W32pServiceTable from windows 10 build 14931

September 22, 2016, 7:24 am

≫ Next: W32pServiceTable from windows 10 build 14931 x64

≪ Previous: bugs in mbedtls DH client/server

W32pServiceLimit .eq. 0x48A

NtUserGetOwnerTransformedMonitorRect
NtUserYieldTask
NtUserSetSensorPresence
NtGdiWidenPath
NtGdiUpdateColors
NtGdiUnrealizeObject
NtGdiUnmapMemFont
NtGdiUnloadPrinterDriver
NtGdiTransparentBlt
NtGdiTransformPoints
NtGdiSwapBuffers
NtGdiStrokePath
NtGdiStrokeAndFillPath
NtGdiStretchDIBitsInternal
NtGdiStretchBlt
NtGdiStartPage
NtGdiStartDoc
NtGdiSetSizeDevice
NtGdiSetVirtualResolution
NtGdiSetTextJustification
NtGdiSetSystemPaletteUse
NtGdiSetRectRgn
NtGdiSetPixelFormat
NtGdiSetPixel
NtGdiSetOPMSigningKeyAndSequenceNumbers
NtGdiSetLayout
NtGdiMirrorWindowOrg
NtGdiGetDeviceWidth
NtGdiSetMiterLimit
NtGdiSetMetaRgn
NtGdiSetMagicColors
NtGdiSetLinkedUFIs
NtGdiSetIcmMode
NtGdiSetFontXform
NtGdiSetFontEnumeration
NtGdiSetDIBitsToDeviceInternal
NtGdiSetDeviceGammaRamp
NtGdiSetColorSpace
NtGdiSetColorAdjustment
NtGdiSetBrushOrg
NtGdiSetBrushAttributes
NtGdiSetBoundsRect
NtGdiSetBitmapDimension
NtGdiSetBitmapBits
NtGdiSetBitmapAttributes
NtGdiSelectPen
NtGdiSelectFont
NtGdiSelectClipPath
NtGdiSelectBrush
NtGdiSelectBitmap
NtGdiScaleWindowExtEx
NtGdiScaleViewportExtEx
NtGdiSaveDC
NtGdiRoundRect
NtGdiRestoreDC
NtGdiResizePalette
NtGdiResetDC
NtGdiRemoveFontMemResourceEx
NtGdiRemoveFontResourceW
NtGdiRectVisible
NtGdiRectInRegion
NtGdiRectangle
NtGdiQueryFontAssocInfo
NtGdiQueryFonts
NtGdiPtVisible
NtGdiPtInRegion
NtGdiPolyTextOutW
NtGdiPolyPolyDraw
NtGdiPolyDraw
NtGdiPlgBlt
NtGdiPathToRegion
NtGdiPolyPatBlt
NtGdiPatBlt
NtGdiOpenDCW
NtGdiOffsetRgn
NtGdiOffsetClipRgn
NtGdiMoveTo
NtGdiMonoBitmap
NtGdiModifyWorldTransform
NtGdiMaskBlt
NtGdiMakeInfoDC
NtGdiMakeFontDir
NtGdiLineTo
NtGdiInvertRgn
NtGdiIntersectClipRect
NtGdiInitSpool
NtGdiInit
NtGdiIcmBrushInfo
NtGdiHfontCreate
NtGdiGradientFill
NtGdiGetWidthTable
NtGdiGetFontUnicodeRanges
NtGdiAddEmbFontToDC
NtGdiChangeGhostFont
NtGdiGetEmbedFonts
NtGdiGetUFIPathname
NtGdiGetEmbUFI
NtGdiGetUFI
NtGdiGetTransform
NtGdiGetTextMetricsW
NtGdiGetTextFaceW
NtGdiGetTextExtentExW
NtGdiGetTextExtent
NtGdiGetTextCharsetInfo
NtGdiGetSystemPaletteUse
NtGdiGetSuggestedOPMProtectedOutputArraySize
NtGdiGetStringBitmapW
NtGdiGetStats
NtGdiGetSpoolMessage
NtGdiGetServerMetaFileBits
NtGdiGetRgnBox
NtGdiGetRegionData
NtGdiGetRealizationInfo
NtGdiGetRasterizerCaps
NtGdiGetRandomRgn
NtGdiGetPixel
NtGdiGetPath
NtGdiGetOutlineTextMetricsInternalW
NtGdiGetOPMRandomNumber
NtGdiGetObjectBitmapHandle
NtGdiGetNearestPaletteIndex
NtGdiGetNearestColor
NtGdiGetMonitorID
NtGdiGetMiterLimit
NtGdiGetLinkedUFIs
NtGdiGetKerningPairs
NtGdiGetOPMInformation
NtGdiGetGlyphOutline
NtGdiGetGlyphIndicesWInternal
NtGdiGetGlyphIndicesW
NtGdiGetFontResourceInfoInternalW
