;note that the Zw... functions are alternate names for the ;Nt... functions. (see www.sysinternals.com for details) ;if you change a Nt.. function DON'T FORGET to change the ;Zw one too. LIBRARY ntdll.dll EXPORTS CsrClientCallServer@16 DbgBreakPoint@0 DbgPrint DbgUiConnectToDbg@0 DbgUiContinue@8 DbgUiWaitStateChange@8 DbgUserBreakPoint@0 LdrDisableThreadCalloutsForDll@4 LdrGetProcedureAddress@16 LdrLoadDll@16 LdrProcessRelocationBlock@16 LdrShutdownProcess@0 LdrUnloadDll@4 NlsAnsiCodePage NlsMbCodePageTag NlsMbOemCodePageTag NtAcceptConnectPort@24 NtAccessCheck@32 NtAccessCheckAndAuditAlarm@44 NtAccessCheckByType@44 NtAccessCheckByTypeAndAuditAlarm@64 NtAccessCheckByTypeResultList@44 NtAccessCheckByTypeResultListAndAuditAlarm@64 NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68 NtAddAtom@12 NtAdjustGroupsToken@24 NtAdjustPrivilegesToken@24 NtAlertResumeThread@8 NtAlertThread@4 NtAllocateLocallyUniqueId@4 NtAllocateUserPhysicalPages@12 NtAllocateUuids@16 NtAllocateVirtualMemory@24 NtAreMappedFilesTheSame@8 NtAssignProcessToJobObject@8 NtCallbackReturn@12 NtCancelDeviceWakeupRequest@4 NtCancelIoFile@8 NtCancelTimer@8 NtClearEvent@4 NtClose@4 NtCloseObjectAuditAlarm@12 NtCompleteConnectPort@4 NtConnectPort@32 NtContinue@8 NtCreateDirectoryObject@12 NtCreateEvent@20 NtCreateEventPair@12 NtCreateFile@44 NtCreateIoCompletion@16 NtCreateJobObject@12 NtCreateKey@28 NtCreateMailslotFile@32 NtCreateMutant@16 NtCreateNamedPipeFile@56 NtCreatePagingFile@16 NtCreatePort@20 NtCreateProcess@32 NtCreateProfile@36 NtCreateSection@28 NtCreateSemaphore@20 NtCreateSymbolicLinkObject@16 NtCreateThread@32 NtCreateTimer@16 NtCreateToken@52 NtCreateWaitablePort@20 NtDelayExecution@8 NtDeleteAtom@4 NtDeleteFile@4 NtDeleteKey@4 NtDeleteObjectAuditAlarm@12 NtDeleteValueKey@8 NtDeviceIoControlFile@40 NtDisplayString@4 NtDuplicateObject@28 NtDuplicateToken@24 NtEnumerateKey@24 NtEnumerateValueKey@24 NtExtendSection@8 NtFilterToken@24 NtFindAtom@12 NtFlushBuffersFile@8 NtFlushInstructionCache@12 NtFlushKey@4 NtFlushVirtualMemory@16 NtFlushWriteBuffer@0 NtFreeUserPhysicalPages@12 NtFreeVirtualMemory@16 NtFsControlFile@40 NtGetContextThread@8 NtGetDevicePowerState@8 NtGetPlugPlayEvent@16 NtGetTickCount@0 NtGetWriteWatch@28 NtImpersonateAnonymousToken@8 NtImpersonateClientOfPort@8 NtImpersonateThread@12 NtInitializeRegistry@4 NtInitiatePowerAction@16 NtIsSystemResumeAutomatic@0 NtListenPort@8 NtLoadDriver@4 NtLoadKey@8 NtLoadKey2@12 NtLockFile@40 NtLockVirtualMemory@16 NtMakeTemporaryObject@4 NtMapUserPhysicalPages@12 NtMapUserPhysicalPagesScatter@12 NtMapViewOfSection@40 NtNotifyChangeDirectoryFile@36 NtNotifyChangeKey@40 NtNotifyChangeMultipleKeys@48 