text: /*
   * PROJECT:   Veil
   * FILE:      Veil.h
   * PURPOSE:   Definition for the Windows Internal API from ntdll.dll,
   *            samlib.dll and winsta.dll
   *
   * LICENSE:   Relicensed under The MIT License from The CC BY 4.0 License
   *
   * DEVELOPER: MiroKaku (50670906+MiroKaku@users.noreply.github.com)
   */
  
  /*
   * PROJECT:   Mouri's Internal NT API Collections (MINT)
   * FILE:      MINT.h
   * PURPOSE:   Definition for the Windows Internal API from ntdll.dll,
   *            samlib.dll and winsta.dll
   *
   * LICENSE:   Relicensed under The MIT License from The CC BY 4.0 License
   *
   * DEVELOPER: Mouri_Naruto (Mouri_Naruto AT Outlook.com)
   */
  
  /*
   * This file is part of the Process Hacker project - https://processhacker.sf.io/
   *
   * You can redistribute this file and/or modify it under the terms of the
   * Attribution 4.0 International (CC BY 4.0) license.
   *
   * You must give appropriate credit, provide a link to the license, and
   * indicate if changes were made. You may do so in any reasonable manner, but
   * not in any way that suggests the licensor endorses you or your use.
   */
  
  #pragma once
  
  // Warnings which disabled for compiling
  #if _MSC_VER >= 1200
  #pragma warning(push)
  // nonstandard extension used : nameless struct/union
  #pragma warning(disable:4201)
  // 'struct_name' : structure was padded due to __declspec(align())
  #pragma warning(disable:4324)
  // 'enumeration': a forward declaration of an unscoped enumeration must have an
  // underlying type (int assumed)
  #pragma warning(disable:4471)
  #endif
  
  VEIL_BEGIN()
  
  #ifndef _KERNEL_MODE
  // Create disposition
  
  #define FILE_SUPERSEDE                  0x00000000
  #define FILE_OPEN                       0x00000001
  #define FILE_CREATE                     0x00000002
  #define FILE_OPEN_IF                    0x00000003
  #define FILE_OVERWRITE                  0x00000004
  #define FILE_OVERWRITE_IF               0x00000005
  #define FILE_MAXIMUM_DISPOSITION        0x00000005
  
  // Create/open flags
  
  #define FILE_DIRECTORY_FILE             0x00000001
  #define FILE_WRITE_THROUGH              0x00000002
  #define FILE_SEQUENTIAL_ONLY            0x00000004
  #define FILE_NO_INTERMEDIATE_BUFFERING  0x00000008
  
  #define FILE_SYNCHRONOUS_IO_ALERT       0x00000010
  #define FILE_SYNCHRONOUS_IO_NONALERT    0x00000020
  #define FILE_NON_DIRECTORY_FILE         0x00000040
  #define FILE_CREATE_TREE_CONNECTION     0x00000080
  
  #define FILE_COMPLETE_IF_OPLOCKED       0x00000100
  #define FILE_NO_EA_KNOWLEDGE            0x00000200
  #define FILE_OPEN_FOR_RECOVERY          0x00000400
  #define FILE_RANDOM_ACCESS              0x00000800
  
  #define FILE_DELETE_ON_CLOSE            0x00001000
  #define FILE_OPEN_BY_FILE_ID            0x00002000
  #define FILE_OPEN_FOR_BACKUP_INTENT     0x00004000
  #define FILE_NO_COMPRESSION             0x00008000
  #if (NTDDI_VERSION >= NTDDI_WIN7)
  #define FILE_OPEN_REQUIRING_OPLOCK      0x00010000
  #define FILE_DISALLOW_EXCLUSIVE         0x00020000
  #endif
  #if (NTDDI_VERSION >= NTDDI_WIN8)
  #define FILE_SESSION_AWARE              0x00040000
  #endif
  
  #define FILE_RESERVE_OPFILTER           0x00100000
  #define FILE_OPEN_REPARSE_POINT         0x00200000
  #define FILE_OPEN_NO_RECALL             0x00400000
  #define FILE_OPEN_FOR_FREE_SPACE_QUERY  0x00800000
  
  #define FILE_COPY_STRUCTURED_STORAGE    0x00000041
  #define FILE_STRUCTURED_STORAGE         0x00000441
  
  // I/O status information values for NtCreateFile/NtOpenFile
  
  #define FILE_SUPERSEDED                 0x00000000
  #define FILE_OPENED                     0x00000001
  #define FILE_CREATED                    0x00000002
  #define FILE_OVERWRITTEN                0x00000003
  #define FILE_EXISTS                     0x00000004
  #define FILE_DOES_NOT_EXIST             0x00000005
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS3)
  //
  // Define the QueryFlags values for NtQueryDirectoryFileEx.
  //
  
  #define FILE_QUERY_RESTART_SCAN                 0x00000001
  #define FILE_QUERY_RETURN_SINGLE_ENTRY          0x00000002
  #define FILE_QUERY_INDEX_SPECIFIED              0x00000004
  #define FILE_QUERY_RETURN_ON_DISK_ENTRIES_ONLY  0x00000008
  #endif
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
  #define FILE_QUERY_NO_CURSOR_UPDATE             0x00000010
  #endif
  
  // Special ByteOffset parameters
  
  #define FILE_WRITE_TO_END_OF_FILE       0xffffffff
  #define FILE_USE_FILE_POINTER_POSITION  0xfffffffe
  
  // Alignment requirement values
  
  #define FILE_BYTE_ALIGNMENT             0x00000000
  #define FILE_WORD_ALIGNMENT             0x00000001
  #define FILE_LONG_ALIGNMENT             0x00000003
  #define FILE_QUAD_ALIGNMENT             0x00000007
  #define FILE_OCTA_ALIGNMENT             0x0000000f
  #define FILE_32_BYTE_ALIGNMENT          0x0000001f
  #define FILE_64_BYTE_ALIGNMENT          0x0000003f
  #define FILE_128_BYTE_ALIGNMENT         0x0000007f
  #define FILE_256_BYTE_ALIGNMENT         0x000000ff
  #define FILE_512_BYTE_ALIGNMENT         0x000001ff
  
  // Maximum length of a filename string
  
  #define MAXIMUM_FILENAME_LENGTH         256
  
  // Extended attributes
  
  #define FILE_NEED_EA                    0x00000080
  
  #define FILE_EA_TYPE_BINARY             0xfffe
  #define FILE_EA_TYPE_ASCII              0xfffd
  #define FILE_EA_TYPE_BITMAP             0xfffb
  #define FILE_EA_TYPE_METAFILE           0xfffa
  #define FILE_EA_TYPE_ICON               0xfff9
  #define FILE_EA_TYPE_EA                 0xffee
  #define FILE_EA_TYPE_MVMT               0xffdf
  #define FILE_EA_TYPE_MVST               0xffde
  #define FILE_EA_TYPE_ASN1               0xffdd
  #define FILE_EA_TYPE_FAMILY_IDS         0xff01
  
  // Device characteristics
  
  #define FILE_REMOVABLE_MEDIA            0x00000001
  #define FILE_READ_ONLY_DEVICE           0x00000002
  #define FILE_FLOPPY_DISKETTE            0x00000004
  #define FILE_WRITE_ONCE_MEDIA           0x00000008
  #define FILE_REMOTE_DEVICE              0x00000010
  #define FILE_DEVICE_IS_MOUNTED          0x00000020
  #define FILE_VIRTUAL_VOLUME             0x00000040
  #define FILE_AUTOGENERATED_DEVICE_NAME  0x00000080
  #define FILE_DEVICE_SECURE_OPEN         0x00000100
  #define FILE_CHARACTERISTIC_PNP_DEVICE  0x00000800
  #define FILE_CHARACTERISTIC_TS_DEVICE   0x00001000
  #define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000
  #define FILE_CHARACTERISTIC_CSV         0x00010000
  #define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
  #define FILE_PORTABLE_DEVICE            0x00040000
  #define FILE_REMOTE_DEVICE_VSMB         0x00080000
  #define FILE_DEVICE_REQUIRE_SECURITY_CHECK 0x00100000
  
  // Named pipe values
  
  // NamedPipeType for NtCreateNamedPipeFile
  #define FILE_PIPE_BYTE_STREAM_TYPE      0x00000000
  #define FILE_PIPE_MESSAGE_TYPE          0x00000001
  #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
  #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
  #define FILE_PIPE_TYPE_VALID_MASK       0x00000003
  
  // CompletionMode for NtCreateNamedPipeFile
  #define FILE_PIPE_QUEUE_OPERATION       0x00000000
  #define FILE_PIPE_COMPLETE_OPERATION    0x00000001
  
  // ReadMode for NtCreateNamedPipeFile
  #define FILE_PIPE_BYTE_STREAM_MODE      0x00000000
  #define FILE_PIPE_MESSAGE_MODE          0x00000001
  
  // NamedPipeConfiguration for NtQueryInformationFile
  #define FILE_PIPE_INBOUND               0x00000000
  #define FILE_PIPE_OUTBOUND              0x00000001
  #define FILE_PIPE_FULL_DUPLEX           0x00000002
  
  // NamedPipeState for NtQueryInformationFile
  #define FILE_PIPE_DISCONNECTED_STATE    0x00000001
  #define FILE_PIPE_LISTENING_STATE       0x00000002
  #define FILE_PIPE_CONNECTED_STATE       0x00000003
  #define FILE_PIPE_CLOSING_STATE         0x00000004
  
  // NamedPipeEnd for NtQueryInformationFile
  #define FILE_PIPE_CLIENT_END            0x00000000
  #define FILE_PIPE_SERVER_END            0x00000001
  
  #endif // !_KERNEL_MODE
  
  // Win32 pipe instance limit (0xff)
  #define FILE_PIPE_UNLIMITED_INSTANCES   0xffffffff 
  
  // Mailslot values
  
  #define MAILSLOT_SIZE_AUTO 0
  
  // private
  typedef struct _FILE_IO_COMPLETION_INFORMATION
  {
      PVOID KeyContext;
      PVOID ApcContext;
      IO_STATUS_BLOCK IoStatusBlock;
  } FILE_IO_COMPLETION_INFORMATION, * PFILE_IO_COMPLETION_INFORMATION;
  