NtGdiGetFontFileInfo
NtGdiGetFontFileData
NtGdiGetFontData
NtGdiGetEudcTimeStampEx
NtGdiGetETM
NtGdiGetEntry
NtGdiGetDIBitsInternal
NtGdiGetDeviceCapsAll
NtGdiGetDeviceGammaRamp
NtGdiGetDeviceCaps
NtGdiGetDCPoint
NtGdiGetDCObject
NtGdiGetDCforBitmap
NtGdiGetDCDword
NtGdiGetCurrentDpiInfo
NtGdiGetCOPPCompatibleOPMInformation
NtGdiGetColorSpaceforBitmap
NtGdiGetColorAdjustment
NtGdiGetCharWidthInfo
NtGdiGetCharWidthW
NtGdiGetCharSet
NtGdiGetCharacterPlacementW
NtGdiGetCharABCWidthsW
NtGdiGetCertificateSize
NtGdiGetCertificate
NtGdiGetCertificateSizeByHandle
NtGdiGetCertificateByHandle
NtGdiGetBoundsRect
NtGdiGetBitmapDimension
NtGdiGetBitmapBits
NtGdiGetAppClipBox
NtGdiGetAndSetDCDword
NtGdiFullscreenControl
NtGdiFrameRgn
NtGdiForceUFIMapping
NtGdiFlush
NtGdiFlattenPath
NtGdiFillRgn
NtGdiFillPath
NtGdiExtTextOutW
NtGdiExtSelectClipRgn
NtGdiExtGetObjectW
NtGdiExtFloodFill
NtGdiExtEscape
NtGdiExtCreateRegion
NtGdiExtCreatePen
NtGdiExcludeClipRect
NtGdiEudcLoadUnloadLink
NtGdiEqualRgn
NtGdiEnumObjects
NtGdiEnumFonts
NtGdiEndPath
NtGdiEndPage
NtGdiEndGdiRendering
NtGdiEndDoc
NtGdiEnableEudc
NtGdiEllipse
NtGdiDrawEscape
NtGdiDoPalette
NtGdiDoBanding
NtGdiGetPerBandInfo
NtGdiDestroyOPMProtectedOutput
NtGdiDescribePixelFormat
NtGdiDeleteObjectApp
NtGdiDeleteColorTransform
NtGdiDeleteColorSpace
NtGdiDeleteClientObj
NtGdiDxgGenericThunk
NtGdiDvpReleaseNotification
NtGdiDvpAcquireNotification
NtGdiDvpWaitForVideoPortSync
NtGdiDvpUpdateVideoPort
NtGdiDvpGetVideoSignalStatus
NtGdiDvpGetVideoPortConnectInfo
NtGdiDvpGetVideoPortOutputFormats
NtGdiDvpGetVideoPortLine
NtGdiDvpGetVideoPortInputFormats
NtGdiDvpGetVideoPortFlipStatus
NtGdiDvpGetVideoPortField
NtGdiDvpGetVideoPortBandwidth
NtGdiDvpFlipVideoPort
NtGdiDvpDestroyVideoPort
NtGdiDvpCreateVideoPort
NtGdiDvpColorControl
NtGdiDvpCanCreateVideoPort
NtGdiDdWaitForVerticalBlank
NtGdiDdUpdateOverlay
NtGdiDdUnlockD3D
NtGdiDdUnlock
NtGdiDdUnattachSurface
NtGdiDdSetOverlayPosition
NtGdiDdCreateSurfaceEx
NtGdiDdSetGammaRamp
NtGdiDdSetExclusiveMode
NtGdiDdSetColorKey
NtGdiDdResetVisrgn
NtGdiDdRenderMoComp
NtGdiDdReleaseDC
NtGdiDdReenableDirectDrawObject
NtGdiDdQueryMoCompStatus
NtGdiDdQueryDirectDrawObject
NtGdiDdLockD3D
NtGdiDdLock
NtGdiDdGetScanLine
NtGdiDdGetMoCompFormats
NtGdiDdGetMoCompGuids
NtGdiDdGetMoCompBuffInfo
NtGdiDdGetInternalMoCompInfo
NtGdiDdGetFlipStatus
NtGdiDdGetDxHandle
NtGdiDdGetDriverInfo
NtGdiDdGetDC
NtGdiDdGetBltStatus
NtGdiDdGetAvailDriverMemory
NtGdiDdFlipToGDISurface
NtGdiDdFlip
NtGdiDdEndMoCompFrame
NtGdiDdDestroyD3DBuffer
NtGdiDdDestroySurface
NtGdiDdDestroyMoComp
NtGdiDdDeleteSurfaceObject
NtGdiDdDeleteDirectDrawObject
NtGdiDdCreateSurfaceObject
NtGdiDdCreateMoComp
NtGdiDdCreateD3DBuffer
NtGdiDdCreateSurface
NtGdiDdCreateDirectDrawObject
NtGdiDdColorControl
NtGdiDdCanCreateD3DBuffer
