Vanara/PInvoke/NTDll/CorrelationReport.md

74 KiB

Vanara.PInvoke.NTDll

PInvoke API (methods, structures and constants) imported from Windows NtDll.dll.

  • Includes methods from ntdll.dll
  • Current NuGet release: NugetNuget

Methods - 4% API coverage (24 of 566 functions)

Native Method Header Managed Method
_vscprintf
ApiSetQueryApiSetPresenceEx
DbgBreakPoint wdm.h Vanara.PInvoke.NtDll.DbgBreakPoint
DbgPrint
DbgPrintEx
DbgPrompt ntddk.h Vanara.PInvoke.NtDll.DbgPrompt
EtwCheckCoverage
LdrCallEnclave
LdrControlFlowGuardEnforced
LdrCreateEnclave
LdrDeleteEnclave
LdrFastFailInLoaderCallout ntldr.h Vanara.PInvoke.NtDll.LdrFastFailInLoaderCallout
LdrInitializeEnclave
LdrIsModuleSxsRedirected
LdrLoadEnclaveModule
LdrRegisterDllNotification Vanara.PInvoke.NtDll.LdrRegisterDllNotification
LdrUnregisterDllNotification ntldr.h Vanara.PInvoke.NtDll.LdrUnregisterDllNotification
NtAcquireCrossVmMutant
NtAllocateUserPhysicalPagesEx
NtAllocateVirtualMemory ntifs.h Vanara.PInvoke.NtDll.NtAllocateVirtualMemory
NtAllocateVirtualMemoryEx
NtCallEnclave
NtClose winternl.h Vanara.PInvoke.NtDll.NtClose
NtCommitComplete wdm.h Vanara.PInvoke.NtDll.NtCommitComplete
NtCommitEnlistment wdm.h Vanara.PInvoke.NtDll.NtCommitEnlistment
NtCommitTransaction wdm.h Vanara.PInvoke.NtDll.NtCommitTransaction
NtCompareTokens Vanara.PInvoke.NtDll.NtCompareTokens
NtContinueEx
NtCreateCrossVmEvent
NtCreateCrossVmMutant
NtCreateEnlistment wdm.h Vanara.PInvoke.NtDll.NtCreateEnlistment
NtCreateFile
NtCreateFileA ntifs.h Vanara.PInvoke.NtDll.NtCreateFile
NtCreateFileW ntifs.h Vanara.PInvoke.NtDll.NtCreateFile
NtCreateResourceManager wdm.h Vanara.PInvoke.NtDll.NtCreateResourceManager
NtCreateSection
NtCreateSectionA ntifs.h Vanara.PInvoke.NtDll.NtCreateSection
NtCreateSectionEx
NtCreateSectionW ntifs.h Vanara.PInvoke.NtDll.NtCreateSection
NtCreateTransaction
NtCreateTransactionA wdm.h Vanara.PInvoke.NtDll.NtCreateTransaction
NtCreateTransactionManager
NtCreateTransactionManagerA wdm.h Vanara.PInvoke.NtDll.NtCreateTransactionManager
NtCreateTransactionManagerW wdm.h Vanara.PInvoke.NtDll.NtCreateTransactionManager
NtCreateTransactionW wdm.h Vanara.PInvoke.NtDll.NtCreateTransaction
NtDeviceIoControlFile
NtDirectGraphicsCall
NtDuplicateToken
NtEnumerateTransactionObject
NtFlushBuffersFileEx
NtFreeVirtualMemory
NtFsControlFile
NtGetCurrentProcessorNumber
NtGetNotificationResourceManager
NtLoadKey3
NtLockFile
NtManageHotPatch
NtMapViewOfSectionEx
NtNotifyChangeDirectoryFileEx
NtNotifyChangeMultipleKeys
NtOpenDirectoryObject
NtOpenEnlistment
NtOpenFile
NtOpenProcess
NtOpenProcessTokenEx
NtOpenResourceManager
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadTokenEx
NtOpenTransaction
NtOpenTransactionManager
NtPowerInformation
NtPrepareComplete
NtPrepareEnlistment
NtPrePrepareComplete
NtPrePrepareEnlistment
NtProtectVirtualMemory
NtPssCaptureVaSpaceBulk
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryDirectoryFileEx
NtQueryInformationEnlistment
NtQueryInformationFile
NtQueryInformationProcess winternl.h Vanara.PInvoke.NtDll.NtQueryInformationProcess
NtQueryInformationResourceManager
NtQueryInformationThread