  #ifndef _KERNEL_MODE
  typedef enum _FILE_INFORMATION_CLASS
  {
      FileDirectoryInformation = 1, // FILE_DIRECTORY_INFORMATION
      FileFullDirectoryInformation, // FILE_FULL_DIR_INFORMATION
      FileBothDirectoryInformation, // FILE_BOTH_DIR_INFORMATION
      FileBasicInformation, // FILE_BASIC_INFORMATION
      FileStandardInformation, // FILE_STANDARD_INFORMATION
      FileInternalInformation, // FILE_INTERNAL_INFORMATION
      FileEaInformation, // FILE_EA_INFORMATION
      FileAccessInformation, // FILE_ACCESS_INFORMATION
      FileNameInformation, // FILE_NAME_INFORMATION
      FileRenameInformation, // FILE_RENAME_INFORMATION // 10
      FileLinkInformation, // FILE_LINK_INFORMATION
      FileNamesInformation, // FILE_NAMES_INFORMATION
      FileDispositionInformation, // FILE_DISPOSITION_INFORMATION
      FilePositionInformation, // FILE_POSITION_INFORMATION
      FileFullEaInformation, // FILE_FULL_EA_INFORMATION
      FileModeInformation, // FILE_MODE_INFORMATION
      FileAlignmentInformation, // FILE_ALIGNMENT_INFORMATION
      FileAllInformation, // FILE_ALL_INFORMATION
      FileAllocationInformation, // FILE_ALLOCATION_INFORMATION
      FileEndOfFileInformation, // FILE_END_OF_FILE_INFORMATION // 20
      FileAlternateNameInformation, // FILE_NAME_INFORMATION
      FileStreamInformation, // FILE_STREAM_INFORMATION
      FilePipeInformation, // FILE_PIPE_INFORMATION
      FilePipeLocalInformation, // FILE_PIPE_LOCAL_INFORMATION
      FilePipeRemoteInformation, // FILE_PIPE_REMOTE_INFORMATION
      FileMailslotQueryInformation, // FILE_MAILSLOT_QUERY_INFORMATION
      FileMailslotSetInformation, // FILE_MAILSLOT_SET_INFORMATION
      FileCompressionInformation, // FILE_COMPRESSION_INFORMATION
      FileObjectIdInformation, // FILE_OBJECTID_INFORMATION
      FileCompletionInformation, // FILE_COMPLETION_INFORMATION // 30
      FileMoveClusterInformation, // FILE_MOVE_CLUSTER_INFORMATION
      FileQuotaInformation, // FILE_QUOTA_INFORMATION
      FileReparsePointInformation, // FILE_REPARSE_POINT_INFORMATION
      FileNetworkOpenInformation, // FILE_NETWORK_OPEN_INFORMATION
      FileAttributeTagInformation, // FILE_ATTRIBUTE_TAG_INFORMATION
      FileTrackingInformation, // FILE_TRACKING_INFORMATION
      FileIdBothDirectoryInformation, // FILE_ID_BOTH_DIR_INFORMATION
      FileIdFullDirectoryInformation, // FILE_ID_FULL_DIR_INFORMATION
      FileValidDataLengthInformation, // FILE_VALID_DATA_LENGTH_INFORMATION
      FileShortNameInformation, // FILE_NAME_INFORMATION // 40
      FileIoCompletionNotificationInformation, // FILE_IO_COMPLETION_NOTIFICATION_INFORMATION // since VISTA
      FileIoStatusBlockRangeInformation, // FILE_IOSTATUSBLOCK_RANGE_INFORMATION
      FileIoPriorityHintInformation, // FILE_IO_PRIORITY_HINT_INFORMATION, FILE_IO_PRIORITY_HINT_INFORMATION_EX
      FileSfioReserveInformation, // FILE_SFIO_RESERVE_INFORMATION
      FileSfioVolumeInformation, // FILE_SFIO_VOLUME_INFORMATION
      FileHardLinkInformation, // FILE_LINKS_INFORMATION
      FileProcessIdsUsingFileInformation, // FILE_PROCESS_IDS_USING_FILE_INFORMATION
      FileNormalizedNameInformation, // FILE_NAME_INFORMATION
      FileNetworkPhysicalNameInformation, // FILE_NETWORK_PHYSICAL_NAME_INFORMATION
      FileIdGlobalTxDirectoryInformation, // FILE_ID_GLOBAL_TX_DIR_INFORMATION // since WIN7 // 50
      FileIsRemoteDeviceInformation, // FILE_IS_REMOTE_DEVICE_INFORMATION
      FileUnusedInformation,
      FileNumaNodeInformation, // FILE_NUMA_NODE_INFORMATION
      FileStandardLinkInformation, // FILE_STANDARD_LINK_INFORMATION
      FileRemoteProtocolInformation, // FILE_REMOTE_PROTOCOL_INFORMATION
      FileRenameInformationBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION // since WIN8
      FileLinkInformationBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION
      FileVolumeNameInformation, // FILE_VOLUME_NAME_INFORMATION
      FileIdInformation, // FILE_ID_INFORMATION
      FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION // 60
      FileReplaceCompletionInformation, // FILE_COMPLETION_INFORMATION // since WINBLUE
      FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION // FILE_LINKS_FULL_ID_INFORMATION
      FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD
      FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE
      FileRenameInformationEx, // FILE_RENAME_INFORMATION_EX
      FileRenameInformationExBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION_EX
      FileDesiredStorageClassInformation, // FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2
      FileStatInformation, // FILE_STAT_INFORMATION
      FileMemoryPartitionInformation, // FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3
      FileStatLxInformation, // FILE_STAT_LX_INFORMATION // since REDSTONE4 // 70
      FileCaseSensitiveInformation, // FILE_CASE_SENSITIVE_INFORMATION
      FileLinkInformationEx, // FILE_LINK_INFORMATION_EX // since REDSTONE5
      FileLinkInformationExBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION_EX
      FileStorageReserveIdInformation, // FILE_SET_STORAGE_RESERVE_ID_INFORMATION
      FileCaseSensitiveInformationForceAccessCheck, // FILE_CASE_SENSITIVE_INFORMATION
      FileKnownFolderInformation, // FILE_KNOWN_FOLDER_INFORMATION // since WIN11
      FileMaximumInformation
  } FILE_INFORMATION_CLASS, * PFILE_INFORMATION_CLASS;
  
  // NtQueryInformationFile/NtSetInformationFile types
  
  typedef struct _FILE_BASIC_INFORMATION
  {
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      ULONG FileAttributes;
  } FILE_BASIC_INFORMATION, * PFILE_BASIC_INFORMATION;
  
  typedef struct _FILE_STANDARD_INFORMATION
  {
      LARGE_INTEGER AllocationSize;
      LARGE_INTEGER EndOfFile;
      ULONG NumberOfLinks;
      BOOLEAN DeletePending;
      BOOLEAN Directory;
  } FILE_STANDARD_INFORMATION, * PFILE_STANDARD_INFORMATION;
  
  typedef struct _FILE_STANDARD_INFORMATION_EX
  {
      LARGE_INTEGER AllocationSize;
      LARGE_INTEGER EndOfFile;
      ULONG NumberOfLinks;
      BOOLEAN DeletePending;
      BOOLEAN Directory;
      BOOLEAN AlternateStream;
      BOOLEAN MetadataAttribute;
  } FILE_STANDARD_INFORMATION_EX, * PFILE_STANDARD_INFORMATION_EX;
  
  typedef struct _FILE_INTERNAL_INFORMATION
  {
      LARGE_INTEGER IndexNumber;
  } FILE_INTERNAL_INFORMATION, * PFILE_INTERNAL_INFORMATION;
  
  typedef struct _FILE_EA_INFORMATION
  {
      ULONG EaSize;
  } FILE_EA_INFORMATION, * PFILE_EA_INFORMATION;
  
  typedef struct _FILE_ACCESS_INFORMATION
  {
      ACCESS_MASK AccessFlags;
  } FILE_ACCESS_INFORMATION, * PFILE_ACCESS_INFORMATION;
  
  typedef struct _FILE_POSITION_INFORMATION
  {
      LARGE_INTEGER CurrentByteOffset;
  } FILE_POSITION_INFORMATION, * PFILE_POSITION_INFORMATION;
  
  typedef struct _FILE_MODE_INFORMATION
  {
      ULONG Mode;
  } FILE_MODE_INFORMATION, * PFILE_MODE_INFORMATION;
  
  typedef struct _FILE_ALIGNMENT_INFORMATION
  {
      ULONG AlignmentRequirement;
  } FILE_ALIGNMENT_INFORMATION, * PFILE_ALIGNMENT_INFORMATION;
  
  typedef struct _FILE_NAME_INFORMATION
  {
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_NAME_INFORMATION, * PFILE_NAME_INFORMATION;
  
  typedef struct _FILE_ALL_INFORMATION
  {
      FILE_BASIC_INFORMATION BasicInformation;
      FILE_STANDARD_INFORMATION StandardInformation;
      FILE_INTERNAL_INFORMATION InternalInformation;
      FILE_EA_INFORMATION EaInformation;
      FILE_ACCESS_INFORMATION AccessInformation;
      FILE_POSITION_INFORMATION PositionInformation;
      FILE_MODE_INFORMATION ModeInformation;
      FILE_ALIGNMENT_INFORMATION AlignmentInformation;
      FILE_NAME_INFORMATION NameInformation;
  } FILE_ALL_INFORMATION, * PFILE_ALL_INFORMATION;
  
  typedef struct _FILE_NETWORK_OPEN_INFORMATION
  {
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER AllocationSize;
      LARGE_INTEGER EndOfFile;
      ULONG FileAttributes;
  } FILE_NETWORK_OPEN_INFORMATION, * PFILE_NETWORK_OPEN_INFORMATION;
  
  typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
  {
      ULONG FileAttributes;
      ULONG ReparseTag;
  } FILE_ATTRIBUTE_TAG_INFORMATION, * PFILE_ATTRIBUTE_TAG_INFORMATION;
  
  typedef struct _FILE_ALLOCATION_INFORMATION
  {
      LARGE_INTEGER AllocationSize;
  } FILE_ALLOCATION_INFORMATION, * PFILE_ALLOCATION_INFORMATION;
  
  typedef struct _FILE_COMPRESSION_INFORMATION
  {
      LARGE_INTEGER CompressedFileSize;
      USHORT CompressionFormat;
      UCHAR CompressionUnitShift;
      UCHAR ChunkShift;
      UCHAR ClusterShift;
      UCHAR Reserved[3];
  } FILE_COMPRESSION_INFORMATION, * PFILE_COMPRESSION_INFORMATION;
  
  typedef struct _FILE_DISPOSITION_INFORMATION
  {
      BOOLEAN DeleteFile;
  } FILE_DISPOSITION_INFORMATION, * PFILE_DISPOSITION_INFORMATION;
  
  typedef struct _FILE_END_OF_FILE_INFORMATION
  {
      LARGE_INTEGER EndOfFile;
  } FILE_END_OF_FILE_INFORMATION, * PFILE_END_OF_FILE_INFORMATION;
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
  #define FLAGS_END_OF_FILE_INFO_EX_EXTEND_PAGING     0x00000001
  #define FLAGS_END_OF_FILE_INFO_EX_NO_EXTRA_PAGING_EXTEND 0x00000002
  #define FLAGS_END_OF_FILE_INFO_EX_TIME_CONSTRAINED  0x00000004
  #define FLAGS_DELAY_REASONS_LOG_FILE_FULL           0x00000001
  #define FLAGS_DELAY_REASONS_BITMAP_SCANNED          0x00000002
  
  typedef struct _FILE_END_OF_FILE_INFORMATION_EX
  {
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER PagingFileSizeInMM;
      LARGE_INTEGER PagingFileMaxSize;
      ULONG Flags;
  } FILE_END_OF_FILE_INFORMATION_EX, * PFILE_END_OF_FILE_INFORMATION_EX;
  #endif
  
  typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
  {
      LARGE_INTEGER ValidDataLength;
  } FILE_VALID_DATA_LENGTH_INFORMATION, * PFILE_VALID_DATA_LENGTH_INFORMATION;
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
  #define FILE_LINK_REPLACE_IF_EXISTS                 0x00000001
  #define FILE_LINK_POSIX_SEMANTICS                   0x00000002
  
