text: /*
   * Process Hacker -
   *   Authorization functions
   *
   * This file is part of Process Hacker.
   *
   * Process Hacker is free software; you can redistribute it and/or modify
   * it under the terms of the GNU General Public License as published by
   * the Free Software Foundation, either version 3 of the License, or
   * (at your option) any later version.
   *
   * Process Hacker is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   * GNU General Public License for more details.
   *
   * You should have received a copy of the GNU General Public License
   * along with Process Hacker.  If not, see <http://www.gnu.org/licenses/>.
   */
  
  #ifndef _NTSEAPI_H
  #define _NTSEAPI_H
  
  // Privileges
  
  #define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)
  #define SE_CREATE_TOKEN_PRIVILEGE (2L)
  #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)
  #define SE_LOCK_MEMORY_PRIVILEGE (4L)
  #define SE_INCREASE_QUOTA_PRIVILEGE (5L)
  
  #define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)
  #define SE_TCB_PRIVILEGE (7L)
  #define SE_SECURITY_PRIVILEGE (8L)
  #define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)
  #define SE_LOAD_DRIVER_PRIVILEGE (10L)
  #define SE_SYSTEM_PROFILE_PRIVILEGE (11L)
  #define SE_SYSTEMTIME_PRIVILEGE (12L)
  #define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)
  #define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)
  #define SE_CREATE_PAGEFILE_PRIVILEGE (15L)
  #define SE_CREATE_PERMANENT_PRIVILEGE (16L)
  #define SE_BACKUP_PRIVILEGE (17L)
  #define SE_RESTORE_PRIVILEGE (18L)
  #define SE_SHUTDOWN_PRIVILEGE (19L)
  #define SE_DEBUG_PRIVILEGE (20L)
  #define SE_AUDIT_PRIVILEGE (21L)
  #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)
  #define SE_CHANGE_NOTIFY_PRIVILEGE (23L)
  #define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)
  #define SE_UNDOCK_PRIVILEGE (25L)
  #define SE_SYNC_AGENT_PRIVILEGE (26L)
  #define SE_ENABLE_DELEGATION_PRIVILEGE (27L)
  #define SE_MANAGE_VOLUME_PRIVILEGE (28L)
  #define SE_IMPERSONATE_PRIVILEGE (29L)
  #define SE_CREATE_GLOBAL_PRIVILEGE (30L)
  #define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)
  #define SE_RELABEL_PRIVILEGE (32L)
  #define SE_INC_WORKING_SET_PRIVILEGE (33L)
  #define SE_TIME_ZONE_PRIVILEGE (34L)
  #define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L)
  #define SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE (36L)
  #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE
  