NtOpenDirectoryObject@12 NtOpenEvent@12 NtOpenEventPair@12 NtOpenFile@24 NtOpenIoCompletion@12 NtOpenJobObject@12 NtOpenKey@12 NtOpenMutant@12 NtOpenObjectAuditAlarm@48 NtOpenProcess@16 NtOpenProcessToken@12 NtOpenSection@12 NtOpenSemaphore@12 NtOpenSymbolicLinkObject@12 NtOpenThread@16 NtOpenThreadToken@16 NtOpenTimer@12 NtPowerInformation@20 NtPrivilegeCheck@12 NtPrivilegedServiceAuditAlarm@20 NtPrivilegeObjectAuditAlarm@24 NtProtectVirtualMemory@20 NtPulseEvent@8 NtQueryAttributesFile@8 NtQueryDefaultLocale@8 NtQueryDefaultUILanguage@4 NtQueryDirectoryFile@44 NtQueryDirectoryObject@28 NtQueryEaFile@36 NtQueryEvent@20 NtQueryFullAttributesFile@8 NtQueryInformationAtom@20 NtQueryInformationFile@20 NtQueryInformationJobObject@20 NtQueryInformationPort@20 NtQueryInformationProcess@20 NtQueryInformationThread@20 NtQueryInformationToken@20 NtQueryIntervalProfile@8 NtQueryIoCompletion@20 NtQueryKey@20 NtQueryMultipleValueKey@24 NtQueryMutant@20 NtQueryObject@20 NtQueryOpenSubKeys@8 NtQueryPerformanceCounter@8 NtQueryQuotaInformationFile@36 NtQuerySection@20 NtQuerySecurityObject@20 NtQuerySemaphore@20 NtQuerySymbolicLinkObject@12 NtQuerySystemEnvironmentValue@16 NtQuerySystemInformation@16 NtQuerySystemTime@4 NtQueryTimer@20 NtQueryTimerResolution@12 NtQueryValueKey@24 NtQueryVirtualMemory@24 NtQueryVolumeInformationFile@20 NtQueueApcThread@20 NtRaiseException@12 NtRaiseHardError@24 NtReadFile@36 NtReadFileScatter@36 NtReadRequestData@24 NtReadVirtualMemory@20 NtRegisterThreadTerminatePort@4 NtReleaseMutant@8 NtReleaseSemaphore@12 NtRemoveIoCompletion@20 NtReplaceKey@12 NtReplyPort@8 NtReplyWaitReceivePort@16 NtReplyWaitReceivePortEx@20 NtReplyWaitReplyPort@8 NtRequestDeviceWakeup@4 NtRequestPort@8 NtRequestWaitReplyPort@12 NtRequestWakeupLatency@4 NtResetEvent@8 NtResetWriteWatch@12 NtRestoreKey@12 NtResumeThread@8 NtSaveKey@8 NtSaveMergedKeys@12 NtSecureConnectPort@36 NtSetContextThread@8 NtSetDefaultHardErrorPort@4 NtSetDefaultLocale@8 NtSetDefaultUILanguage@4 NtSetEaFile@16 NtSetEvent@8 NtSetHighEventPair@4 NtSetHighWaitLowEventPair@4 NtSetInformationFile@20 NtSetInformationJobObject@16 NtSetInformationKey@16 NtSetInformationObject@16 NtSetInformationProcess@16 NtSetInformationThread@16 NtSetInformationToken@16 NtSetIntervalProfile@8 NtSetIoCompletion@20 NtSetLdtEntries@16 NtSetLowEventPair@4 NtSetLowWaitHighEventPair@4 NtSetQuotaInformationFile@16 NtSetSecurityObject@12 NtSetSystemEnvironmentValue@8 NtSetSystemInformation@12 NtSetSystemPowerState@12 NtSetSystemTime@8 NtSetThreadExecutionState@8 NtSetTimer@28 NtSetTimerResolution@12 NtSetUuidSeed@4 NtSetValueKey@24 NtSetVolumeInformationFile@20 NtShutdownSystem@4 NtSignalAndWaitForSingleObject@16 