  #define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
  #define FILE_LINK_NO_INCREASE_AVAILABLE_SPACE       0x00000010
  #define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE       0x00000020
  #define FILE_LINK_PRESERVE_AVAILABLE_SPACE          0x00000030
  #define FILE_LINK_IGNORE_READONLY_ATTRIBUTE         0x00000040
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_19H1)
  #define FILE_LINK_FORCE_RESIZE_TARGET_SR            0x00000080
  #define FILE_LINK_FORCE_RESIZE_SOURCE_SR            0x00000100
  #define FILE_LINK_FORCE_RESIZE_SR                   0x00000180
  #endif
  
  typedef struct _FILE_LINK_INFORMATION
  {
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
      union
      {
          BOOLEAN ReplaceIfExists; // FileLinkInformation
          ULONG Flags; // FileLinkInformationEx
      };
  #else
      BOOLEAN ReplaceIfExists;
  #endif
      HANDLE RootDirectory;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_LINK_INFORMATION, * PFILE_LINK_INFORMATION;
  
  typedef struct _FILE_LINK_INFORMATION_EX
  {
      ULONG Flags;
      HANDLE RootDirectory;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_LINK_INFORMATION_EX, * PFILE_LINK_INFORMATION_EX;
  
  typedef struct _FILE_MOVE_CLUSTER_INFORMATION
  {
      ULONG ClusterCount;
      HANDLE RootDirectory;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_MOVE_CLUSTER_INFORMATION, * PFILE_MOVE_CLUSTER_INFORMATION;
  
  typedef struct _FILE_RENAME_INFORMATION
  {
      BOOLEAN ReplaceIfExists;
      HANDLE RootDirectory;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_RENAME_INFORMATION, * PFILE_RENAME_INFORMATION;
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
  #define FILE_RENAME_REPLACE_IF_EXISTS               0x00000001
  #define FILE_RENAME_POSIX_SEMANTICS                 0x00000002
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS3)
  #define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE  0x00000004
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
  #define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
  #define FILE_RENAME_NO_INCREASE_AVAILABLE_SPACE     0x00000010
  #define FILE_RENAME_NO_DECREASE_AVAILABLE_SPACE     0x00000020
  #define FILE_RENAME_PRESERVE_AVAILABLE_SPACE        0x00000030
  #define FILE_RENAME_IGNORE_READONLY_ATTRIBUTE       0x00000040
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_19H1)
  #define FILE_RENAME_FORCE_RESIZE_TARGET_SR          0x00000080
  #define FILE_RENAME_FORCE_RESIZE_SOURCE_SR          0x00000100
  #define FILE_RENAME_FORCE_RESIZE_SR                 0x00000180
  #endif
  
  typedef struct _FILE_RENAME_INFORMATION_EX
  {
      ULONG Flags;
      HANDLE RootDirectory;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_RENAME_INFORMATION_EX, * PFILE_RENAME_INFORMATION_EX;
  
  typedef struct _FILE_STREAM_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG StreamNameLength;
      LARGE_INTEGER StreamSize;
      LARGE_INTEGER StreamAllocationSize;
      WCHAR StreamName[1];
  } FILE_STREAM_INFORMATION, * PFILE_STREAM_INFORMATION;
  
  typedef struct _FILE_TRACKING_INFORMATION
  {
      HANDLE DestinationFile;
      ULONG ObjectInformationLength;
      CHAR ObjectInformation[1];
  } FILE_TRACKING_INFORMATION, * PFILE_TRACKING_INFORMATION;
  
  typedef struct _FILE_COMPLETION_INFORMATION
  {
      HANDLE Port;
      PVOID Key;
  } FILE_COMPLETION_INFORMATION, * PFILE_COMPLETION_INFORMATION;
  
  typedef struct _FILE_PIPE_INFORMATION
  {
      ULONG ReadMode;
      ULONG CompletionMode;
  } FILE_PIPE_INFORMATION, * PFILE_PIPE_INFORMATION;
  
  typedef struct _FILE_PIPE_LOCAL_INFORMATION
  {
      ULONG NamedPipeType;
      ULONG NamedPipeConfiguration;
      ULONG MaximumInstances;
      ULONG CurrentInstances;
      ULONG InboundQuota;
      ULONG ReadDataAvailable;
      ULONG OutboundQuota;
      ULONG WriteQuotaAvailable;
      ULONG NamedPipeState;
      ULONG NamedPipeEnd;
  } FILE_PIPE_LOCAL_INFORMATION, * PFILE_PIPE_LOCAL_INFORMATION;
  
  typedef struct _FILE_PIPE_REMOTE_INFORMATION
  {
      LARGE_INTEGER CollectDataTime;
      ULONG MaximumCollectionCount;
  } FILE_PIPE_REMOTE_INFORMATION, * PFILE_PIPE_REMOTE_INFORMATION;
  
  typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
  {
      ULONG MaximumMessageSize;
      ULONG MailslotQuota;
      ULONG NextMessageSize;
      ULONG MessagesAvailable;
      LARGE_INTEGER ReadTimeout;
  } FILE_MAILSLOT_QUERY_INFORMATION, * PFILE_MAILSLOT_QUERY_INFORMATION;
  
  typedef struct _FILE_MAILSLOT_SET_INFORMATION
  {
      PLARGE_INTEGER ReadTimeout;
  } FILE_MAILSLOT_SET_INFORMATION, * PFILE_MAILSLOT_SET_INFORMATION;
  
  typedef struct _FILE_REPARSE_POINT_INFORMATION
  {
      LONGLONG FileReference;
      ULONG Tag;
  } FILE_REPARSE_POINT_INFORMATION, * PFILE_REPARSE_POINT_INFORMATION;
  
  typedef struct _FILE_LINK_ENTRY_INFORMATION
  {
      ULONG NextEntryOffset;
      LONGLONG ParentFileId; // LARGE_INTEGER
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_LINK_ENTRY_INFORMATION, * PFILE_LINK_ENTRY_INFORMATION;
  
  typedef struct _FILE_LINKS_INFORMATION
  {
      ULONG BytesNeeded;
      ULONG EntriesReturned;
      FILE_LINK_ENTRY_INFORMATION Entry;
  } FILE_LINKS_INFORMATION, * PFILE_LINKS_INFORMATION;
  
  typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION
  {
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_NETWORK_PHYSICAL_NAME_INFORMATION, * PFILE_NETWORK_PHYSICAL_NAME_INFORMATION;
  
  typedef struct _FILE_STANDARD_LINK_INFORMATION
  {
      ULONG NumberOfAccessibleLinks;
      ULONG TotalNumberOfLinks;
      BOOLEAN DeletePending;
      BOOLEAN Directory;
  } FILE_STANDARD_LINK_INFORMATION, * PFILE_STANDARD_LINK_INFORMATION;
  
  typedef struct _FILE_SFIO_RESERVE_INFORMATION
  {
      ULONG RequestsPerPeriod;
      ULONG Period;
      BOOLEAN RetryFailures;
      BOOLEAN Discardable;
      ULONG RequestSize;
      ULONG NumOutstandingRequests;
  } FILE_SFIO_RESERVE_INFORMATION, * PFILE_SFIO_RESERVE_INFORMATION;
  
  typedef struct _FILE_SFIO_VOLUME_INFORMATION
  {
      ULONG MaximumRequestsPerPeriod;
      ULONG MinimumPeriod;
      ULONG MinimumTransferSize;
  } FILE_SFIO_VOLUME_INFORMATION, * PFILE_SFIO_VOLUME_INFORMATION;
  
  typedef enum _IO_PRIORITY_HINT
  {
      IoPriorityVeryLow = 0, // Defragging, content indexing and other background I/Os.
      IoPriorityLow, // Prefetching for applications.
      IoPriorityNormal, // Normal I/Os.
      IoPriorityHigh, // Used by filesystems for checkpoint I/O.
      IoPriorityCritical, // Used by memory manager. Not available for applications.
      MaxIoPriorityTypes
  } IO_PRIORITY_HINT;
  
  typedef DECLSPEC_ALIGN(8) struct _FILE_IO_PRIORITY_HINT_INFORMATION
  {
      IO_PRIORITY_HINT PriorityHint;
  } FILE_IO_PRIORITY_HINT_INFORMATION, * PFILE_IO_PRIORITY_HINT_INFORMATION;
  
  typedef struct _FILE_IO_PRIORITY_HINT_INFORMATION_EX
  {
      IO_PRIORITY_HINT PriorityHint;
      BOOLEAN BoostOutstanding;
  } FILE_IO_PRIORITY_HINT_INFORMATION_EX, * PFILE_IO_PRIORITY_HINT_INFORMATION_EX;
  
  #define FILE_SKIP_COMPLETION_PORT_ON_SUCCESS    0x1
  #define FILE_SKIP_SET_EVENT_ON_HANDLE           0x2
  #define FILE_SKIP_SET_USER_EVENT_ON_FAST_IO     0x4
  
  typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION
  {
      ULONG Flags;
  } FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, * PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
  
  typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION
  {
      ULONG NumberOfProcessIdsInList;
      ULONG_PTR ProcessIdList[1];
  } FILE_PROCESS_IDS_USING_FILE_INFORMATION, * PFILE_PROCESS_IDS_USING_FILE_INFORMATION;
  
  typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION
  {
      BOOLEAN IsRemote;
  } FILE_IS_REMOTE_DEVICE_INFORMATION, * PFILE_IS_REMOTE_DEVICE_INFORMATION;
  
  typedef struct _FILE_NUMA_NODE_INFORMATION
  {
      USHORT NodeNumber;
  } FILE_NUMA_NODE_INFORMATION, * PFILE_NUMA_NODE_INFORMATION;
  
  typedef struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION
  {
      PUCHAR IoStatusBlockRange;
      ULONG Length;
  } FILE_IOSTATUSBLOCK_RANGE_INFORMATION, * PFILE_IOSTATUSBLOCK_RANGE_INFORMATION;
  
  // Win32 FILE_REMOTE_PROTOCOL_INFO
  typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
  {
      // Structure Version
      USHORT StructureVersion;     // 1 for Win7, 2 for Win8 SMB3, 3 for Blue SMB3, 4 for RS5
      USHORT StructureSize;        // sizeof(FILE_REMOTE_PROTOCOL_INFORMATION)
  
      ULONG Protocol;             // Protocol (WNNC_NET_*) defined in winnetwk.h or ntifs.h.
  
      // Protocol Version & Type
      USHORT ProtocolMajorVersion;
      USHORT ProtocolMinorVersion;
      USHORT ProtocolRevision;
  
      USHORT Reserved;
  
      // Protocol-Generic Information
      ULONG Flags;
  
      struct
      {
          ULONG Reserved[8];
      } GenericReserved;
  
      // Protocol specific information
  
  #if (NTDDI_VERSION < NTDDI_WIN8)
      struct
      {
          ULONG Reserved[16];
      } ProtocolSpecificReserved;
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_WIN8)
      union
      {
          struct
          {
              struct
              {
                  ULONG Capabilities;
              } Server;
              struct
              {
                  ULONG Capabilities;
  #if (NTDDI_VERSION >= NTDDI_WIN10_FE)
                  ULONG ShareFlags;
  #else
                  ULONG CachingFlags;
  #endif
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
                  UCHAR ShareType;
                  UCHAR Reserved0[3];
                  ULONG Reserved1;
  #endif
              } Share;
          } Smb2;
          ULONG Reserved[16];
      } ProtocolSpecific;
  #endif
  } FILE_REMOTE_PROTOCOL_INFORMATION, * PFILE_REMOTE_PROTOCOL_INFORMATION;
  