  // Authz
  
  // begin_rev
  
  #if (PHNT_MODE == PHNT_MODE_KERNEL)
  typedef enum _TOKEN_INFORMATION_CLASS
  {
      TokenUser = 1, // q: TOKEN_USER
      TokenGroups, // q: TOKEN_GROUPS
      TokenPrivileges, // q: TOKEN_PRIVILEGES
      TokenOwner, // q; s: TOKEN_OWNER
      TokenPrimaryGroup, // q; s: TOKEN_PRIMARY_GROUP
      TokenDefaultDacl, // q; s: TOKEN_DEFAULT_DACL
      TokenSource, // q: TOKEN_SOURCE
      TokenType, // q: TOKEN_TYPE
      TokenImpersonationLevel, // q: SECURITY_IMPERSONATION_LEVEL
      TokenStatistics, // q: TOKEN_STATISTICS // 10
      TokenRestrictedSids, // q: TOKEN_GROUPS
      TokenSessionId, // q; s: ULONG (requires SeTcbPrivilege)
      TokenGroupsAndPrivileges, // q: TOKEN_GROUPS_AND_PRIVILEGES
      TokenSessionReference, // s: ULONG (requires SeTcbPrivilege)
      TokenSandBoxInert, // q: ULONG
      TokenAuditPolicy, // q; s: TOKEN_AUDIT_POLICY (requires SeSecurityPrivilege/SeTcbPrivilege)
      TokenOrigin, // q; s: TOKEN_ORIGIN (requires SeTcbPrivilege)
      TokenElevationType, // q: TOKEN_ELEVATION_TYPE
      TokenLinkedToken, // q; s: TOKEN_LINKED_TOKEN (requires SeCreateTokenPrivilege)
      TokenElevation, // q: TOKEN_ELEVATION // 20
      TokenHasRestrictions, // q: ULONG
      TokenAccessInformation, // q: TOKEN_ACCESS_INFORMATION
      TokenVirtualizationAllowed, // q; s: ULONG (requires SeCreateTokenPrivilege)
      TokenVirtualizationEnabled, // q; s: ULONG
      TokenIntegrityLevel, // q; s: TOKEN_MANDATORY_LABEL
      TokenUIAccess, // q; s: ULONG
      TokenMandatoryPolicy, // q; s: TOKEN_MANDATORY_POLICY (requires SeTcbPrivilege)
      TokenLogonSid, // q: TOKEN_GROUPS
      TokenIsAppContainer, // q: ULONG
      TokenCapabilities, // q: TOKEN_GROUPS // 30
      TokenAppContainerSid, // q: TOKEN_APPCONTAINER_INFORMATION
      TokenAppContainerNumber, // q: ULONG
      TokenUserClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
      TokenDeviceClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
      TokenRestrictedUserClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
      TokenRestrictedDeviceClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
      TokenDeviceGroups, // q: TOKEN_GROUPS
      TokenRestrictedDeviceGroups, // q: TOKEN_GROUPS
      TokenSecurityAttributes, // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION
      TokenIsRestricted, // q: ULONG // 40
      TokenProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL
      TokenPrivateNameSpace, // q; s: ULONG
      TokenSingletonAttributes, // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION
      TokenBnoIsolation, // q: TOKEN_BNO_ISOLATION_INFORMATION
      TokenChildProcessFlags, // q; s: ULONG
      TokenIsLessPrivilegedAppContainer, // q: ULONG
      TokenIsSandboxed, // q: ULONG
      TokenOriginatingProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL
      MaxTokenInfoClass
  } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
  #endif
  
  // Types
  
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06
  #define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10
  
  // Flags
  
  #define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001
  #define TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE 0x0002
  #define TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY 0x0004
  #define TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT 0x0008
  #define TOKEN_SECURITY_ATTRIBUTE_DISABLED 0x0010
  #define TOKEN_SECURITY_ATTRIBUTE_MANDATORY 0x0020
  #define TOKEN_SECURITY_ATTRIBUTE_COMPARE_IGNORE 0x0040
  
  #define TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS ( \
      TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE | \
      TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | \
      TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY | \
      TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | \
      TOKEN_SECURITY_ATTRIBUTE_DISABLED | \
      TOKEN_SECURITY_ATTRIBUTE_MANDATORY)
  
  #define TOKEN_SECURITY_ATTRIBUTE_CUSTOM_FLAGS 0xffff0000
  
  // end_rev
  
  // private
  typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE
  {
      ULONG64 Version;
      UNICODE_STRING Name;
  } TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;
  
  // private
  typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
  {
      PVOID pValue;
      ULONG ValueLength;
  } TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;
  
  // private
  typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
  {
      UNICODE_STRING Name;
      USHORT ValueType;
      USHORT Reserved;
      ULONG Flags;
      ULONG ValueCount;
      union
      {
          PLONG64 pInt64;
          PULONG64 pUint64;
          PUNICODE_STRING pString;
          PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
          PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
      } Values;
  } TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;
  
  // rev
  #define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1 1
  // rev
  #define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1
  
  // private
  typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
  {
      USHORT Version;
      USHORT Reserved;
      ULONG AttributeCount;
      union
      {
          PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
      } Attribute;
  } TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;
  
  // private
  typedef enum _TOKEN_SECURITY_ATTRIBUTE_OPERATION
  {
      TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE,
      TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL,
      TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD,
      TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE,
      TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE
  } TOKEN_SECURITY_ATTRIBUTE_OPERATION, *PTOKEN_SECURITY_ATTRIBUTE_OPERATION;
  
  // private
  typedef struct _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION
  {
      PTOKEN_SECURITY_ATTRIBUTES_INFORMATION Attributes;
      PTOKEN_SECURITY_ATTRIBUTE_OPERATION Operations;
  } TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION;
  