NtGdiDdCanCreateSurface
NtGdiDdBlt
NtGdiDdBeginMoCompFrame
NtGdiDdAttachSurface
NtGdiDdAlphaBlt
NtGdiDdAddAttachedSurface
NtGdiDdGetDriverState
NtGdiD3dDrawPrimitives2
NtGdiD3dValidateTextureStageState
NtGdiD3dContextDestroyAll
NtGdiD3dContextDestroy
NtGdiD3dContextCreate
NtGdiCreateSolidBrush
NtGdiCreateServerMetaFile
NtGdiCreateRoundRectRgn
NtGdiCreateRectRgn
NtGdiCreatePen
NtGdiCreatePatternBrushInternal
NtGdiCreatePaletteInternal
NtGdiCreateOPMProtectedOutputs
NtGdiCreateOPMProtectedOutput
NtGdiCreateMetafileDC
NtGdiCreateHatchBrushInternal
NtGdiCreateHalftonePalette
NtGdiCreateEllipticRgn
NtGdiCreateSessionMappedDIBSection
NtGdiCreateDIBSection
NtGdiCreateDIBitmapInternal
NtGdiCreateDIBBrush
NtGdiCreateCompatibleDC
NtGdiCreateCompatibleBitmap
NtGdiCreateColorTransform
NtGdiCreateColorSpace
NtGdiCreateClientObj
NtGdiCreateBitmapFromDxSurface2
NtGdiCreateBitmapFromDxSurface
NtGdiCreateBitmap
NtGdiConvertMetafileRect
NtGdiConfigureOPMProtectedOutput
NtGdiComputeXformCoefficients
NtGdiCombineTransform
NtGdiCombineRgn
NtGdiColorCorrectPalette
NtGdiClearBrushAttributes
NtGdiClearBitmapAttributes
NtGdiCloseFigure
NtGdiCheckBitmapBits
NtGdiCancelDC
NtGdiBitBlt
NtGdiBeginPath
NtGdiBeginGdiRendering
NtGdiArcInternal
NtGdiFontIsLinked
NtGdiAnyLinkedFonts
NtGdiAngleArc
NtGdiAlphaBlend
NtGdiAddRemoteMMInstanceToDC
NtGdiRemoveMergeFont
NtGdiAddFontMemResourceEx
NtGdiAddRemoteFontToDC
NtGdiAddFontResourceW
NtGdiAbortPath
NtGdiAbortDoc
NtUserDefSetText
NtUserDeferWindowPosAndBand
NtUserDdeInitialize
NtUserCanBrokerForceForeground
NtUserCreateWindowStation
NtUserCreateWindowEx
NtUserCreateLocalMemHandle
NtUserCreateInputContext
NtUserCreateDesktopEx
NtUserCreateCaret
NtUserCreateAcceleratorTable
NtUserCountClipboardFormats
NtUserCopyAcceleratorTable
NtUserConvertMemHandle
NtUserConsoleControl
NtUserCloseWindowStation
NtUserCloseDesktop
NtUserCloseClipboard
NtUserClipCursor
NtUserChildWindowFromPointEx
NtUserCheckMenuItem
NtUserCheckWindowThreadDesktop
NtUserDwmValidateWindow
NtUserCheckAccessForIntegrityLevel
NtUserDisplayConfigSetDeviceInfo
NtUserDisplayConfigGetDeviceInfo
NtUserQueryDisplayConfig
NtUserSetDisplayConfig
NtUserGetDisplayConfigBufferSizes
NtUserChangeDisplaySettings
NtUserChangeClipboardChain
NtUserCallTwoParam
NtUserCallOneParam
NtUserCallNoParam
NtUserCallNextHookEx
NtUserCallMsgFilter
NtUserCallHwndParamLock
NtUserCallHwndParam
NtUserCallHwndOpt
NtUserCallHwndLock
NtUserCallHwnd
NtUserBroadcastThemeChangeEvent
NtUserBuildPropList
NtUserBuildNameList
NtUserBuildHwndList
NtUserBuildHimcList
NtUserBlockInput
NtUserBitBltSysBmp
NtUserBeginPaint
NtUserAttachThreadInput
NtUserAssociateInputContext
NtUserAlterWindowStyle
NtUserAddClipboardFormatListener
NtUserActivateKeyboardLayout
NtUserDelegateCapturePointers
NtUserDelegateInput
NtUserDispatchMessage