  #define CHECKSUM_ENFORCEMENT_OFF 0x00000001
  
  typedef struct _FILE_INTEGRITY_STREAM_INFORMATION
  {
      USHORT ChecksumAlgorithm;
      UCHAR ChecksumChunkShift;
      UCHAR ClusterShift;
      ULONG Flags;
  } FILE_INTEGRITY_STREAM_INFORMATION, * PFILE_INTEGRITY_STREAM_INFORMATION;
  
  typedef struct _FILE_VOLUME_NAME_INFORMATION
  {
      ULONG DeviceNameLength;
      WCHAR DeviceName[1];
  } FILE_VOLUME_NAME_INFORMATION, * PFILE_VOLUME_NAME_INFORMATION;
  
  typedef struct _FILE_ID_INFORMATION
  {
      ULONGLONG VolumeSerialNumber;
      FILE_ID_128 FileId;
  } FILE_ID_INFORMATION, * PFILE_ID_INFORMATION;
  
  typedef struct _FILE_ID_EXTD_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      ULONG EaSize;
      ULONG ReparsePointTag;
      FILE_ID_128 FileId;
      WCHAR FileName[1];
  } FILE_ID_EXTD_DIR_INFORMATION, * PFILE_ID_EXTD_DIR_INFORMATION;
  
  typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION
  {
      ULONG NextEntryOffset;
      FILE_ID_128 ParentFileId;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_LINK_ENTRY_FULL_ID_INFORMATION, * PFILE_LINK_ENTRY_FULL_ID_INFORMATION;
  
  typedef struct _FILE_LINKS_FULL_ID_INFORMATION
  {
      ULONG BytesNeeded;
      ULONG EntriesReturned;
      FILE_LINK_ENTRY_FULL_ID_INFORMATION Entry;
  } FILE_LINKS_FULL_ID_INFORMATION, * PFILE_LINKS_FULL_ID_INFORMATION;
  
  typedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      ULONG EaSize;
      ULONG ReparsePointTag;
      FILE_ID_128 FileId;
      CCHAR ShortNameLength;
      WCHAR ShortName[12];
      WCHAR FileName[1];
  } FILE_ID_EXTD_BOTH_DIR_INFORMATION, * PFILE_ID_EXTD_BOTH_DIR_INFORMATION;
  
  // private
  typedef struct _FILE_STAT_INFORMATION
  {
      LARGE_INTEGER FileId;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER AllocationSize;
      LARGE_INTEGER EndOfFile;
      ULONG FileAttributes;
      ULONG ReparseTag;
      ULONG NumberOfLinks;
      ACCESS_MASK EffectiveAccess;
  } FILE_STAT_INFORMATION, * PFILE_STAT_INFORMATION;
  
  // private
  typedef struct _FILE_MEMORY_PARTITION_INFORMATION
  {
      HANDLE OwnerPartitionHandle;
      union
      {
          struct
          {
              UCHAR NoCrossPartitionAccess;
              UCHAR Spare[3];
          };
          ULONG AllFlags;
      } Flags;
  } FILE_MEMORY_PARTITION_INFORMATION, * PFILE_MEMORY_PARTITION_INFORMATION;
  
  // LxFlags
  #define LX_FILE_METADATA_HAS_UID        0x1
  #define LX_FILE_METADATA_HAS_GID        0x2
  #define LX_FILE_METADATA_HAS_MODE       0x4
  #define LX_FILE_METADATA_HAS_DEVICE_ID  0x8
  #define LX_FILE_CASE_SENSITIVE_DIR      0x10
  
  // private
  typedef struct _FILE_STAT_LX_INFORMATION
  {
      LARGE_INTEGER FileId;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER AllocationSize;
      LARGE_INTEGER EndOfFile;
      ULONG FileAttributes;
      ULONG ReparseTag;
      ULONG NumberOfLinks;
      ACCESS_MASK EffectiveAccess;
      ULONG LxFlags;
      ULONG LxUid;
      ULONG LxGid;
      ULONG LxMode;
      ULONG LxDeviceIdMajor;
      ULONG LxDeviceIdMinor;
  } FILE_STAT_LX_INFORMATION, * PFILE_STAT_LX_INFORMATION;
  
  #define FILE_CS_FLAG_CASE_SENSITIVE_DIR 0x00000001
  
  // private
  typedef struct _FILE_CASE_SENSITIVE_INFORMATION
  {
      ULONG Flags;
  } FILE_CASE_SENSITIVE_INFORMATION, * PFILE_CASE_SENSITIVE_INFORMATION;
  
  // private
  typedef enum _FILE_KNOWN_FOLDER_TYPE
  {
      KnownFolderNone,
      KnownFolderDesktop,
      KnownFolderDocuments,
      KnownFolderDownloads,
      KnownFolderMusic,
      KnownFolderPictures,
      KnownFolderVideos,
      KnownFolderOther,
      KnownFolderMax = 7
  } FILE_KNOWN_FOLDER_TYPE;
  
  // private
  typedef struct _FILE_KNOWN_FOLDER_INFORMATION
  {
      FILE_KNOWN_FOLDER_TYPE Type;
  } FILE_KNOWN_FOLDER_INFORMATION, * PFILE_KNOWN_FOLDER_INFORMATION;
  
  // NtQueryDirectoryFile types
  
  typedef struct _FILE_DIRECTORY_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_DIRECTORY_INFORMATION, * PFILE_DIRECTORY_INFORMATION;
  
  typedef struct _FILE_FULL_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      ULONG EaSize;
      WCHAR FileName[1];
  } FILE_FULL_DIR_INFORMATION, * PFILE_FULL_DIR_INFORMATION;
  
  typedef struct _FILE_ID_FULL_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      ULONG EaSize;
      LARGE_INTEGER FileId;
      WCHAR FileName[1];
  } FILE_ID_FULL_DIR_INFORMATION, * PFILE_ID_FULL_DIR_INFORMATION;
  
  typedef struct _FILE_BOTH_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      ULONG EaSize;
      CCHAR ShortNameLength;
      WCHAR ShortName[12];
      WCHAR FileName[1];
  } FILE_BOTH_DIR_INFORMATION, * PFILE_BOTH_DIR_INFORMATION;
  
  typedef struct _FILE_ID_BOTH_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      ULONG EaSize;
      CCHAR ShortNameLength;
      WCHAR ShortName[12];
      LARGE_INTEGER FileId;
      WCHAR FileName[1];
  } FILE_ID_BOTH_DIR_INFORMATION, * PFILE_ID_BOTH_DIR_INFORMATION;
  
  typedef struct _FILE_NAMES_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      ULONG FileNameLength;
      WCHAR FileName[1];
  } FILE_NAMES_INFORMATION, * PFILE_NAMES_INFORMATION;
  
  typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG FileIndex;
      LARGE_INTEGER CreationTime;
      LARGE_INTEGER LastAccessTime;
      LARGE_INTEGER LastWriteTime;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER EndOfFile;
      LARGE_INTEGER AllocationSize;
      ULONG FileAttributes;
      ULONG FileNameLength;
      LARGE_INTEGER FileId;
      GUID LockingTransactionId;
      ULONG TxInfoFlags;
      WCHAR FileName[1];
  } FILE_ID_GLOBAL_TX_DIR_INFORMATION, * PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
  
  #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED         0x00000001
  #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX       0x00000002
  #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX  0x00000004
  
  typedef struct _FILE_OBJECTID_INFORMATION
  {
      LONGLONG FileReference;
      UCHAR ObjectId[16]; // GUID
      union
      {
          struct
          {
              UCHAR BirthVolumeId[16];
              UCHAR BirthObjectId[16];
              UCHAR DomainId[16];
          };
          UCHAR ExtendedInfo[48];
      };
  } FILE_OBJECTID_INFORMATION, * PFILE_OBJECTID_INFORMATION;
  
  // NtQueryEaFile/NtSetEaFile types
  
  typedef struct _FILE_FULL_EA_INFORMATION
  {
      ULONG NextEntryOffset;
      UCHAR Flags;
      UCHAR EaNameLength;
      USHORT EaValueLength;
      CHAR EaName[1];
  } FILE_FULL_EA_INFORMATION, * PFILE_FULL_EA_INFORMATION;
  
  typedef struct _FILE_GET_EA_INFORMATION
  {
      ULONG NextEntryOffset;
      UCHAR EaNameLength;
      CHAR EaName[1];
  } FILE_GET_EA_INFORMATION, * PFILE_GET_EA_INFORMATION;
  
  // NtQueryQuotaInformationFile/NtSetQuotaInformationFile types
  
  typedef struct _FILE_GET_QUOTA_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG SidLength;
      SID Sid;
  } FILE_GET_QUOTA_INFORMATION, * PFILE_GET_QUOTA_INFORMATION;
  
  typedef struct _FILE_QUOTA_INFORMATION
  {
      ULONG NextEntryOffset;
      ULONG SidLength;
      LARGE_INTEGER ChangeTime;
      LARGE_INTEGER QuotaUsed;
      LARGE_INTEGER QuotaThreshold;
      LARGE_INTEGER QuotaLimit;
      SID Sid;
  } FILE_QUOTA_INFORMATION, * PFILE_QUOTA_INFORMATION;
  
  typedef enum _FSINFOCLASS
  {
      FileFsVolumeInformation = 1, // FILE_FS_VOLUME_INFORMATION
      FileFsLabelInformation, // FILE_FS_LABEL_INFORMATION
      FileFsSizeInformation, // FILE_FS_SIZE_INFORMATION
      FileFsDeviceInformation, // FILE_FS_DEVICE_INFORMATION
      FileFsAttributeInformation, // FILE_FS_ATTRIBUTE_INFORMATION
      FileFsControlInformation, // FILE_FS_CONTROL_INFORMATION
      FileFsFullSizeInformation, // FILE_FS_FULL_SIZE_INFORMATION
      FileFsObjectIdInformation, // FILE_FS_OBJECTID_INFORMATION
      FileFsDriverPathInformation, // FILE_FS_DRIVER_PATH_INFORMATION
      FileFsVolumeFlagsInformation, // FILE_FS_VOLUME_FLAGS_INFORMATION // 10
      FileFsSectorSizeInformation, // FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8
      FileFsDataCopyInformation, // FILE_FS_DATA_COPY_INFORMATION
      FileFsMetadataSizeInformation, // FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD
      FileFsFullSizeInformationEx, // FILE_FS_FULL_SIZE_INFORMATION_EX // since REDSTONE5
      FileFsMaximumInformation
  } FS_INFORMATION_CLASS, * PFS_INFORMATION_CLASS;
  
  // NtQueryVolumeInformation/NtSetVolumeInformation types
  
  // private
  typedef struct _FILE_FS_VOLUME_INFORMATION
  {
      LARGE_INTEGER VolumeCreationTime;
      ULONG VolumeSerialNumber;
      ULONG VolumeLabelLength;
      BOOLEAN SupportsObjects;
      WCHAR VolumeLabel[1];
  } FILE_FS_VOLUME_INFORMATION, * PFILE_FS_VOLUME_INFORMATION;
  
  // private
  typedef struct _FILE_FS_LABEL_INFORMATION
  {
      ULONG VolumeLabelLength;
      WCHAR VolumeLabel[1];
  } FILE_FS_LABEL_INFORMATION, * PFILE_FS_LABEL_INFORMATION;
  
  // private
  typedef struct _FILE_FS_SIZE_INFORMATION
  {
      LARGE_INTEGER TotalAllocationUnits;
      LARGE_INTEGER AvailableAllocationUnits;
      ULONG SectorsPerAllocationUnit;
      ULONG BytesPerSector;
  } FILE_FS_SIZE_INFORMATION, * PFILE_FS_SIZE_INFORMATION;
  