NtStartProfile@4 NtStopProfile@4 NtSuspendThread@8 NtSystemDebugControl@24 NtTerminateJobObject@8 NtTerminateProcess@8 NtTerminateThread@8 NtTestAlert@0 NtUnloadDriver@4 NtUnloadKey@4 NtUnlockFile@20 NtUnlockVirtualMemory@16 NtUnmapViewOfSection@8 NtVdmControl@8 NtWaitForMultipleObjects@20 NtWaitForSingleObject@12 NtWaitHighEventPair@4 NtWaitLowEventPair@4 NtWriteFile@36 NtWriteFileGather@36 NtWriteRequestData@24 NtWriteVirtualMemory@20 NtYieldExecution@0 RtlAcquirePebLock@0 RtlAcquireResourceExclusive@8 RtlAcquireResourceShared@8 RtlAddAccessAllowedAce@16 RtlAllocateAndInitializeSid@44 RtlAllocateHandle@8 RtlAllocateHeap@12 RtlAnsiCharToUnicodeChar@4 RtlAnsiStringToUnicodeSize@4 RtlAnsiStringToUnicodeString@12 RtlAppendAsciizToString@8 RtlAppendStringToString@8 RtlAppendUnicodeStringToString@8 RtlAppendUnicodeToString@8 RtlAreBitsClear@12 RtlAreBitsSet@12 RtlCharToInteger@12 RtlClearAllBits@4 RtlClearBits@12 RtlCompareMemory@12 RtlCompareMemoryUlong@12 RtlCompareString@12 RtlCompareUnicodeString@12 RtlConvertSidToUnicodeString@12 RtlCopySid@12 RtlCopyString@8 RtlCopyUnicodeString@8 RtlCreateAcl@12 RtlCreateEnvironment@8 RtlCreateHeap@24 RtlCreateProcessParameters@40 RtlCreateSecurityDescriptor@8 RtlCreateUnicodeString@8 RtlCreateUnicodeStringFromAsciiz@8 RtlDeleteResource@4 RtlDeleteTimer@12 RtlDeleteTimerQueue@4 RtlDeleteTimerQueueEx@8 RtlDeNormalizeProcessParams@4 RtlDestroyEnvironment@4 RtlDestroyHandleTable@4 RtlDestroyHeap@4 RtlDestroyProcessParameters@4 RtlDetermineDosPathNameType_U@4 RtlDoesFileExists_U@4 RtlDosPathNameToNtPathName_U@16 RtlDosSearchPath_U@24 RtlDowncaseUnicodeString@12 RtlEnumProcessHeaps@8 RtlEqualComputerName@8 RtlEqualDomainName@8 RtlEqualPrefixSid@8 RtlEqualSid@8 RtlEqualString@12 RtlEqualUnicodeString@12 RtlEraseUnicodeString@4 RtlExpandEnvironmentStrings_U@16 RtlFillMemory@12 RtlFillMemoryUlong@12 RtlFindClearBits@12 RtlFindClearBitsAndSet@12 RtlFindLongestRunClear@8 RtlFindLongestRunSet@8 RtlFindSetBits@12 RtlFindSetBitsAndClear@12 RtlFreeAnsiString@4 RtlFreeHandle@8 RtlFreeHeap@12 RtlFreeOemString@4 RtlFreeSid@4 RtlFreeUnicodeString@4 RtlGetAce@12 RtlGetControlSecurityDescriptor@12 RtlGetCurrentDirectory_U@8 RtlGetDaclSecurityDescriptor@16 RtlGetFullPathName_U@16 RtlGetGroupSecurityDescriptor@12 RtlGetLongestNtPathLength@0 RtlGetNtGlobalFlags@0 RtlGetOwnerSecurityDescriptor@12 RtlGetProcessHeaps@8 RtlGetSaclSecurityDescriptor@16 RtlGetVersion@4 RtlIdentifierAuthoritySid@4 RtlImageDirectoryEntryToData@16 RtlImageNtHeader@4 RtlImageRvaToSection@12 RtlImageRvaToVa@16 RtlImpersonateSelf@4 RtlInitAnsiString@8 RtlInitCodePageTable@8 RtlInitNlsTables@16 RtlInitString@8 RtlInitUnicodeString@8 RtlInitializeBitMap@12 