NtUserDisableProcessWindowFiltering
NtUserDisableThreadIme
NtUserDestroyWindow
NtUserDestroyMenu
NtUserDestroyInputContext
NtUserDestroyCursor
NtUserDestroyAcceleratorTable
NtUserDeleteMenu
NtUserDoSoundDisconnect
NtUserDoSoundConnect
NtUserGhostWindowFromHungWindow
NtUserGetWOWClass
NtUserGetWindowPlacement
NtUserGetWindowDisplayAffinity
NtUserGetWindowDC
NtUserGetWindowCompositionAttribute
NtUserGetWindowCompositionInfo
NtUserGetWindowBand
NtUserGetUpdateRgn
NtUserGetUpdateRect
NtUserGetUpdatedClipboardFormats
NtUserGetTopLevelWindow
NtUserGetTitleBarInfo
NtUserGetThreadState
NtUserGetThreadDesktop
NtUserGetSystemMenu
NtUserGetScrollBarInfo
NtUserGetRegisteredRawInputDevices
NtUserGetRawInputDeviceList
NtUserGetRawInputDeviceInfo
NtUserGetRawInputData
NtUserGetRawInputBuffer
NtUserGetProcessDpiAwarenessContext
NtUserGetProcessWindowStation
NtUserGetPriorityClipboardFormat
NtUserGetOpenClipboardWindow
NtUserGetObjectInformation
NtUserGetMouseMovePointsEx
NtUserGetMessage
NtUserGetMenuItemRect
NtUserGetMenuIndex
NtUserGetMenuBarInfo
NtUserGetListBoxInfo
NtUserGetKeyState
NtUserGetKeyNameText
NtUserGetKeyboardState
NtUserGetKeyboardLayoutName
NtUserGetKeyboardLayoutList
NtUserGetInternalWindowPos
NtUserGetInputLocaleInfo
NtUserGetImeInfoEx
NtUserGetImeHotKey
NtUserGetIconSize
NtUserGetIconInfo
NtUserGetGUIThreadInfo
NtUserGetGuiResources
NtUserGetForegroundWindow
NtUserGetDoubleClickTime
NtUserGetDesktopID
NtUserGetDCEx
NtUserGetDC
NtUserGetCursorInfo
NtUserGetCursorFrameInfo
NtUserGetCurrentInputMessageSource
NtUserGetCIMSSM
NtUserGetCPD
NtUserGetControlColor
NtUserGetControlBrush
NtUserGetComboBoxInfo
NtUserGetClipCursor
NtUserGetClipboardViewer
NtUserGetClipboardSequenceNumber
NtUserGetClipboardOwner
NtUserGetClipboardFormatName
NtUserGetClipboardData
NtUserGetClassName
NtUserGetClassInfoEx
NtUserGetCaretPos
NtUserGetCaretBlinkTime
NtUserGetAtomName
NtUserGetAsyncKeyState
NtUserGetAppImeLevel
NtUserGetAncestor
NtUserGetAltTabInfo
NtUserFrostCrashedWindow
NtUserFlashWindowEx
NtUserFindWindowEx
NtUserFindExistingCursorIcon
NtUserFillWindow
NtUserExcludeUpdateRgn
NtUserEvent
NtUserEnumDisplaySettings
NtUserEnumDisplayMonitors
NtUserEnumDisplayDevices
NtUserEndPaint
NtUserEndMenu
NtUserEndDeferWindowPosEx
NtUserEnableScrollBar
NtUserEnableMenuItem
NtUserEmptyClipboard
NtUserDrawMenuBarTemp
NtUserDrawIconEx
NtUserDrawCaptionTemp
NtUserDrawCaption
NtUserDrawAnimatedRects
NtUserDragObject
NtUserDragDetect
NtUserHandleDelegatedInput
NtUserInheritWindowMonitor
NtUserRealChildWindowFromPoint
NtUserQueryWindow
NtUserQuerySendMessage
NtUserQueryInputContext
NtUserQueryInformationThread
NtUserQueryBSDRWindow
NtUserPerMonitorDPIPhysicalToLogicalPoint
NtUserProcessConnect
NtUserPrintWindow
NtUserPostThreadMessage
NtUserPostMessage
NtUserPhysicalToLogicalPoint