  // FileSystemControlFlags
  #define FILE_VC_QUOTA_NONE              0x00000000
  #define FILE_VC_QUOTA_TRACK             0x00000001
  #define FILE_VC_QUOTA_ENFORCE           0x00000002
  #define FILE_VC_QUOTA_MASK              0x00000003
  #define FILE_VC_CONTENT_INDEX_DISABLED  0x00000008
  #define FILE_VC_LOG_QUOTA_THRESHOLD     0x00000010
  #define FILE_VC_LOG_QUOTA_LIMIT         0x00000020
  #define FILE_VC_LOG_VOLUME_THRESHOLD    0x00000040
  #define FILE_VC_LOG_VOLUME_LIMIT        0x00000080
  #define FILE_VC_QUOTAS_INCOMPLETE       0x00000100
  #define FILE_VC_QUOTAS_REBUILDING       0x00000200
  #define FILE_VC_VALID_MASK              0x000003ff
  
  // private
  typedef struct _FILE_FS_CONTROL_INFORMATION
  {
      LARGE_INTEGER FreeSpaceStartFiltering;
      LARGE_INTEGER FreeSpaceThreshold;
      LARGE_INTEGER FreeSpaceStopFiltering;
      LARGE_INTEGER DefaultQuotaThreshold;
      LARGE_INTEGER DefaultQuotaLimit;
      ULONG FileSystemControlFlags;
  } FILE_FS_CONTROL_INFORMATION, * PFILE_FS_CONTROL_INFORMATION;
  
  // private
  typedef struct _FILE_FS_FULL_SIZE_INFORMATION
  {
      LARGE_INTEGER TotalAllocationUnits;
      LARGE_INTEGER CallerAvailableAllocationUnits;
      LARGE_INTEGER ActualAvailableAllocationUnits;
      ULONG SectorsPerAllocationUnit;
      ULONG BytesPerSector;
  } FILE_FS_FULL_SIZE_INFORMATION, * PFILE_FS_FULL_SIZE_INFORMATION;
  
  // private
  typedef struct _FILE_FS_OBJECTID_INFORMATION
  {
      UCHAR ObjectId[16];
      UCHAR ExtendedInfo[48];
  } FILE_FS_OBJECTID_INFORMATION, * PFILE_FS_OBJECTID_INFORMATION;
  
  // private
  typedef struct _FILE_FS_DEVICE_INFORMATION
  {
      DEVICE_TYPE DeviceType;
      ULONG Characteristics;
  } FILE_FS_DEVICE_INFORMATION, * PFILE_FS_DEVICE_INFORMATION;
  
  // private
  typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
  {
      ULONG FileSystemAttributes;
      LONG MaximumComponentNameLength;
      ULONG FileSystemNameLength;
      WCHAR FileSystemName[1];
  } FILE_FS_ATTRIBUTE_INFORMATION, * PFILE_FS_ATTRIBUTE_INFORMATION;
  
  // private
  typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
  {
      BOOLEAN DriverInPath;
      ULONG DriverNameLength;
      WCHAR DriverName[1];
  } FILE_FS_DRIVER_PATH_INFORMATION, * PFILE_FS_DRIVER_PATH_INFORMATION;
  
  // private
  typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION
  {
      ULONG Flags;
  } FILE_FS_VOLUME_FLAGS_INFORMATION, * PFILE_FS_VOLUME_FLAGS_INFORMATION;
  
  #define SSINFO_FLAGS_ALIGNED_DEVICE 0x00000001
  #define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002
  
  // If set for Sector and Partition fields, alignment is not known.
  #define SSINFO_OFFSET_UNKNOWN 0xffffffff
  
  typedef struct _FILE_FS_SECTOR_SIZE_INFORMATION
  {
      ULONG LogicalBytesPerSector;
      ULONG PhysicalBytesPerSectorForAtomicity;
      ULONG PhysicalBytesPerSectorForPerformance;
      ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity;
      ULONG Flags;
      ULONG ByteOffsetForSectorAlignment;
      ULONG ByteOffsetForPartitionAlignment;
  } FILE_FS_SECTOR_SIZE_INFORMATION, * PFILE_FS_SECTOR_SIZE_INFORMATION;
  
  // private
  typedef struct _FILE_FS_DATA_COPY_INFORMATION
  {
      ULONG NumberOfCopies;
  } FILE_FS_DATA_COPY_INFORMATION, * PFILE_FS_DATA_COPY_INFORMATION;
  
  // private
  typedef struct _FILE_FS_METADATA_SIZE_INFORMATION
  {
      LARGE_INTEGER TotalMetadataAllocationUnits;
      ULONG SectorsPerAllocationUnit;
      ULONG BytesPerSector;
  } FILE_FS_METADATA_SIZE_INFORMATION, * PFILE_FS_METADATA_SIZE_INFORMATION;
  
  // private
  typedef struct _FILE_FS_FULL_SIZE_INFORMATION_EX
  {
      ULONGLONG ActualTotalAllocationUnits;
      ULONGLONG ActualAvailableAllocationUnits;
      ULONGLONG ActualPoolUnavailableAllocationUnits;
      ULONGLONG CallerTotalAllocationUnits;
      ULONGLONG CallerAvailableAllocationUnits;
      ULONGLONG CallerPoolUnavailableAllocationUnits;
      ULONGLONG UsedAllocationUnits;
      ULONGLONG TotalReservedAllocationUnits;
      ULONGLONG VolumeStorageReserveAllocationUnits;
      ULONGLONG AvailableCommittedAllocationUnits;
      ULONGLONG PoolAvailableAllocationUnits;
      ULONG SectorsPerAllocationUnit;
      ULONG BytesPerSector;
  } FILE_FS_FULL_SIZE_INFORMATION_EX, * PFILE_FS_FULL_SIZE_INFORMATION_EX;
  #endif // !_KERNEL_MODE
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateFile(
      _Out_ PHANDLE FileHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_opt_ PLARGE_INTEGER AllocationSize,
      _In_ ULONG FileAttributes,
      _In_ ULONG ShareAccess,
      _In_ ULONG CreateDisposition,
      _In_ ULONG CreateOptions,
      _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
      _In_ ULONG EaLength
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCreateFile(
      _Out_ PHANDLE FileHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_opt_ PLARGE_INTEGER AllocationSize,
      _In_ ULONG FileAttributes,
      _In_ ULONG ShareAccess,
      _In_ ULONG CreateDisposition,
      _In_ ULONG CreateOptions,
      _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
      _In_ ULONG EaLength
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateNamedPipeFile(
      _Out_ PHANDLE FileHandle,
      _In_ ULONG DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG ShareAccess,
      _In_ ULONG CreateDisposition,
      _In_ ULONG CreateOptions,
      _In_ ULONG NamedPipeType,
      _In_ ULONG ReadMode,
      _In_ ULONG CompletionMode,
      _In_ ULONG MaximumInstances,
      _In_ ULONG InboundQuota,
      _In_ ULONG OutboundQuota,
      _In_opt_ PLARGE_INTEGER DefaultTimeout
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSTATUS
  NTAPI
  ZwCreateNamedPipeFile(
      _Out_ PHANDLE FileHandle,
      _In_ ULONG DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG ShareAccess,
      _In_ ULONG CreateDisposition,
      _In_ ULONG CreateOptions,
      _In_ ULONG NamedPipeType,
      _In_ ULONG ReadMode,
      _In_ ULONG CompletionMode,
      _In_ ULONG MaximumInstances,
      _In_ ULONG InboundQuota,
      _In_ ULONG OutboundQuota,
      _In_opt_ PLARGE_INTEGER DefaultTimeout
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateMailslotFile(
      _Out_ PHANDLE FileHandle,
      _In_ ULONG DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG CreateOptions,
      _In_ ULONG MailslotQuota,
      _In_ ULONG MaximumMessageSize,
      _In_ PLARGE_INTEGER ReadTimeout
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSTATUS
  NTAPI
  ZwCreateMailslotFile(
      _Out_ PHANDLE FileHandle,
      _In_ ULONG DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG CreateOptions,
      _In_ ULONG MailslotQuota,
      _In_ ULONG MaximumMessageSize,
      _In_ PLARGE_INTEGER ReadTimeout
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenFile(
      _Out_ PHANDLE FileHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG ShareAccess,
      _In_ ULONG OpenOptions
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwOpenFile(
      _Out_ PHANDLE FileHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG ShareAccess,
      _In_ ULONG OpenOptions
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtDeleteFile(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwDeleteFile(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  #if (NTDDI_VERSION >= NTDDI_VISTA)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtFlushBuffersFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  ZwFlushBuffersFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  #endif
  
  #define FLUSH_FLAGS_FILE_DATA_ONLY      0x00000001
  #define FLUSH_FLAGS_NO_SYNC             0x00000002
  #define FLUSH_FLAGS_FILE_DATA_SYNC_ONLY 0x00000004 // REDSTONE1
  
  #if (NTDDI_VERSION >= NTDDI_WIN8)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtFlushBuffersFileEx (
      _In_ HANDLE FileHandle,
      _In_ ULONG Flags,
      _In_reads_bytes_(ParametersSize) PVOID Parameters,
      _In_ ULONG ParametersSize,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
      );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  ZwFlushBuffersFileEx(
      _In_ HANDLE FileHandle,
      _In_ ULONG FLags,
      _In_reads_bytes_(ParametersSize) PVOID Parameters,
      _In_ ULONG ParametersSize,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  #endif
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass
  );
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS2)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryInformationByName(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryInformationByName(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass
  );
  #endif // NTDDI_VERSION >= NTDDI_WIN10_RS2
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwSetInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryDirectoryFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass,
      _In_ BOOLEAN ReturnSingleEntry,
      _In_opt_ PUNICODE_STRING FileName,
      _In_ BOOLEAN RestartScan
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryDirectoryFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass,
      _In_ BOOLEAN ReturnSingleEntry,
      _In_opt_ PUNICODE_STRING FileName,
      _In_ BOOLEAN RestartScan
  );
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS3)
  // QueryFlags values for NtQueryDirectoryFileEx
  #define FILE_QUERY_RESTART_SCAN                 0x00000001
  #define FILE_QUERY_RETURN_SINGLE_ENTRY          0x00000002
  #define FILE_QUERY_INDEX_SPECIFIED              0x00000004
  #define FILE_QUERY_RETURN_ON_DISK_ENTRIES_ONLY  0x00000008
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS5)
  #define FILE_QUERY_NO_CURSOR_UPDATE             0x00000010
  #endif
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryDirectoryFileEx(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass,
      _In_ ULONG QueryFlags,  // Valid flags are in SL_QUERY_DIRECTORY_MASK
      _In_opt_ PUNICODE_STRING FileName
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryDirectoryFileEx(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FileInformation,
      _In_ ULONG Length,
      _In_ FILE_INFORMATION_CLASS FileInformationClass,
      _In_ ULONG QueryFlags,
      _In_opt_ PUNICODE_STRING FileName
  );
  #endif // NTDDI_VERSION >= NTDDI_WIN10_RS3
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryEaFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_ BOOLEAN ReturnSingleEntry,
      _In_reads_bytes_opt_(EaListLength) PVOID EaList,
      _In_ ULONG EaListLength,
      _In_opt_ PULONG EaIndex,
      _In_ BOOLEAN RestartScan
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSTATUS
  ZwQueryEaFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_ BOOLEAN ReturnSingleEntry,
      _In_reads_bytes_opt_(EaListLength) PVOID EaList,
      _In_ ULONG EaListLength,
      _In_opt_ PULONG EaIndex,
      _In_ BOOLEAN RestartScan
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetEaFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSTATUS
  ZwSetEaFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length
  );
  