NtQueryInformationToken
NtQueryInformationTransaction
NtQueryInformationTransactionManager
NtQueryKey wdm.h Vanara.PInvoke.NtDll.NtQueryKey
NtQueryMultipleValueKey
NtQueryObject
NtQueryPerformanceCounter
NtQueryQuotaInformationFile
NtQuerySecurityObject
NtQuerySymbolicLinkObject
NtQuerySystemInformation winternl.h Vanara.PInvoke.NtDll.NtQuerySystemInformation
NtQuerySystemTime
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtReadFile
NtReadOnlyEnlistment
NtRecoverEnlistment
NtRecoverResourceManager
NtRecoverTransactionManager
NtRenameKey
NtRenameTransactionManager
NtRollbackComplete
NtRollbackEnlistment
NtRollbackTransaction
NtRollforwardTransactionManager
NtSetInformationEnlistment
NtSetInformationFile
NtSetInformationKey
NtSetInformationResourceManager
NtSetInformationThread
NtSetInformationToken
NtSetInformationTransaction
NtSetInformationTransactionManager
NtSetQuotaInformationFile
NtSetSecurityObject
NtSinglePhaseReject
NtTerminateEnclave
NtUnlockFile
NtUnmapViewOfSection
NtWaitForSingleObject
NtWriteFile
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAce
RtlAddFunctionTable
RtlAddGrowableFunctionTable
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlAppendStringToString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlAreBitsClear
RtlAreBitsClearEx
RtlAreBitsSet
RtlCallEnclaveReturn
RtlCapabilityCheckForSingleSessionSku
RtlCaptureContext
RtlCaptureContext2
RtlCaptureStackBackTrace
RtlCharToInteger
RtlCheckRegistryKey
RtlCheckSystemBootStatusIntegrity
RtlClearAllBitsEx
RtlClearBitEx
RtlClearBits
RtlClearBitsEx
RtlCmEncodeMemIoResource
RtlCompareMemory
RtlCompareMemoryUlong
RtlCompareString
RtlCompareUnicodeString
RtlCompressBuffer
RtlConstructCrossVmEventPath
RtlConstructCrossVmMutexPath
RtlConvertSidToUnicodeString
RtlCopyLuid
RtlCopyMemoryNonTemporal
RtlCopySid
RtlCopyString
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateHeap
RtlCreateProcessParametersWithTemplate
RtlCreateRegistryKey
RtlCreateSecurityDescriptor
RtlCreateSystemVolumeInformationFolder
RtlCreateUnicodeString
RtlCreateUserFiberShadowStack
RtlCustomCPToUnicodeN
RtlDecompressBuffer
RtlDecompressBufferEx
RtlDecompressFragment
RtlDelete
RtlDeleteAce
RtlDeleteElementGenericTable
RtlDeleteElementGenericTableAvl
RtlDeleteFunctionTable
RtlDeleteGrowableFunctionTable
RtlDeleteNoSplay
RtlDeleteRegistryValue
RtlDestroyHeap
RtlDisownModuleHeapAllocation
RtlDoesNameContainWildCards
RtlDosLongPathNameToNtPathName_U_WithStatus
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus
RtlDowncaseUnicodeString
RtlDrainNonVolatileFlush
RtlEnclaveCallDispatch
RtlEnclaveCallDispatchReturn
RtlEnumerateGenericTable
RtlEnumerateGenericTableAvl
RtlEnumerateGenericTableLikeADirectory
RtlEnumerateGenericTableWithoutSplaying
RtlEnumerateGenericTableWithoutSplayingAvl
RtlEqualPrefixSid
RtlEqualSid
RtlEqualUnicodeString
RtlEthernetAddressToString
RtlEthernetStringToAddress
RtlExtendCorrelationVector
RtlFillMemoryNonTemporal
RtlFillNonVolatileMemory
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindClearBitsEx
RtlFindClearRuns
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFindSetBitsAndClearEx
RtlFindSetBitsEx
RtlFirstEntrySList
RtlFlsGetValue
RtlFlsSetValue
RtlFlushNonVolatileMemory
RtlFlushNonVolatileMemoryRanges
RtlFreeAnsiString
RtlFreeHeap
RtlFreeNonVolatileToken
RtlFreeOemString
RtlFreeUnicodeString
RtlFreeUserFiberShadowStack
RtlFreeUTF8String
RtlGenerate8dot3Name
RtlGetAce
RtlGetCompressionWorkSpaceSize
RtlGetDaclSecurityDescriptor
RtlGetElementGenericTable
RtlGetElementGenericTableAvl
RtlGetEnabledExtendedFeatures
RtlGetExtendedContextLength2
RtlGetFunctionTableListHead
RtlGetGroupSecurityDescriptor
RtlGetMultiTimePrecise
RtlGetNonVolatileToken
RtlGetOwnerSecurityDescriptor
RtlGetPersistedStateLocation
RtlGetReturnAddressHijackTarget
RtlGetSaclSecurityDescriptor
RtlGetSystemBootStatus
RtlGetSystemBootStatusEx
RtlGetUnloadEventTrace
RtlGetUnloadEventTraceEx
RtlGetVersion
RtlGrowFunctionTable
RtlGUIDFromString
RtlHashUnicodeString
RtlIncrementCorrelationVector
RtlInitAnsiString
RtlInitCodePageTable
RtlInitializeBitMap
RtlInitializeBitMapEx
RtlInitializeCorrelationVector
RtlInitializeExtendedContext2
RtlInitializeGenericTable
RtlInitializeGenericTableAvl
RtlInitializeSid
RtlInitializeSidEx
RtlInitializeSListHead
RtlInitString
RtlInitStringEx
RtlInitUnicodeString
RtlInitUTF8String
RtlInitUTF8StringEx
RtlInsertElementGenericTable
RtlInsertElementGenericTableAvl
RtlInsertElementGenericTableFullAvl
RtlInstallFunctionTableCallback
RtlInt64ToUnicodeString
RtlIntegerToUnicodeString
RtlInterlockedFlushSList
RtlInterlockedPushEntrySList
RtlIoDecodeMemIoResource
RtlIoEncodeMemIoResource
RtlIpv4AddressToStringA
RtlIpv4AddressToStringExW
RtlIpv4StringToAddress
RtlIpv4StringToAddressEx
RtlIpv6AddressToString
RtlIpv6AddressToStringExW
RtlIpv6StringToAddress
RtlIpv6StringToAddressExW
RtlIsCloudFilesPlaceholder
RtlIsCurrentProcess
RtlIsCurrentThread
RtlIsGenericTableEmpty
RtlIsGenericTableEmptyAvl
RtlIsNameInExpression
RtlIsNameInUnUpcasedExpression
RtlIsNameLegalDOS8Dot3
RtlIsPartialPlaceholder
RtlIsPartialPlaceholderFileHandle
RtlIsPartialPlaceholderFileInfo
RtlIsStateSeparationEnabled
RtlIsValidLocaleName
RtlIsZeroMemory
RtlLengthSecurityDescriptor
RtlLengthSid
RtlLocalTimeToSystemTime
RtlLookupElementGenericTable
RtlLookupElementGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlLookupFunctionEntry
RtlMapGenericMask
RtlMoveMemory
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlNormalizeSecurityDescriptor
RtlNotifyFeatureUsage
RtlNtStatusToDosError
RtlNumberGenericTableElements
RtlNumberGenericTableElementsAvl
RtlNumberOfClearBits
RtlNumberOfClearBitsEx
RtlNumberOfSetBits
RtlNumberOfSetBitsEx
RtlNumberOfSetBitsUlongPtr
RtlOemStringToUnicodeString
RtlOemToUnicodeN
RtlPcToFileHeader
RtlPrefixUnicodeString
RtlpTimeFieldsToTime
RtlpTimeToTimeFields
RtlpWow64CtxFromAmd64
RtlpWow64GetContextOnAmd64
RtlpWow64SetContextOnAmd64
RtlQueryAllFeatureConfigurations
RtlQueryDepthSList
RtlQueryFeatureConfiguration
RtlQueryFeatureConfigurationChangeStamp
RtlQueryFeatureUsageNotificationSubscriptions
RtlQueryImageMitigationPolicy
RtlQueryProcessPlaceholderCompatibilityMode
RtlQueryRegistryValues
RtlQueryRegistryValueWithFallback
RtlQueryThreadPlaceholderCompatibilityMode