  // rev
  typedef struct _TOKEN_PROCESS_TRUST_LEVEL
  {
      PSID TrustLevelSid;
  } TOKEN_PROCESS_TRUST_LEVEL, *PTOKEN_PROCESS_TRUST_LEVEL;
  
  // Tokens
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateToken(
      _Out_ PHANDLE TokenHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
      _In_ TOKEN_TYPE Type,
      _In_ PLUID AuthenticationId,
      _In_ PLARGE_INTEGER ExpirationTime,
      _In_ PTOKEN_USER User,
      _In_ PTOKEN_GROUPS Groups,
      _In_ PTOKEN_PRIVILEGES Privileges,
      _In_opt_ PTOKEN_OWNER Owner,
      _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
      _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
      _In_ PTOKEN_SOURCE Source
      );
  
  #if (PHNT_VERSION >= PHNT_WIN8)
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateLowBoxToken(
      _Out_ PHANDLE TokenHandle,
      _In_ HANDLE ExistingTokenHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
      _In_ PSID PackageSid,
      _In_ ULONG CapabilityCount,
      _In_reads_opt_(CapabilityCount) PSID_AND_ATTRIBUTES Capabilities,
      _In_ ULONG HandleCount,
      _In_reads_opt_(HandleCount) HANDLE *Handles
      );
  #endif
  
  #if (PHNT_VERSION >= PHNT_WIN8)
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCreateTokenEx(
      _Out_ PHANDLE TokenHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
      _In_ TOKEN_TYPE Type,
      _In_ PLUID AuthenticationId,
      _In_ PLARGE_INTEGER ExpirationTime,
      _In_ PTOKEN_USER User,
      _In_ PTOKEN_GROUPS Groups,
      _In_ PTOKEN_PRIVILEGES Privileges,
      _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,
      _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,
      _In_opt_ PTOKEN_GROUPS DeviceGroups,
      _In_opt_ PTOKEN_MANDATORY_POLICY MandatoryPolicy,
      _In_opt_ PTOKEN_OWNER Owner,
      _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
      _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
      _In_ PTOKEN_SOURCE Source
      );
  #endif
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenProcessToken(
      _In_ HANDLE ProcessHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _Out_ PHANDLE TokenHandle
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenProcessTokenEx(
      _In_ HANDLE ProcessHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ ULONG HandleAttributes,
      _Out_ PHANDLE TokenHandle
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenThreadToken(
      _In_ HANDLE ThreadHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ BOOLEAN OpenAsSelf,
      _Out_ PHANDLE TokenHandle
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenThreadTokenEx(
      _In_ HANDLE ThreadHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ BOOLEAN OpenAsSelf,
      _In_ ULONG HandleAttributes,
      _Out_ PHANDLE TokenHandle
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtDuplicateToken(
      _In_ HANDLE ExistingTokenHandle,
      _In_ ACCESS_MASK DesiredAccess,
      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
      _In_ BOOLEAN EffectiveOnly,
      _In_ TOKEN_TYPE Type,
      _Out_ PHANDLE NewTokenHandle
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQueryInformationToken(
      _In_ HANDLE TokenHandle,
      _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
      _Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) PVOID TokenInformation,
      _In_ ULONG TokenInformationLength,
      _Out_ PULONG ReturnLength
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetInformationToken(
      _In_ HANDLE TokenHandle,
      _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
      _In_reads_bytes_(TokenInformationLength) PVOID TokenInformation,
      _In_ ULONG TokenInformationLength
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAdjustPrivilegesToken(
      _In_ HANDLE TokenHandle,
      _In_ BOOLEAN DisableAllPrivileges,
      _In_opt_ PTOKEN_PRIVILEGES NewState,
      _In_ ULONG BufferLength,
      _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
      _Out_opt_ PULONG ReturnLength
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAdjustGroupsToken(
      _In_ HANDLE TokenHandle,
      _In_ BOOLEAN ResetToDefault,
      _In_opt_ PTOKEN_GROUPS NewState,
      _In_opt_ ULONG BufferLength,
      _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
      _Out_opt_ PULONG ReturnLength
      );
  