  #if (NTDDI_VERSION >= NTDDI_VISTA)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryQuotaInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_ BOOLEAN ReturnSingleEntry,
      _In_reads_bytes_opt_(SidListLength) PVOID SidList,
      _In_ ULONG SidListLength,
      _In_reads_bytes_opt_((8 + (4 * ((SID*)StartSid)->SubAuthorityCount))) // SeLengthSid()
      PSID StartSid,
      _In_ BOOLEAN RestartScan
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryQuotaInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_ BOOLEAN ReturnSingleEntry,
      _In_reads_bytes_opt_(SidListLength) PVOID SidList,
      _In_ ULONG SidListLength,
      _In_opt_ PSID StartSid,
      _In_ BOOLEAN RestartScan
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetQuotaInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwSetQuotaInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length
  );
  #endif
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryVolumeInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FsInformation,
      _In_ ULONG Length,
      _In_ FS_INFORMATION_CLASS FsInformationClass
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryVolumeInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID FsInformation,
      _In_ ULONG Length,
      _In_ FS_INFORMATION_CLASS FsInformationClass
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetVolumeInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID FsInformation,
      _In_ ULONG Length,
      _In_ FS_INFORMATION_CLASS FsInformationClass
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwSetVolumeInformationFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID FsInformation,
      _In_ ULONG Length,
      _In_ FS_INFORMATION_CLASS FsInformationClass
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCancelIoFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCancelIoFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  
  #if (NTDDI_VERSION >= NTDDI_VISTA)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCancelIoFileEx(
      _In_ HANDLE FileHandle,
      _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCancelIoFileEx(
      _In_ HANDLE FileHandle,
      _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_VISTA)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCancelSynchronousIoFile(
      _In_ HANDLE ThreadHandle,
      _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCancelSynchronousIoFile(
      _In_ HANDLE ThreadHandle,
      _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock
  );
  #endif
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtDeviceIoControlFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG IoControlCode,
      _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
      _In_ ULONG InputBufferLength,
      _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
      _In_ ULONG OutputBufferLength
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwDeviceIoControlFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG IoControlCode,
      _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
      _In_ ULONG InputBufferLength,
      _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
      _In_ ULONG OutputBufferLength
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtFsControlFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG FsControlCode,
      _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
      _In_ ULONG InputBufferLength,
      _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
      _In_ ULONG OutputBufferLength
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwFsControlFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ ULONG FsControlCode,
      _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
      _In_ ULONG InputBufferLength,
      _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
      _In_ ULONG OutputBufferLength
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtReadFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwReadFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtWriteFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwWriteFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_reads_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtReadFileScatter(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwReadFileScatter(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtWriteFileGather(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwWriteFileGather(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
      _In_ ULONG Length,
      _In_opt_ PLARGE_INTEGER ByteOffset,
      _In_opt_ PULONG Key
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtLockFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PLARGE_INTEGER ByteOffset,
      _In_ PLARGE_INTEGER Length,
      _In_ ULONG Key,
      _In_ BOOLEAN FailImmediately,
      _In_ BOOLEAN ExclusiveLock
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwLockFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PLARGE_INTEGER ByteOffset,
      _In_ PLARGE_INTEGER Length,
      _In_ ULONG Key,
      _In_ BOOLEAN FailImmediately,
      _In_ BOOLEAN ExclusiveLock
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtUnlockFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PLARGE_INTEGER ByteOffset,
      _In_ PLARGE_INTEGER Length,
      _In_ ULONG Key
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwUnlockFile(
      _In_ HANDLE FileHandle,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_ PLARGE_INTEGER ByteOffset,
      _In_ PLARGE_INTEGER Length,
      _In_ ULONG Key
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryAttributesFile(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PFILE_BASIC_INFORMATION FileInformation
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryAttributesFile(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PFILE_BASIC_INFORMATION FileInformation
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryFullAttributesFile(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryFullAttributesFile(
      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
      _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtNotifyChangeDirectoryFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer, // FILE_NOTIFY_INFORMATION
      _In_ ULONG Length,
      _In_ ULONG CompletionFilter,
      _In_ BOOLEAN WatchTree
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwNotifyChangeDirectoryFile(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer, // FILE_NOTIFY_INFORMATION
      _In_ ULONG Length,
      _In_ ULONG CompletionFilter,
      _In_ BOOLEAN WatchTree
  );
  
  #ifndef _KERNEL_MODE
  // private
  typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS
  {
      DirectoryNotifyInformation = 1, // FILE_NOTIFY_INFORMATION
      DirectoryNotifyExtendedInformation = 2 // FILE_NOTIFY_EXTENDED_INFORMATION
  } DIRECTORY_NOTIFY_INFORMATION_CLASS, * PDIRECTORY_NOTIFY_INFORMATION_CLASS;
  #endif // !_KERNEL_MODE
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS3)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtNotifyChangeDirectoryFileEx(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_ ULONG CompletionFilter,
      _In_ BOOLEAN WatchTree,
      _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwNotifyChangeDirectoryFileEx(
      _In_ HANDLE FileHandle,
      _In_opt_ HANDLE Event,
      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
      _In_opt_ PVOID ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _Out_writes_bytes_(Length) PVOID Buffer,
      _In_ ULONG Length,
      _In_ ULONG CompletionFilter,
      _In_ BOOLEAN WatchTree,
      _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass
  );
  #endif // NTDDI_VERSION >= NTDDI_WIN10_RS3
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtLoadDriver(
      _In_ PUNICODE_STRING DriverServiceName
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwLoadDriver(
      _In_ PUNICODE_STRING DriverServiceName
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtUnloadDriver(
      _In_ PUNICODE_STRING DriverServiceName
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwUnloadDriver(
      _In_ PUNICODE_STRING DriverServiceName
  );
  
  //
  // I/O completion port
  //
  
  #ifndef IO_COMPLETION_QUERY_STATE
  #define IO_COMPLETION_QUERY_STATE 0x0001
  #endif
  
  #ifndef IO_COMPLETION_MODIFY_STATE
  #define IO_COMPLETION_MODIFY_STATE 0x0002
  #endif
  
  #ifndef IO_COMPLETION_ALL_ACCESS
  #define IO_COMPLETION_ALL_ACCESS (IO_COMPLETION_QUERY_STATE|IO_COMPLETION_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE) 
  #endif
  
  typedef enum _IO_COMPLETION_INFORMATION_CLASS
  {
      IoCompletionBasicInformation
  } IO_COMPLETION_INFORMATION_CLASS;
  
  typedef struct _IO_COMPLETION_BASIC_INFORMATION
  {
      LONG Depth;
  } IO_COMPLETION_BASIC_INFORMATION, * PIO_COMPLETION_BASIC_INFORMATION;
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateIoCompletion(
      _Out_ PHANDLE IoCompletionHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
      _In_opt_ ULONG Count
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCreateIoCompletion(
      _Out_ PHANDLE IoCompletionHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
      _In_opt_ ULONG Count
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenIoCompletion(
      _Out_ PHANDLE IoCompletionHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwOpenIoCompletion(
      _Out_ PHANDLE IoCompletionHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryIoCompletion(
      _In_ HANDLE IoCompletionHandle,
      _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
      _Out_writes_bytes_(IoCompletionInformationLength) PVOID IoCompletionInformation,
      _In_ ULONG IoCompletionInformationLength,
      _Out_opt_ PULONG ReturnLength
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwQueryIoCompletion(
      _In_ HANDLE IoCompletionHandle,
      _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
      _Out_writes_bytes_(IoCompletionInformationLength) PVOID IoCompletionInformation,
      _In_ ULONG IoCompletionInformationLength,
      _Out_opt_ PULONG ReturnLength
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetIoCompletion(
      _In_ HANDLE IoCompletionHandle,
      _In_opt_ PVOID KeyContext,
      _In_opt_ PVOID ApcContext,
      _In_ NTSTATUS IoStatus,
      _In_ ULONG_PTR IoStatusInformation
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwSetIoCompletion(
      _In_ HANDLE IoCompletionHandle,
      _In_opt_ PVOID KeyContext,
      _In_opt_ PVOID ApcContext,
      _In_ NTSTATUS IoStatus,
      _In_ ULONG_PTR IoStatusInformation
  );
  
  #if (NTDDI_VERSION >= NTDDI_WIN7)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetIoCompletionEx(
      _In_ HANDLE IoCompletionHandle,
      _In_ HANDLE IoCompletionPacketHandle,
      _In_opt_ PVOID KeyContext,
      _In_opt_ PVOID ApcContext,
      _In_ NTSTATUS IoStatus,
      _In_ ULONG_PTR IoStatusInformation
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwSetIoCompletionEx(
      _In_ HANDLE IoCompletionHandle,
      _In_ HANDLE IoCompletionPacketHandle,
      _In_opt_ PVOID KeyContext,
      _In_opt_ PVOID ApcContext,
      _In_ NTSTATUS IoStatus,
      _In_ ULONG_PTR IoStatusInformation
  );
  #endif
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtRemoveIoCompletion(
      _In_ HANDLE IoCompletionHandle,
      _Out_ PVOID* KeyContext,
      _Out_ PVOID* ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_opt_ PLARGE_INTEGER Timeout
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwRemoveIoCompletion(
      _In_ HANDLE IoCompletionHandle,
      _Out_ PVOID* KeyContext,
      _Out_ PVOID* ApcContext,
      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
      _In_opt_ PLARGE_INTEGER Timeout
  );
  
  #if (NTDDI_VERSION >= NTDDI_VISTA)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtRemoveIoCompletionEx(
      _In_ HANDLE IoCompletionHandle,
      _Out_writes_to_(Count, *NumEntriesRemoved) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,
      _In_ ULONG Count,
      _Out_ PULONG NumEntriesRemoved,
      _In_opt_ PLARGE_INTEGER Timeout,
      _In_ BOOLEAN Alertable
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwRemoveIoCompletionEx(
      _In_ HANDLE IoCompletionHandle,
      _Out_writes_to_(Count, *NumEntriesRemoved) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,
      _In_ ULONG Count,
      _Out_ PULONG NumEntriesRemoved,
      _In_opt_ PLARGE_INTEGER Timeout,
      _In_ BOOLEAN Alertable
  );
  #endif
  
  //
  // Wait completion packet
  //
  
  #if (NTDDI_VERSION >= NTDDI_WIN8)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateWaitCompletionPacket(
      _Out_ PHANDLE WaitCompletionPacketHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCreateWaitCompletionPacket(
      _Out_ PHANDLE WaitCompletionPacketHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAssociateWaitCompletionPacket(
      _In_ HANDLE WaitCompletionPacketHandle,
      _In_ HANDLE IoCompletionHandle,
      _In_ HANDLE TargetObjectHandle,
      _In_opt_ PVOID KeyContext,
      _In_opt_ PVOID ApcContext,
      _In_ NTSTATUS IoStatus,
      _In_ ULONG_PTR IoStatusInformation,
      _Out_opt_ PBOOLEAN AlreadySignaled
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwAssociateWaitCompletionPacket(
      _In_ HANDLE WaitCompletionPacketHandle,
      _In_ HANDLE IoCompletionHandle,
      _In_ HANDLE TargetObjectHandle,
      _In_opt_ PVOID KeyContext,
      _In_opt_ PVOID ApcContext,
      _In_ NTSTATUS IoStatus,
      _In_ ULONG_PTR IoStatusInformation,
      _Out_opt_ PBOOLEAN AlreadySignaled
  );
  
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCancelWaitCompletionPacket(
      _In_ HANDLE WaitCompletionPacketHandle,
      _In_ BOOLEAN RemoveSignaledPacket
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwCancelWaitCompletionPacket(
      _In_ HANDLE WaitCompletionPacketHandle,
      _In_ BOOLEAN RemoveSignaledPacket
  );
  #endif
  
