚠
ZwAdjust
Groups
Token
⚠
ZwAdjust
Privileges
Token
⚠
ZwAllocate
Virtual
Memory
⚠
ZwAllocate
Virtual
Memory
Ex
⚠
ZwCancel
IoFile
Ex
⚠
ZwClose
Object
Audit
Alarm
⚠
ZwCreate
Directory
Object
⚠
ZwCreate
Event
⚠
ZwCreate
Section
Ex
⚠
ZwDelete
File
⚠
ZwDelete
Object
Audit
Alarm
⚠
ZwDuplicate
Object
⚠
ZwDuplicate
Token
⚠
ZwFilter
Token
⚠
ZwFlush
Buffers
File
⚠
ZwFlush
Buffers
File
Ex
⚠
ZwFlush
Virtual
Memory
⚠
ZwFree
Virtual
Memory
⚠
ZwFs
Control
File
⚠
ZwImpersonate
Anonymous
Token
⚠
ZwLock
File
⚠
ZwNotify
Change
Key
⚠
ZwOpen
Directory
Object
⚠
ZwOpen
Object
Audit
Alarm
⚠
ZwOpen
Process
Token
⚠
ZwOpen
Process
Token
Ex
⚠
ZwOpen
Thread
Token
⚠
ZwOpen
Thread
Token
Ex
⚠
ZwPrivilege
Check
⚠
ZwPrivilege
Object
Audit
Alarm
⚠
ZwPrivileged
Service
Audit
Alarm
⚠
ZwQuery
Directory
File
⚠
ZwQuery
Directory
File
Ex
⚠
ZwQuery
Directory
Object
⚠
ZwQuery
EaFile
⚠
ZwQuery
Full
Attributes
File
⚠
ZwQuery
Information
Token
⚠
ZwQuery
Object
⚠
ZwQuery
Quota
Information
File
⚠
ZwQuery
Security
Object
⚠
ZwQuery
Virtual
Memory
⚠
ZwQuery
Volume
Information
File
⚠
ZwSet
EaFile
⚠
ZwSet
Event
⚠
ZwSet
Information
Token
⚠
ZwSet
Information
Virtual
Memory
⚠
ZwSet
Quota
Information
File
⚠
ZwSet
Security
Object
⚠
ZwSet
Volume
Information
File
⚠
ZwUnlock
File
⚠
Type Aliases
§
ALLOCATE_
VIRTUAL_
MEMORY_
EX_
CALLBACK
FREE_
VIRTUAL_
MEMORY_
EX_
CALLBACK
PACQUIRE_
FOR_
LAZY_
WRITE
PACQUIRE_
FOR_
LAZY_
WRITE_
EX
PACQUIRE_
FOR_
READ_
AHEAD
PALLOCATE_
VIRTUAL_
MEMORY_
EX_
CALLBACK
PASYNC_
READ_
COMPLETION_
CALLBACK
PCC_
POST_
DEFERRED_
WRITE
PCHECK_
FOR_
TRAVERSE_
ACCESS
PCOMPLETE_
LOCK_
IRP_
ROUTINE
PDIRTY_
PAGE_
ROUTINE
PFILTER_
REPORT_
CHANGE
PFLUSH_
TO_
LSN
PFN_
FSRTLTEARDOWNPERSTREAMCONTEXTS
PFREE_
VIRTUAL_
MEMORY_
EX_
CALLBACK
PFSRTL_
EXTRA_
CREATE_
PARAMETER_
CLEANUP_
CALLBACK
PFSRTL_
STACK_
OVERFLOW_
ROUTINE
PFS_
FILTER_
CALLBACK
PFS_
FILTER_
COMPLETION_
CALLBACK
POPLOCK_
FS_
PREPOST_
IRP
POPLOCK_
NOTIFY_
ROUTINE
POPLOCK_
WAIT_
COMPLETE_
ROUTINE
PQUERY_
LOG_
USAGE
PQUERY_
VIRTUAL_
MEMORY_
CALLBACK
PRELEASE_
FROM_
LAZY_
WRITE
PRELEASE_
FROM_
READ_
AHEAD
PRTL_
ALLOCATE_
STRING_
ROUTINE
PRTL_
FREE_
STRING_
ROUTINE
PRTL_
HEAP_
COMMIT_
ROUTINE
PRTL_
REALLOCATE_
STRING_
ROUTINE
PSE_
LOGON_
SESSION_
TERMINATED_
ROUTINE
PSE_
LOGON_
SESSION_
TERMINATED_
ROUTINE_
EX
PUNLOCK_
ROUTINE
QUERY_
VIRTUAL_
MEMORY_
CALLBACK
RTL_
ALLOCATE_
STRING_
ROUTINE
RTL_
FREE_
STRING_
ROUTINE
RTL_
HEAP_
COMMIT_
ROUTINE
RTL_
REALLOCATE_
STRING_
ROUTINE
SE_
LOGON_
SESSION_
TERMINATED_
ROUTINE
SE_
LOGON_
SESSION_
TERMINATED_
ROUTINE_
EX
Sspi
Async
Notify
Callback
Unions
§
FILE_
LINK_
INFORMATION_
0
FILE_
OBJECTID_
INFORMATION_
0
FILE_
REMOTE_
PROTOCOL_
INFORMATION_
1
FILE_
RENAME_
INFORMATION_
0
FSRTL_
ADVANCED_
FCB_
HEADER_
0
FSRTL_
UNC_
PROVIDER_
REGISTRATION_
0
FSRTL_
UNC_
PROVIDER_
REGISTRATION_
1
FS_
FILTER_
PARAMETERS
KAPC_
STATE_
0
KAPC_
STATE_
1
MM_
PREFETCH_
FLAGS
REPARSE_
DATA_
BUFFER_
0
REPARSE_
DATA_
BUFFER_
EX_
0
RTL_
SEGMENT_
HEAP_
MEMORY_
SOURCE_
0