RtlInitializeCriticalSection@4 RtlInitializeCriticalSectionAndSpinCount@8 RtlInitializeHandleTable@12 RtlInitializeResource@4 RtlInitializeSid@12 RtlIntegerToChar@16 RtlIntegerToUnicodeString@12 RtlIsDosDeviceName_U@4 RtlIsNameLegalDOS8Dot3@12 RtlIsTextUnicode@12 RtlIsValidHandle@8 RtlIsValidIndexHandle@12 RtlLargeIntegerAdd@16 RtlLengthRequiredSid@4 RtlLengthSecurityDescriptor@4 RtlLengthSid@4 RtlLockHeap@4 RtlMakeSelfRelativeSD@12 RtlMoveMemory@12 RtlMultiByteToUnicodeN@20 RtlMultiByteToUnicodeSize@12 RtlNormalizeProcessParams@4 RtlNtStatusToDosError@4 RtlNumberOfClearBits@4 RtlNumberOfSetBits@4 RtlOemStringToUnicodeSize@4 RtlOemStringToUnicodeString@12 RtlOemToUnicodeN@12 RtlOpenCurrentUser@8 RtlPrefixString@12 RtlPrefixUnicodeString@12 RtlQueryAtomInAtomTable@24 RtlQueryEnvironmentVariable_U@12 RtlRaiseStatus@4 RtlReAllocateHeap@16 RtlReleasePebLock@0 RtlReleaseResource@4 RtlResetRtlTranslations@4 RtlSetAllBits@4 RtlSetBits@12 RtlSetCurrentDirectory_U@4 RtlSetCurrentEnvironment@8 RtlSetDaclSecurityDescriptor@16 RtlSetEnvironmentVariable@12 RtlSetGroupSecurityDescriptor@12 RtlSetIoCompletionCallback@12 RtlSetOwnerSecurityDescriptor@12 RtlSetSaclSecurityDescriptor@16 RtlSizeHeap@12 RtlSubAuthorityCountSid@4 RtlSubAuthoritySid@8 RtlTimeToSecondsSince1970@8 RtlTimeToTimeFields@8 RtlUnicodeStringToAnsiSize@4 RtlUnicodeStringToAnsiString@12 RtlUnicodeStringToCountedOemString@12 RtlUnicodeStringToOemSize@4 RtlUnicodeStringToOemString@12 RtlUnicodeToMultiByteN@20 RtlUnicodeToMultiByteSize@12 RtlUnicodeToOemN@20 RtlUnlockHeap@4 RtlUpcaseUnicodeChar@4 RtlUpcaseUnicodeString@12 RtlUpcaseUnicodeStringToAnsiString@12 RtlUpcaseUnicodeStringToCountedOemString@12 RtlUpcaseUnicodeStringToOemString@12 RtlUpcaseUnicodeToMultiByteN@20 RtlUpcaseUnicodeToOemN@20 RtlUpdateTimer@16 RtlUpperChar@4 RtlUpperString@12 RtlValidSid@4 RtlValidateHeap@12 RtlValidateProcessHeaps@0 RtlValidSecurityDescriptor@4 RtlZeroMemory@8 RtlpUnWaitCriticalSection@4 RtlxAnsiStringToUnicodeSize@4 RtlxOemStringToUnicodeSize@4 RtlxUnicodeStringToAnsiSize@4 RtlxUnicodeStringToOemSize@4 ZwAcceptConnectPort@24 ZwAccessCheck@32 ZwAccessCheckAndAuditAlarm@44 ZwAccessCheckByType@44 ZwAccessCheckByTypeAndAuditAlarm@64 ZwAccessCheckByTypeResultList@44 ZwAccessCheckByTypeResultListAndAuditAlarm@64 ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68 ZwAddAtom@12 ZwAdjustGroupsToken@24 ZwAdjustPrivilegesToken@24 ZwAlertResumeThread@8 ZwAlertThread@4 ZwAllocateLocallyUniqueId@4 ZwAllocateUserPhysicalPages@12 ZwAllocateUuids@16 ZwAllocateVirtualMemory@24 ZwAreMappedFilesTheSame@8 ZwAssignProcessToJobObject@8 ZwCallbackReturn@12 ZwCancelDeviceWakeupRequest@4 ZwCancelIoFile@8 