  //
  // Sessions
  //
  
  #ifndef _KERNEL_MODE
  typedef enum _IO_SESSION_EVENT
  {
      IoSessionEventIgnore,
      IoSessionEventCreated,
      IoSessionEventTerminated,
      IoSessionEventConnected,
      IoSessionEventDisconnected,
      IoSessionEventLogon,
      IoSessionEventLogoff,
      IoSessionEventMax
  } IO_SESSION_EVENT;
  
  typedef enum _IO_SESSION_STATE
  {
      IoSessionStateCreated = 1,
      IoSessionStateInitialized = 2,
      IoSessionStateConnected = 3,
      IoSessionStateDisconnected = 4,
      IoSessionStateDisconnectedLoggedOn = 5,
      IoSessionStateLoggedOn = 6,
      IoSessionStateLoggedOff = 7,
      IoSessionStateTerminated = 8,
      IoSessionStateMax
  } IO_SESSION_STATE;
  #endif // !_KERNEL_MODE
  
  #if (NTDDI_VERSION >= NTDDI_VISTA)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenSession(
      _Out_ PHANDLE SessionHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwOpenSession(
      _Out_ PHANDLE SessionHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ POBJECT_ATTRIBUTES ObjectAttributes
  );
  #endif
  
  #if (NTDDI_VERSION >= NTDDI_WIN7)
  __kernel_entry NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtNotifyChangeSession(
      _In_ HANDLE SessionHandle,
      _In_ ULONG ChangeSequenceNumber,
      _In_ PLARGE_INTEGER ChangeTimeStamp,
      _In_ IO_SESSION_EVENT Event,
      _In_ IO_SESSION_STATE NewState,
      _In_ IO_SESSION_STATE PreviousState,
      _In_reads_bytes_opt_(PayloadSize) PVOID Payload,
      _In_ ULONG PayloadSize
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  ZwNotifyChangeSession(
      _In_ HANDLE SessionHandle,
      _In_ ULONG ChangeSequenceNumber,
      _In_ PLARGE_INTEGER ChangeTimeStamp,
      _In_ IO_SESSION_EVENT Event,
      _In_ IO_SESSION_STATE NewState,
      _In_ IO_SESSION_STATE PreviousState,
      _In_reads_bytes_opt_(PayloadSize) PVOID Payload,
      _In_ ULONG PayloadSize
  );
  #endif
  
  //
  // Other types
  //
  
  #ifndef _KERNEL_MODE
  //
  // Define the I/O bus interface types.
  //
  typedef enum _INTERFACE_TYPE
  {
      InterfaceTypeUndefined = -1,
      Internal = 0,
      Isa = 1,
      Eisa = 2,
      MicroChannel = 3,
      TurboChannel = 4,
      PCIBus = 5,
      VMEBus = 6,
      NuBus = 7,
      PCMCIABus = 8,
      CBus = 9,
      MPIBus = 10,
      MPSABus = 11,
      ProcessorInternal = 12,
      InternalPowerBus = 13,
      PNPISABus = 14,
      PNPBus = 15,
      Vmcs = 16,
      ACPIBus = 17,
      MaximumInterfaceType
  } INTERFACE_TYPE, * PINTERFACE_TYPE;
  
  //
  // Define the DMA transfer widths.
  //
  
  typedef enum _DMA_WIDTH
  {
      Width8Bits,
      Width16Bits,
      Width32Bits,
      Width64Bits,
      WidthNoWrap,
      MaximumDmaWidth
  } DMA_WIDTH, * PDMA_WIDTH;
  
  //
  // Define DMA transfer speeds.
  //
  
  typedef enum _DMA_SPEED
  {
      Compatible,
      TypeA,
      TypeB,
      TypeC,
      TypeF,
      MaximumDmaSpeed
  } DMA_SPEED, * PDMA_SPEED;
  
  typedef enum _BUS_DATA_TYPE
  {
      ConfigurationSpaceUndefined = -1,
      Cmos,
      EisaConfiguration,
      Pos,
      CbusConfiguration,
      PCIConfiguration,
      VMEConfiguration,
      NuBusConfiguration,
      PCMCIAConfiguration,
      MPIConfiguration,
      MPSAConfiguration,
      PNPISAConfiguration,
      SgiInternalConfiguration,
      MaximumBusDataType
  } BUS_DATA_TYPE, * PBUS_DATA_TYPE;
  #endif // !_KERNEL_MODE
  
  //
  // Control structures
  //
  
  #ifndef _KERNEL_MODE
  // Reparse structure for FSCTL_SET_REPARSE_POINT, FSCTL_GET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT
  
  #define SYMLINK_FLAG_RELATIVE   0x00000001
  
  #if (NTDDI_VERSION >= NTDDI_WIN10_RS4)
  #define SYMLINK_DIRECTORY       0x80000000 // If set then this is a directory symlink
  #define SYMLINK_FILE            0x40000000 // If set then this is a file symlink
  #endif
  
  typedef struct _REPARSE_DATA_BUFFER
  {
      ULONG ReparseTag;
      USHORT ReparseDataLength;
      USHORT Reserved;
  
      _Field_size_bytes_(ReparseDataLength)
          union
      {
          struct
          {
              USHORT SubstituteNameOffset;
              USHORT SubstituteNameLength;
              USHORT PrintNameOffset;
              USHORT PrintNameLength;
              ULONG Flags;
              WCHAR PathBuffer[1];
          } SymbolicLinkReparseBuffer;
          struct
          {
              USHORT SubstituteNameOffset;
              USHORT SubstituteNameLength;
              USHORT PrintNameOffset;
              USHORT PrintNameLength;
              WCHAR PathBuffer[1];
          } MountPointReparseBuffer;
          struct
          {
              UCHAR DataBuffer[1];
          } GenericReparseBuffer;
      };
  } REPARSE_DATA_BUFFER, * PREPARSE_DATA_BUFFER;
  
  #define REPARSE_DATA_BUFFER_HEADER_SIZE UFIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
  
  #endif // !_KERNEL_MODE
  
  // Named pipe FS control definitions
  
  #define DEVICE_NAMED_PIPE L"\\Device\\NamedPipe\\"
  
  #ifndef _KERNEL_MODE
  #define FSCTL_PIPE_ASSIGN_EVENT             CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_DISCONNECT               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_LISTEN                   CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_PEEK                     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
  #define FSCTL_PIPE_QUERY_EVENT              CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_TRANSCEIVE               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER,  FILE_READ_DATA | FILE_WRITE_DATA)
  #define FSCTL_PIPE_WAIT                     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_IMPERSONATE              CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_SET_CLIENT_PROCESS       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_QUERY_CLIENT_PROCESS     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_GET_PIPE_ATTRIBUTE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_SET_PIPE_ATTRIBUTE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_FLUSH                    CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
  #define FSCTL_PIPE_DISABLE_IMPERSONATE      CTL_CODE(FILE_DEVICE_NAMED_PIPE, 17, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define FSCTL_PIPE_SILO_ARRIVAL             CTL_CODE(FILE_DEVICE_NAMED_PIPE, 18, METHOD_BUFFERED, FILE_WRITE_DATA)
  #define FSCTL_PIPE_CREATE_SYMLINK           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 19, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
  #define FSCTL_PIPE_DELETE_SYMLINK           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 20, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
  #define FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2  CTL_CODE(FILE_DEVICE_NAMED_PIPE, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
  
  #define FSCTL_PIPE_INTERNAL_READ            CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
  #define FSCTL_PIPE_INTERNAL_WRITE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
  #define FSCTL_PIPE_INTERNAL_TRANSCEIVE      CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
  #define FSCTL_PIPE_INTERNAL_READ_OVFLOW     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
  
  // Flags for query event
  
  #define FILE_PIPE_READ_DATA     0x00000000
  #define FILE_PIPE_WRITE_SPACE   0x00000001
  
  // Input for FSCTL_PIPE_ASSIGN_EVENT
  typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
  {
      HANDLE EventHandle;
      ULONG KeyValue;
  } FILE_PIPE_ASSIGN_EVENT_BUFFER, * PFILE_PIPE_ASSIGN_EVENT_BUFFER;
  
  // Output for FILE_PIPE_PEEK_BUFFER
  typedef struct _FILE_PIPE_PEEK_BUFFER
  {
      ULONG NamedPipeState;
      ULONG ReadDataAvailable;
      ULONG NumberOfMessages;
      ULONG MessageLength;
      CHAR Data[1];
  } FILE_PIPE_PEEK_BUFFER, * PFILE_PIPE_PEEK_BUFFER;
  
  // Output for FSCTL_PIPE_QUERY_EVENT
  typedef struct _FILE_PIPE_EVENT_BUFFER
  {
      ULONG NamedPipeState;
      ULONG EntryType;
      ULONG ByteCount;
      ULONG KeyValue;
      ULONG NumberRequests;
  } FILE_PIPE_EVENT_BUFFER, * PFILE_PIPE_EVENT_BUFFER;
  
  // Input for FSCTL_PIPE_WAIT
  typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
  {
      LARGE_INTEGER Timeout;
      ULONG NameLength;
      BOOLEAN TimeoutSpecified;
      WCHAR Name[1];
  } FILE_PIPE_WAIT_FOR_BUFFER, * PFILE_PIPE_WAIT_FOR_BUFFER;
  
  // Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS
  typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
  {
  #if !defined(BUILD_WOW6432)
      PVOID ClientSession;
      PVOID ClientProcess;
  #else
      ULONGLONG ClientSession;
      ULONGLONG ClientProcess;
  #endif
  } FILE_PIPE_CLIENT_PROCESS_BUFFER, * PFILE_PIPE_CLIENT_PROCESS_BUFFER;
  
  // Control structure for FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2
  
  typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2
  {
      ULONGLONG ClientSession;
  #if !defined(BUILD_WOW6432)
      PVOID ClientProcess;
  #else
      ULONGLONG ClientProcess;
  #endif
  } FILE_PIPE_CLIENT_PROCESS_BUFFER_V2, * PFILE_PIPE_CLIENT_PROCESS_BUFFER_V2;
  
  #define FILE_PIPE_COMPUTER_NAME_LENGTH 15
  
  // Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS
  typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX
  {
  #if !defined(BUILD_WOW6432)
      PVOID ClientSession;
      PVOID ClientProcess;
  #else
      ULONGLONG ClientSession;
      ULONGLONG ClientProcess;
  #endif
      USHORT ClientComputerNameLength; // in bytes
      WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH + 1]; // null-terminated
  } FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, * PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
  
  // Control structure for FSCTL_PIPE_SILO_ARRIVAL
  
  typedef struct _FILE_PIPE_SILO_ARRIVAL_INPUT
  {
      HANDLE JobHandle;
  } FILE_PIPE_SILO_ARRIVAL_INPUT, * PFILE_PIPE_SILO_ARRIVAL_INPUT;
  
  //
  // Flags for create symlink
  //
  
  //
  // A global symlink will cause resolution of the symlink's target to occur in
  // the host silo (i.e. not in any current silo).  For example, if there is a
  // symlink at \Device\Silos\37\Device\NamedPipe\symlink then the target will be
  // resolved as \Device\NamedPipe\target instead of \Device\Silos\37\Device\NamedPipe\target
  //
  #define FILE_PIPE_SYMLINK_FLAG_GLOBAL   0x1
  
  //
  // A relative symlink will cause resolution of the symlink's target to occur relative
  // to the root of the named pipe file system.  For example, if there is a symlink at
  // \Device\NamedPipe\symlink that has a target called "target", then the target will
  // be resolved as \Device\NamedPipe\target
  //
  #define FILE_PIPE_SYMLINK_FLAG_RELATIVE 0x2
  