RtlQueryTokenHostIdAsUlong64
RtlRaiseCustomSystemEventTrigger
RtlRaiseException
RtlRaiseExceptionForReturnAddressHijack
RtlRaiseNoncontinuableException
RtlRandom
RtlRandomEx
RtlRealPredecessor
RtlRealSuccessor
RtlRegisterFeatureConfigurationChangeNotification
RtlRestoreContext
RtlRestoreSystemBootStatusDefaults
RtlRestoreThreadPreferredUILanguages
RtlRunOnceBeginInitialize
RtlRunOnceComplete
RtlRunOnceExecuteOnce
RtlRunOnceInitialize
RtlSecondsSince1970ToTime
RtlSecondsSince1980ToTime
RtlSelfRelativeToAbsoluteSD
RtlSetAllBits
RtlSetAllBitsEx
RtlSetBitEx
RtlSetBits
RtlSetBitsEx
RtlSetDaclSecurityDescriptor
RtlSetFeatureConfigurations
RtlSetGroupSecurityDescriptor
RtlSetImageMitigationPolicy
RtlSetOwnerSecurityDescriptor
RtlSetProcessPlaceholderCompatibilityMode
RtlSetProxiedProcessId
RtlSetSystemBootStatus
RtlSetSystemBootStatusEx
RtlSetThreadPlaceholderCompatibilityMode
RtlSetThreadPreferredUILanguages2
RtlSplay
RtlStringFromGUID
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlSubscribeForFeatureUsageNotification
RtlSubtreePredecessor
RtlSubtreeSuccessor
RtlTestBitEx
RtlTimeFieldsToTime
RtlTimeToSecondsSince1970
RtlTimeToSecondsSince1980
RtlTimeToTimeFields
RtlUdiv128
RtlUnicodeStringToAnsiString
RtlUnicodeStringToCountedOemString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemString
RtlUnicodeStringToUTF8String
RtlUnicodeToCustomCPN
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnicodeToUTF8N
RtlUniform
RtlUnregisterFeatureConfigurationChangeNotification
RtlUnsubscribeFromFeatureUsageNotifications
RtlUnwind
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
RtlUpcaseUnicodeStringToCountedOemString
RtlUpcaseUnicodeStringToOemString
RtlUpcaseUnicodeToCustomCPN
RtlUpcaseUnicodeToMultiByteN
RtlUpcaseUnicodeToOemN
RtlUpperChar
RtlUpperString
RtlUserFiberStart
RtlUTF8StringToUnicodeString
RtlUTF8ToUnicodeN
RtlValidateCorrelationVector
RtlValidRelativeSecurityDescriptor
RtlVerifyVersionInfo
RtlVirtualUnwind
RtlWow64GetEquivalentMachineCHPE
RtlWow64GetSharedInfoProcess
RtlWow64PopAllCrossProcessWorkFromWorkList
RtlWow64PopCrossProcessWorkFromFreeList
RtlWow64PushCrossProcessWorkOntoFreeList
RtlWow64PushCrossProcessWorkOntoWorkList
RtlWow64RequestCrossProcessHeavyFlush
RtlWow64SuspendProcess
RtlWriteNonVolatileMemory
RtlWriteRegistryValue
TpSetPoolThreadCpuSets
vDbgPrintEx
vDbgPrintExWithPrefix
VerSetConditionMask
ZwAcquireCrossVmMutant
ZwAllocateLocallyUniqueId
ZwAllocateUserPhysicalPagesEx
ZwAllocateVirtualMemory
ZwAllocateVirtualMemoryEx
ZwCallEnclave
ZwClose
ZwCommitComplete
ZwCommitEnlistment
ZwCommitTransaction
ZwContinueEx
ZwCreateCrossVmEvent
ZwCreateCrossVmMutant
ZwCreateDirectoryObject
ZwCreateEnlistment
ZwCreateEvent
ZwCreateFile
ZwCreateKey
ZwCreateKeyTransacted
ZwCreateResourceManager
ZwCreateSection
ZwCreateSectionEx
ZwCreateTransaction
ZwCreateTransactionManager
ZwDeleteFile
ZwDeleteKey
ZwDeleteValueKey
ZwDeviceIoControlFile
ZwDirectGraphicsCall
ZwDuplicateObject
ZwDuplicateToken
ZwEnumerateKey
ZwEnumerateTransactionObject
ZwEnumerateValueKey
ZwFlushBuffersFileEx
ZwFlushKey
ZwFlushVirtualMemory
ZwFreeVirtualMemory
ZwFsControlFile