ZwCancelTimer@8 ZwClearEvent@4 ZwClose@4 ZwCloseObjectAuditAlarm@12 ZwCompleteConnectPort@4 ZwConnectPort@32 ZwContinue@8 ZwCreateDirectoryObject@12 ZwCreateEvent@20 ZwCreateEventPair@12 ZwCreateFile@44 ZwCreateIoCompletion@16 ZwCreateJobObject@12 ZwCreateKey@28 ZwCreateMailslotFile@32 ZwCreateMutant@16 ZwCreateNamedPipeFile@56 ZwCreatePagingFile@16 ZwCreatePort@20 ZwCreateProcess@32 ZwCreateProfile@36 ZwCreateSection@28 ZwCreateSemaphore@20 ZwCreateSymbolicLinkObject@16 ZwCreateThread@32 ZwCreateTimer@16 ZwCreateToken@52 ZwCreateWaitablePort@20 ZwDelayExecution@8 ZwDeleteAtom@4 ZwDeleteFile@4 ZwDeleteKey@4 ZwDeleteObjectAuditAlarm@12 ZwDeleteValueKey@8 ZwDeviceIoControlFile@40 ZwDisplayString@4 ZwDuplicateObject@28 ZwDuplicateToken@24 ZwEnumerateKey@24 ZwEnumerateValueKey@24 ZwExtendSection@8 ZwFilterToken@24 ZwFindAtom@12 ZwFlushBuffersFile@8 ZwFlushInstructionCache@12 ZwFlushKey@4 ZwFlushVirtualMemory@16 ZwFlushWriteBuffer@0 ZwFreeUserPhysicalPages@12 ZwFreeVirtualMemory@16 ZwFsControlFile@40 ZwGetContextThread@8 ZwGetDevicePowerState@8 ZwGetPlugPlayEvent@16 ZwGetTickCount@0 ZwGetWriteWatch@28 ZwImpersonateAnonymousToken@8 ZwImpersonateClientOfPort@8 ZwImpersonateThread@12 ZwInitializeRegistry@4 ZwInitiatePowerAction@16 ZwIsSystemResumeAutomatic@0 ZwListenPort@8 ZwLoadDriver@4 ZwLoadKey@8 ZwLoadKey2@12 ZwLockFile@40 ZwLockVirtualMemory@16 ZwMakeTemporaryObject@4 ZwMapUserPhysicalPages@12 ZwMapUserPhysicalPagesScatter@12 ZwMapViewOfSection@40 ZwNotifyChangeDirectoryFile@36 ZwNotifyChangeKey@40 ZwNotifyChangeMultipleKeys@48 ZwOpenDirectoryObject@12 ZwOpenEvent@12 ZwOpenEventPair@12 ZwOpenFile@24 ZwOpenIoCompletion@12 ZwOpenJobObject@12 ZwOpenKey@12 ZwOpenMutant@12 ZwOpenObjectAuditAlarm@48 ZwOpenProcess@16 ZwOpenProcessToken@12 ZwOpenSection@12 ZwOpenSemaphore@12 ZwOpenSymbolicLinkObject@12 ZwOpenThread@16 ZwOpenThreadToken@16 ZwOpenTimer@12 ZwPowerInformation@20 ZwPrivilegeCheck@12 ZwPrivilegedServiceAuditAlarm@20 ZwPrivilegeObjectAuditAlarm@24 ZwProtectVirtualMemory@20 ZwPulseEvent@8 ZwQueryAttributesFile@8 ZwQueryDefaultLocale@8 ZwQueryDefaultUILanguage@4 ZwQueryDirectoryFile@44 ZwQueryDirectoryObject@28 ZwQueryEaFile@36 ZwQueryEvent@20 ZwQueryFullAttributesFile@8 ZwQueryInformationAtom@20 ZwQueryInformationFile@20 ZwQueryInformationJobObject@20 ZwQueryInformationPort@20 ZwQueryInformationProcess@20 ZwQueryInformationThread@20 ZwQueryInformationToken@20 ZwQueryIntervalProfile@8 ZwQueryIoCompletion@20 ZwQueryKey@20 ZwQueryMultipleValueKey@24 ZwQueryMutant@20 ZwQueryObject@20 ZwQueryOpenSubKeys@8 ZwQueryPerformanceCounter@8 ZwQueryQuotaInformationFile@36 ZwQuerySection@20 ZwQuerySecurityObject@20 ZwQuerySemaphore@20 ZwQuerySymbolicLinkObject@12 