  #define FILE_PIPE_SYMLINK_VALID_FLAGS \
      (FILE_PIPE_SYMLINK_FLAG_GLOBAL | FILE_PIPE_SYMLINK_FLAG_RELATIVE)
  
  // Control structure for FSCTL_PIPE_CREATE_SYMLINK
  
  typedef struct _FILE_PIPE_CREATE_SYMLINK_INPUT
  {
      USHORT NameOffset;
      USHORT NameLength;
      USHORT SubstituteNameOffset;
      USHORT SubstituteNameLength;
      ULONG Flags;
  } FILE_PIPE_CREATE_SYMLINK_INPUT, * PFILE_PIPE_CREATE_SYMLINK_INPUT;
  
  // Control structure for FSCTL_PIPE_DELETE_SYMLINK
  
  typedef struct _FILE_PIPE_DELETE_SYMLINK_INPUT
  {
      USHORT NameOffset;
      USHORT NameLength;
  } FILE_PIPE_DELETE_SYMLINK_INPUT, * PFILE_PIPE_DELETE_SYMLINK_INPUT;
  #endif // !_KERNEL_MODE
  
  // Mailslot FS control definitions
  
  #define MAILSLOT_CLASS_FIRSTCLASS   1
  #define MAILSLOT_CLASS_SECONDCLASS  2
  
  #define FSCTL_MAILSLOT_PEEK         CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
  
  // Output for FSCTL_MAILSLOT_PEEK
  typedef struct _FILE_MAILSLOT_PEEK_BUFFER
  {
      ULONG ReadDataAvailable;
      ULONG NumberOfMessages;
      ULONG MessageLength;
  } FILE_MAILSLOT_PEEK_BUFFER, * PFILE_MAILSLOT_PEEK_BUFFER;
  
  // Mount manager FS control definitions
  
  #define MOUNTMGR_DEVICE_NAME L"\\Device\\MountPointManager"
  #define MOUNTMGRCONTROLTYPE 0x0000006D // 'm'
  #define MOUNTDEVCONTROLTYPE 0x0000004D // 'M'
  
  #define IOCTL_MOUNTMGR_CREATE_POINT                 CTL_CODE(MOUNTMGRCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_DELETE_POINTS                CTL_CODE(MOUNTMGRCONTROLTYPE, 1, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_QUERY_POINTS                 CTL_CODE(MOUNTMGRCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY         CTL_CODE(MOUNTMGRCONTROLTYPE, 3, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER            CTL_CODE(MOUNTMGRCONTROLTYPE, 4, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_AUTO_DL_ASSIGNMENTS          CTL_CODE(MOUNTMGRCONTROLTYPE, 5, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED   CTL_CODE(MOUNTMGRCONTROLTYPE, 6, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED   CTL_CODE(MOUNTMGRCONTROLTYPE, 7, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_CHANGE_NOTIFY                CTL_CODE(MOUNTMGRCONTROLTYPE, 8, METHOD_BUFFERED, FILE_READ_ACCESS)
  #define IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE      CTL_CODE(MOUNTMGRCONTROLTYPE, 9, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
  #define IOCTL_MOUNTMGR_CHECK_UNPROCESSED_VOLUMES    CTL_CODE(MOUNTMGRCONTROLTYPE, 10, METHOD_BUFFERED, FILE_READ_ACCESS)
  #define IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION  CTL_CODE(MOUNTMGRCONTROLTYPE, 11, METHOD_BUFFERED, FILE_READ_ACCESS)
  #define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH        CTL_CODE(MOUNTMGRCONTROLTYPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
  #define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS       CTL_CODE(MOUNTMGRCONTROLTYPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
  
  #define IOCTL_MOUNTDEV_QUERY_DEVICE_NAME            CTL_CODE(MOUNTDEVCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
  
  // Input structure for IOCTL_MOUNTMGR_CREATE_POINT.
  typedef struct _MOUNTMGR_CREATE_POINT_INPUT
  {
      USHORT SymbolicLinkNameOffset;
      USHORT SymbolicLinkNameLength;
      USHORT DeviceNameOffset;
      USHORT DeviceNameLength;
  } MOUNTMGR_CREATE_POINT_INPUT, * PMOUNTMGR_CREATE_POINT_INPUT;
  
  // Input structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.
  typedef struct _MOUNTMGR_MOUNT_POINT
  {
      ULONG SymbolicLinkNameOffset;
      USHORT SymbolicLinkNameLength;
      USHORT Reserved1;
      ULONG UniqueIdOffset;
      USHORT UniqueIdLength;
      USHORT Reserved2;
      ULONG DeviceNameOffset;
      USHORT DeviceNameLength;
      USHORT Reserved3;
  } MOUNTMGR_MOUNT_POINT, * PMOUNTMGR_MOUNT_POINT;
  
  // Output structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.
  typedef struct _MOUNTMGR_MOUNT_POINTS
  {
      ULONG Size;
      ULONG NumberOfMountPoints;
      MOUNTMGR_MOUNT_POINT MountPoints[1];
  } MOUNTMGR_MOUNT_POINTS, * PMOUNTMGR_MOUNT_POINTS;
  
  // Input structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER.
  typedef struct _MOUNTMGR_DRIVE_LETTER_TARGET
  {
      USHORT DeviceNameLength;
      WCHAR DeviceName[1];
  } MOUNTMGR_DRIVE_LETTER_TARGET, * PMOUNTMGR_DRIVE_LETTER_TARGET;
  
  // Output structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER.
  typedef struct _MOUNTMGR_DRIVE_LETTER_INFORMATION
  {
      BOOLEAN DriveLetterWasAssigned;
      UCHAR CurrentDriveLetter;
  } MOUNTMGR_DRIVE_LETTER_INFORMATION, * PMOUNTMGR_DRIVE_LETTER_INFORMATION;
  
  // Input structure for IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED and
  // IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED.
  typedef struct _MOUNTMGR_VOLUME_MOUNT_POINT
  {
      USHORT SourceVolumeNameOffset;
      USHORT SourceVolumeNameLength;
      USHORT TargetVolumeNameOffset;
      USHORT TargetVolumeNameLength;
  } MOUNTMGR_VOLUME_MOUNT_POINT, * PMOUNTMGR_VOLUME_MOUNT_POINT;
  
  // Input structure for IOCTL_MOUNTMGR_CHANGE_NOTIFY.
  // Output structure for IOCTL_MOUNTMGR_CHANGE_NOTIFY.
  typedef struct _MOUNTMGR_CHANGE_NOTIFY_INFO
  {
      ULONG EpicNumber;
  } MOUNTMGR_CHANGE_NOTIFY_INFO, * PMOUNTMGR_CHANGE_NOTIFY_INFO;
  
  // Input structure for IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE,
  // IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION,
  // IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH, and
  // IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS.
  // IOCTL_MOUNTMGR_PREPARE_VOLUME_DELETE
  // IOCTL_MOUNTMGR_CANCEL_VOLUME_DELETE
  typedef struct _MOUNTMGR_TARGET_NAME
  {
      USHORT DeviceNameLength;
      WCHAR DeviceName[1];
  } MOUNTMGR_TARGET_NAME, * PMOUNTMGR_TARGET_NAME;
  
  // Macro that defines what a "drive letter" mount point is.  This macro can
  // be used to scan the result from QUERY_POINTS to discover which mount points
  // are find "drive letter" mount points.
  #define MOUNTMGR_IS_DRIVE_LETTER(s) ( \
      (s)->Length == 28 && \
      (s)->Buffer[0] == '\\' && \
      (s)->Buffer[1] == 'D' && \
      (s)->Buffer[2] == 'o' && \
      (s)->Buffer[3] == 's' && \
      (s)->Buffer[4] == 'D' && \
      (s)->Buffer[5] == 'e' && \
      (s)->Buffer[6] == 'v' && \
      (s)->Buffer[7] == 'i' && \
      (s)->Buffer[8] == 'c' && \
      (s)->Buffer[9] == 'e' && \
      (s)->Buffer[10] == 's' && \
      (s)->Buffer[11] == '\\' && \
      (s)->Buffer[12] >= 'A' && \
      (s)->Buffer[12] <= 'Z' && \
      (s)->Buffer[13] == ':')
  
  // Macro that defines what a "volume name" mount point is.  This macro can
  // be used to scan the result from QUERY_POINTS to discover which mount points
  // are "volume name" mount points.
  #define MOUNTMGR_IS_VOLUME_NAME(s) ( \
       ((s)->Length == 96 || ((s)->Length == 98 && (s)->Buffer[48] == '\\')) && \
       (s)->Buffer[0] == '\\' && \
       ((s)->Buffer[1] == '?' || (s)->Buffer[1] == '\\') && \
       (s)->Buffer[2] == '?' && \
       (s)->Buffer[3] == '\\' && \
       (s)->Buffer[4] == 'V' && \
       (s)->Buffer[5] == 'o' && \
       (s)->Buffer[6] == 'l' && \
       (s)->Buffer[7] == 'u' && \
       (s)->Buffer[8] == 'm' && \
       (s)->Buffer[9] == 'e' && \
       (s)->Buffer[10] == '{' && \
       (s)->Buffer[19] == '-' && \
       (s)->Buffer[24] == '-' && \
       (s)->Buffer[29] == '-' && \
       (s)->Buffer[34] == '-' && \
       (s)->Buffer[47] == '}')
  
  // Output structure for IOCTL_MOUNTDEV_QUERY_DEVICE_NAME.
  typedef struct _MOUNTDEV_NAME
  {
      USHORT NameLength;
      WCHAR Name[1];
  } MOUNTDEV_NAME, * PMOUNTDEV_NAME;
  
  // Output structure for IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH and IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS.
  typedef struct _MOUNTMGR_VOLUME_PATHS
  {
      ULONG MultiSzLength;
      WCHAR MultiSz[1];
  } MOUNTMGR_VOLUME_PATHS, * PMOUNTMGR_VOLUME_PATHS;
  
  #define MOUNTMGR_IS_DOS_VOLUME_NAME(s) ( \
       MOUNTMGR_IS_VOLUME_NAME(s) && \
       (s)->Length == 96 && \
       (s)->Buffer[1] == '\\')
  
  #define MOUNTMGR_IS_DOS_VOLUME_NAME_WB(s) ( \
       MOUNTMGR_IS_VOLUME_NAME(s) && \
       (s)->Length == 98 && \
       (s)->Buffer[1] == '\\')
  
  #define MOUNTMGR_IS_NT_VOLUME_NAME(s) ( \
       MOUNTMGR_IS_VOLUME_NAME(s) && \
       (s)->Length == 96 && \
       (s)->Buffer[1] == '?')
  
  #define MOUNTMGR_IS_NT_VOLUME_NAME_WB(s) ( \
       MOUNTMGR_IS_VOLUME_NAME(s) && \
       (s)->Length == 98 && \
       (s)->Buffer[1] == '?')
  
  //
  // Only Kernel
  //
  
  #ifdef _KERNEL_MODE
  
  // Driver
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  NTSTATUS
  NTAPI
  IoCreateDriver(
      _In_opt_ PUNICODE_STRING DriverName,
      _In_ PDRIVER_INITIALIZE InitializationFunction
  );
  
  _IRQL_requires_max_(PASSIVE_LEVEL)
  NTSYSAPI
  VOID
  NTAPI
  IoDeleteDriver(
      _In_ PDRIVER_OBJECT DriverObject
  );
  
  #endif // _KERNEL_MODE
  
  VEIL_END()
  
  #if _MSC_VER >= 1200
  #pragma warning(pop)
  #endif
  