NtUserPeekMessage
NtUserPaintMonitor
NtUserPaintDesktop
NtUserOpenWindowStation
NtUserOpenThreadDesktop
NtUserOpenInputDesktop
NtUserOpenDesktop
NtUserOpenClipboard
NtUserNotifyWinEvent
NtUserNotifyProcessCreate
NtUserNotifyIMEStatus
NtUserMoveWindow
NtUserModifyUserStartupInfoFlags
NtUserMNDragOver
NtUserMNDragLeave
NtUserMinMaximize
NtUserMessageCall
NtUserMenuItemFromPoint
NtUserMapVirtualKeyEx
NtUserLayoutCompleted
NtUserLogicalToPerMonitorDPIPhysicalPoint
NtUserLogicalToPhysicalPoint
NtUserLockWorkStation
NtUserLockWindowUpdate
NtUserLockWindowStation
NtUserLoadKeyboardLayoutEx
NtUserKillTimer
NtUserIsTopLevelWindow
NtUserIsClipboardFormatAvailable
NtUserInvalidateRgn
NtUserInvalidateRect
NtUserInternalGetWindowIcon
NtUserInternalGetWindowText
NtUserInitTask
NtUserInitializeClientPfnArrays
NtUserInitialize
NtUserImpersonateDdeClientWindow
NtUserHungWindowFromGhostWindow
NtUserHiliteMenuItem
NtUserHideCaret
NtUserHardErrorControl
NtUserRealInternalGetMessage
NtUserRealWaitMessageEx
NtUserReleaseDwmHitTestWaiters
NtUserTranslateMessage
NtUserTranslateAccelerator
NtUserPaintMenuBar
NtUserCalcMenuBar
NtUserCalculatePopupWindowPosition
NtUserTrackPopupMenuEx
NtUserTrackMouseEvent
NtUserToUnicodeEx
NtUserThunkedMenuItemInfo
NtUserThunkedMenuInfo
NtUserTestForInteractiveUser
NtUserSendEventMessage
NtUserSystemParametersInfo
NtUserSystemParametersInfoForDpi
NtUserSwitchDesktop
NtUserSoundSentry
NtUserShutdownReasonDestroy
NtUserShutdownBlockReasonQuery
NtUserShutdownBlockReasonCreate
NtUserShowWindowAsync
NtUserShowWindow
NtUserShowScrollBar
NtUserShowCaret
NtUserSetWinEventHook
NtUserSetWindowWord
NtUserSetWindowStationUser
NtUserSetWindowsHookEx
NtUserSetWindowsHookAW
NtUserSetWindowRgnEx
NtUserGetWindowRgnEx
NtUserSetWindowRgn
NtUserSetWindowPos
NtUserSetWindowPlacement
NtUserSetWindowLong
NtUserSetWindowFNID
NtUserSetWindowDisplayAffinity
NtUserSetWindowCompositionTransition
NtUserUpdateDefaultDesktopThumbnail
NtUserSetWindowCompositionAttribute
NtUserSetWindowBand
NtUserSetProcessUIAccessZorder
NtUserSetProcessDpiAwarenessContext
NtUserEnableChildWindowDpiMessage
NtUserIsChildWindowDpiMessageEnabled
NtUserEnableNonClientDpiScaling
NtUserIsNonClientDpiScalingEnabled
NtUserIsWindowBroadcastingDpiToChildren
NtUserSetTimer
NtUserSetThreadState
NtUserSetThreadLayoutHandles
NtUserSetThreadDesktop
NtUserSetThreadInputBlocked
NtUserSetSystemTimer
NtUserSetSystemMenu
NtUserSetSystemCursor
NtUserSetSysColors
NtUserSetShellWindowEx
NtUserSetScrollInfo
NtUserSetProp
NtUserGetProp
NtUserSetProcessWindowStation
NtUserSetParent
NtUserSetObjectInformation
NtUserSetMenuFlagRtoL
NtUserSetMenuDefaultItem
NtUserSetMenuContextHelpId
NtUserSetMenu
NtUserSetKeyboardState
NtUserSetInternalWindowPos
NtUserSetInformationThread
NtUserSetImeOwnerWindow
NtUserSetImeInfoEx