ZwQuerySystemEnvironmentValue@16 ZwQuerySystemInformation@16 ZwQuerySystemTime@4 ZwQueryTimer@20 ZwQueryTimerResolution@12 ZwQueryValueKey@24 ZwQueryVirtualMemory@24 ZwQueryVolumeInformationFile@20 ZwQueueApcThread@20 ZwRaiseException@12 ZwRaiseHardError@24 ZwReadFile@36 ZwReadFileScatter@36 ZwReadRequestData@24 ZwReadVirtualMemory@20 ZwRegisterThreadTerminatePort@4 ZwReleaseMutant@8 ZwReleaseSemaphore@12 ZwRemoveIoCompletion@20 ZwReplaceKey@12 ZwReplyPort@8 ZwReplyWaitReceivePort@16 ZwReplyWaitReceivePortEx@20 ZwReplyWaitReplyPort@8 ZwRequestDeviceWakeup@4 ZwRequestPort@8 ZwRequestWaitReplyPort@12 ZwRequestWakeupLatency@4 ZwResetEvent@8 ZwResetWriteWatch@12 ZwRestoreKey@12 ZwResumeThread@8 ZwSaveKey@8 ZwSaveMergedKeys@12 ZwSecureConnectPort@36 ZwSetContextThread@8 ZwSetDefaultHardErrorPort@4 ZwSetDefaultLocale@8 ZwSetDefaultUILanguage@4 ZwSetEaFile@16 ZwSetEvent@8 ZwSetHighEventPair@4 ZwSetHighWaitLowEventPair@4 ZwSetInformationFile@20 ZwSetInformationJobObject@16 ZwSetInformationKey@16 ZwSetInformationObject@16 ZwSetInformationProcess@16 ZwSetInformationThread@16 ZwSetInformationToken@16 ZwSetIntervalProfile@8 ZwSetIoCompletion@20 ZwSetLdtEntries@16 ZwSetLowEventPair@4 ZwSetLowWaitHighEventPair@4 ZwSetQuotaInformationFile@16 ZwSetSecurityObject@12 ZwSetSystemEnvironmentValue@8 ZwSetSystemInformation@12 ZwSetSystemPowerState@12 ZwSetSystemTime@8 ZwSetThreadExecutionState@8 ZwSetTimer@28 ZwSetTimerResolution@12 ZwSetUuidSeed@4 ZwSetValueKey@24 ZwSetVolumeInformationFile@20 ZwShutdownSystem@4 ZwSignalAndWaitForSingleObject@16 ZwStartProfile@4 ZwStopProfile@4 ZwSuspendThread@8 ZwSystemDebugControl@24 ZwTerminateJobObject@8 ZwTerminateProcess@8 ZwTerminateThread@8 ZwTestAlert@0 ZwUnloadDriver@4 ZwUnloadKey@4 ZwUnlockFile@20 ZwUnlockVirtualMemory@16 ZwUnmapViewOfSection@8 ZwVdmControl@8 ZwWaitForMultipleObjects@20 ZwWaitForSingleObject@12 ZwWaitHighEventPair@4 ZwWaitLowEventPair@4 ZwWriteFile@36 ZwWriteFileGather@36 ZwWriteRequestData@24 ZwWriteVirtualMemory@20 ZwYieldExecution@0 __isascii __iscsym __iscsymf __toascii _itoa _itow _ltoa _ltow _snprintf _snwprintf _strcmpi _stricmp _strlwr _strnicmp _strupr _tolower _toupper _ultoa _ultow _vsnprintf _wcsicmp _wcslwr _wcsnicmp _wcsupr _wtoi _wtol abs atan atoi atol ceil cos fabs floor isalnum isalpha iscntrl isdigit isgraph islower isprint ispunct isspace isupper iswalpha iswctype isxdigit labs log mbstowcs memchr memcmp memcpy memmove memset pow sin sprintf sqrt strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul swprintf tan tolower toupper towlower towupper vsprintf wcscat wcschr wcscmp wcscpy wcscspn wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstol wcstombs wcstoul