  #if (PHNT_VERSION >= PHNT_WIN8)
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAdjustTokenClaimsAndDeviceGroups(
      _In_ HANDLE TokenHandle,
      _In_ BOOLEAN UserResetToDefault,
      _In_ BOOLEAN DeviceResetToDefault,
      _In_ BOOLEAN DeviceGroupsResetToDefault,
      _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewUserState,
      _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewDeviceState,
      _In_opt_ PTOKEN_GROUPS NewDeviceGroupsState,
      _In_ ULONG UserBufferLength,
      _Out_writes_bytes_to_opt_(UserBufferLength, *UserReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousUserState,
      _In_ ULONG DeviceBufferLength,
      _Out_writes_bytes_to_opt_(DeviceBufferLength, *DeviceReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousDeviceState,
      _In_ ULONG DeviceGroupsBufferLength,
      _Out_writes_bytes_to_opt_(DeviceGroupsBufferLength, *DeviceGroupsReturnBufferLength) PTOKEN_GROUPS PreviousDeviceGroups,
      _Out_opt_ PULONG UserReturnLength,
      _Out_opt_ PULONG DeviceReturnLength,
      _Out_opt_ PULONG DeviceGroupsReturnBufferLength
      );
  #endif
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtFilterToken(
      _In_ HANDLE ExistingTokenHandle,
      _In_ ULONG Flags,
      _In_opt_ PTOKEN_GROUPS SidsToDisable,
      _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
      _In_opt_ PTOKEN_GROUPS RestrictedSids,
      _Out_ PHANDLE NewTokenHandle
      );
  
  #if (PHNT_VERSION >= PHNT_WIN8)
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtFilterTokenEx(
      _In_ HANDLE ExistingTokenHandle,
      _In_ ULONG Flags,
      _In_opt_ PTOKEN_GROUPS SidsToDisable,
      _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
      _In_opt_ PTOKEN_GROUPS RestrictedSids,
      _In_ ULONG DisableUserClaimsCount,
      _In_opt_ PUNICODE_STRING UserClaimsToDisable,
      _In_ ULONG DisableDeviceClaimsCount,
      _In_opt_ PUNICODE_STRING DeviceClaimsToDisable,
      _In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,
      _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,
      _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,
      _In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,
      _Out_ PHANDLE NewTokenHandle
      );
  #endif
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCompareTokens(
      _In_ HANDLE FirstTokenHandle,
      _In_ HANDLE SecondTokenHandle,
      _Out_ PBOOLEAN Equal
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtPrivilegeCheck(
      _In_ HANDLE ClientToken,
      _Inout_ PPRIVILEGE_SET RequiredPrivileges,
      _Out_ PBOOLEAN Result
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtImpersonateAnonymousToken(
      _In_ HANDLE ThreadHandle
      );
  
  #if (PHNT_VERSION >= PHNT_WIN7)
  // rev
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtQuerySecurityAttributesToken(
      _In_ HANDLE TokenHandle,
      _In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,
      _In_ ULONG NumberOfAttributes,
      _Out_writes_bytes_(Length) PVOID Buffer, // PTOKEN_SECURITY_ATTRIBUTES_INFORMATION
      _In_ ULONG Length,
      _Out_ PULONG ReturnLength
      );
  #endif
  
  // Access checking
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheck(
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_ HANDLE ClientToken,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ PGENERIC_MAPPING GenericMapping,
      _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
      _Inout_ PULONG PrivilegeSetLength,
      _Out_ PACCESS_MASK GrantedAccess,
      _Out_ PNTSTATUS AccessStatus
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheckByType(
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_opt_ PSID PrincipalSelfSid,
      _In_ HANDLE ClientToken,
      _In_ ACCESS_MASK DesiredAccess,
      _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
      _In_ ULONG ObjectTypeListLength,
      _In_ PGENERIC_MAPPING GenericMapping,
      _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
      _Inout_ PULONG PrivilegeSetLength,
      _Out_ PACCESS_MASK GrantedAccess,
      _Out_ PNTSTATUS AccessStatus
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheckByTypeResultList(
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_opt_ PSID PrincipalSelfSid,
      _In_ HANDLE ClientToken,
      _In_ ACCESS_MASK DesiredAccess,
      _In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
      _In_ ULONG ObjectTypeListLength,
      _In_ PGENERIC_MAPPING GenericMapping,
      _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
      _Inout_ PULONG PrivilegeSetLength,
      _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
      _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus
      );
  