ZwGetNotificationResourceManager
ZwLoadDriver
ZwLoadKey3
ZwLockFile
ZwMakeTemporaryObject
ZwManageHotPatch
ZwMapViewOfSection
ZwMapViewOfSectionEx
ZwNotifyChangeDirectoryFileEx
ZwNotifyChangeKey
ZwOpenDirectoryObject
ZwOpenEnlistment
ZwOpenEvent
ZwOpenFile
ZwOpenKey
ZwOpenKeyEx
ZwOpenKeyTransacted
ZwOpenKeyTransactedEx
ZwOpenProcess
ZwOpenProcessTokenEx
ZwOpenResourceManager
ZwOpenSection
ZwOpenSymbolicLinkObject
ZwOpenThreadTokenEx
ZwOpenTransaction
ZwOpenTransactionManager
ZwPowerInformation
ZwPrepareComplete
ZwPrepareEnlistment
ZwPrePrepareComplete
ZwPrePrepareEnlistment
ZwPssCaptureVaSpaceBulk
ZwQueryDirectoryFile
ZwQueryDirectoryFileEx
ZwQueryEaFile
ZwQueryFullAttributesFile
ZwQueryInformationEnlistment
ZwQueryInformationFile
ZwQueryInformationProcess
ZwQueryInformationResourceManager
ZwQueryInformationToken
ZwQueryInformationTransaction
ZwQueryInformationTransactionManager
ZwQueryKey
ZwQueryObject
ZwQueryQuotaInformationFile
ZwQuerySecurityObject
ZwQuerySymbolicLinkObject
ZwQuerySystemInformation
ZwQuerySystemInformationEx
ZwQueryValueKey
ZwQueryVirtualMemory
ZwQueryVolumeInformationFile
ZwReadFile
ZwReadOnlyEnlistment
ZwRecoverEnlistment
ZwRecoverResourceManager
ZwRecoverTransactionManager
ZwRollbackComplete
ZwRollbackEnlistment
ZwRollbackTransaction
ZwRollforwardTransactionManager
ZwSetEaFile
ZwSetEvent
ZwSetInformationEnlistment
ZwSetInformationFile
ZwSetInformationResourceManager
ZwSetInformationThread
ZwSetInformationToken
ZwSetInformationTransaction
ZwSetInformationVirtualMemory
ZwSetQuotaInformationFile
ZwSetSecurityObject
ZwSetValueKey
ZwSetVolumeInformationFile
ZwSinglePhaseReject
ZwSuspendProcess
ZwTerminateEnclave
ZwTerminateProcess
ZwUnloadDriver
ZwUnlockFile
ZwUnmapViewOfSection
ZwUnmapViewOfSectionEx
ZwWaitForSingleObject
ZwWriteFile

Structures

Native Structure Header Managed Structure
CLIENT_ID Vanara.PInvoke.NtDll.CLIENT_ID
IO_STATUS_BLOCK wdm.h Vanara.PInvoke.NtDll.IO_STATUS_BLOCK
KEY_BASIC_INFORMATION wdm.h Vanara.PInvoke.NtDll.KEY_BASIC_INFORMATION
KEY_FULL_INFORMATION wdm.h Vanara.PInvoke.NtDll.KEY_FULL_INFORMATION
KEY_NAME_INFORMATION ntddk.h Vanara.PInvoke.NtDll.KEY_NAME_INFORMATION
KEY_NODE_INFORMATION wdm.h Vanara.PInvoke.NtDll.KEY_NODE_INFORMATION
LDR_DLL_NOTIFICATION_DATA ntldr.h Vanara.PInvoke.NtDll.LDR_DLL_NOTIFICATION_DATA
OBJECT_ATTRIBUTES wudfwdm.h Vanara.PInvoke.NtDll.OBJECT_ATTRIBUTES
PEB winternl.h Vanara.PInvoke.NtDll.PEB
PROCESS_BASIC_INFORMATION Vanara.PInvoke.NtDll.PROCESS_BASIC_INFORMATION
RTL_USER_PROCESS_PARAMETERS winternl.h Vanara.PInvoke.NtDll.RTL_USER_PROCESS_PARAMETERS
SYSTEM_BASIC_INFORMATION winternl.h Vanara.PInvoke.NtDll.SYSTEM_BASIC_INFORMATION
SYSTEM_PROCESS_INFORMATION winternl.h Vanara.PInvoke.NtDll.SYSTEM_PROCESS_INFORMATION
SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION winternl.h Vanara.PInvoke.NtDll.SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
SYSTEM_REGISTRY_QUOTA_INFORMATION winternl.h Vanara.PInvoke.NtDll.SYSTEM_REGISTRY_QUOTA_INFORMATION
SYSTEM_THREAD_INFORMATION winternl.h Vanara.PInvoke.NtDll.SYSTEM_THREAD_INFORMATION
UNICODE_STRING wudfwdm.h Vanara.PInvoke.NtDll.UNICODE_STRING