  // Signing
  
  #if (PHNT_VERSION >= PHNT_THRESHOLD)
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtSetCachedSigningLevel(
      _In_ ULONG Flags,
      _In_ SE_SIGNING_LEVEL InputSigningLevel,
      _In_reads_(SourceFileCount) PHANDLE SourceFiles,
      _In_ ULONG SourceFileCount,
      _In_opt_ HANDLE TargetFile
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtGetCachedSigningLevel(
      _In_ HANDLE File,
      _Out_ PULONG Flags,
      _Out_ PSE_SIGNING_LEVEL SigningLevel,
      _Out_writes_bytes_to_opt_(*ThumbprintSize, *ThumbprintSize) PUCHAR Thumbprint,
      _Inout_opt_ PULONG ThumbprintSize,
      _Out_opt_ PULONG ThumbprintAlgorithm
      );
  
  // rev
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCompareSigningLevels(
      _In_ SE_SIGNING_LEVEL FirstSigningLevel,
      _In_ SE_SIGNING_LEVEL SecondSigningLevel
      );
  
  #endif
  
  // Audit alarm
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheckAndAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ PUNICODE_STRING ObjectTypeName,
      _In_ PUNICODE_STRING ObjectName,
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ PGENERIC_MAPPING GenericMapping,
      _In_ BOOLEAN ObjectCreation,
      _Out_ PACCESS_MASK GrantedAccess,
      _Out_ PNTSTATUS AccessStatus,
      _Out_ PBOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheckByTypeAndAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ PUNICODE_STRING ObjectTypeName,
      _In_ PUNICODE_STRING ObjectName,
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_opt_ PSID PrincipalSelfSid,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ AUDIT_EVENT_TYPE AuditType,
      _In_ ULONG Flags,
      _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
      _In_ ULONG ObjectTypeListLength,
      _In_ PGENERIC_MAPPING GenericMapping,
      _In_ BOOLEAN ObjectCreation,
      _Out_ PACCESS_MASK GrantedAccess,
      _Out_ PNTSTATUS AccessStatus,
      _Out_ PBOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheckByTypeResultListAndAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ PUNICODE_STRING ObjectTypeName,
      _In_ PUNICODE_STRING ObjectName,
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_opt_ PSID PrincipalSelfSid,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ AUDIT_EVENT_TYPE AuditType,
      _In_ ULONG Flags,
      _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
      _In_ ULONG ObjectTypeListLength,
      _In_ PGENERIC_MAPPING GenericMapping,
      _In_ BOOLEAN ObjectCreation,
      _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
      _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
      _Out_ PBOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ HANDLE ClientToken,
      _In_ PUNICODE_STRING ObjectTypeName,
      _In_ PUNICODE_STRING ObjectName,
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_opt_ PSID PrincipalSelfSid,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ AUDIT_EVENT_TYPE AuditType,
      _In_ ULONG Flags,
      _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
      _In_ ULONG ObjectTypeListLength,
      _In_ PGENERIC_MAPPING GenericMapping,
      _In_ BOOLEAN ObjectCreation,
      _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
      _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
      _Out_ PBOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtOpenObjectAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ PUNICODE_STRING ObjectTypeName,
      _In_ PUNICODE_STRING ObjectName,
      _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_ HANDLE ClientToken,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ ACCESS_MASK GrantedAccess,
      _In_opt_ PPRIVILEGE_SET Privileges,
      _In_ BOOLEAN ObjectCreation,
      _In_ BOOLEAN AccessGranted,
      _Out_ PBOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtPrivilegeObjectAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ HANDLE ClientToken,
      _In_ ACCESS_MASK DesiredAccess,
      _In_ PPRIVILEGE_SET Privileges,
      _In_ BOOLEAN AccessGranted
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtCloseObjectAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ BOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtDeleteObjectAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_opt_ PVOID HandleId,
      _In_ BOOLEAN GenerateOnClose
      );
  
  NTSYSCALLAPI
  NTSTATUS
  NTAPI
  NtPrivilegedServiceAuditAlarm(
      _In_ PUNICODE_STRING SubsystemName,
      _In_ PUNICODE_STRING ServiceName,
      _In_ HANDLE ClientToken,
      _In_ PPRIVILEGE_SET Privileges,
      _In_ BOOLEAN AccessGranted
      );
  
  #endif
  