NtUserSetImeHotKey
NtUserSetFocus
NtUserSetCursorIconData
NtUserSetCursorContents
NtUserSetCursor
NtUserSetClipboardViewer
NtUserSetClipboardData
NtUserSetClassWord
NtUserSetClassLong
NtUserSetChildWindowNoActivate
NtUserSetCapture
NtUserSetAppImeLevel
NtUserSetActiveWindow
NtUserSendInput
NtUserSelectPalette
NtUserScrollWindowEx
NtUserScrollDC
NtUserSBGetParms
NtUserResolveDesktopForWOW
NtUserRemoveProp
NtUserRemoveMenu
NtUserRemoveClipboardFormatListener
NtUserRegisterWindowMessage
NtUserRegisterTasklist
NtUserRegisterServicesProcess
NtUserRegisterRawInputDevices
NtUserRegisterHotKey
NtUserRegisterDManipHook
NtUserGetDManipHookInitFunction
NtUserRegisterManipulationThread
NtUserSetManipulationInputTarget
NtUserRegisterUserApiHook
NtUserRegisterErrorReportingDialog
NtUserRegisterClassExWOW
NtUserRegisterBSDRWindow
NtUserRedrawWindow
NtUserUndelegateInput
NtUserGetWindowMinimizeRect
NtUserDwmGetRemoteSessionOcclusionEvent
NtUserDwmGetRemoteSessionOcclusionState
NtUserDwmKernelShutdown
NtUserDwmKernelStartup
NtUserCheckProcessSession
NtUserUnregisterSessionPort
NtUserRegisterSessionPort
NtUserCtxDisplayIOCtl
NtUserRemoteStopScreenUpdates
NtUserRemoteRedrawScreen
NtUserRemoteRedrawRectangle
NtUserRemoteConnect
NtUserWaitAvailableMessageEx
NtUserWindowFromPoint
NtUserWindowFromPhysicalPoint
NtUserWaitMessage
NtUserWaitForMsgAndEvent
NtUserWaitForInputIdle
NtUserVkKeyScanEx
NtUserValidateTimerCallback
NtUserValidateRect
NtUserValidateHandleSecure
NtUserUserHandleGrantAccess
NtUserUpdatePerUserSystemParameters
NtUserSetLayeredWindowAttributes
NtUserGetLayeredWindowAttributes
NtUserUpdateLayeredWindow
NtUserUpdateInstance
NtUserUpdateInputContext
NtUserUnregisterHotKey
NtUserUnregisterUserApiHook
NtUserUnregisterClass
NtUserUnlockWindowStation
NtUserUnloadKeyboardLayout
NtUserUnhookWinEvent
NtUserUnhookWindowsHookEx
NtUserGetTouchInputInfo
NtUserIsTouchWindow
NtUserModifyWindowTouchCapability
NtGdiEngStretchBltROP
NtGdiEngTextOut
NtGdiEngTransparentBlt
NtGdiEngGradientFill
NtGdiEngAlphaBlend
NtGdiEngLineTo
NtGdiEngPaint
NtGdiEngStrokeAndFillPath
NtGdiEngFillPath
NtGdiEngStrokePath
NtGdiEngMarkBandingSurface
NtGdiEngPlgBlt
NtGdiEngStretchBlt
NtGdiEngBitBlt
NtGdiEngLockSurface
NtGdiEngUnlockSurface
NtGdiEngEraseSurface
NtGdiEngDeleteSurface
NtGdiEngDeletePalette
NtGdiEngCopyBits
NtGdiEngComputeGlyphSet
NtGdiEngCreatePalette
NtGdiEngCreateDeviceBitmap
NtGdiEngCreateDeviceSurface
NtGdiEngCreateBitmap
NtGdiEngAssociateSurface
NtUserSetWindowFeedbackSetting
NtUserRegisterEdgy
NtUserRegisterShellPTPListener
NtUserGetWindowFeedbackSetting
NtUserHidePointerContactVisualization
NtUserGetTouchValidationStatus
NtUserInitializeTouchInjection
NtUserInjectTouchInput
NtUserRegisterTouchHitTestingWindow
NtUserSetDisplayMapping
NtUserSetCalibrationData
NtUserGetPhysicalDeviceRect
NtUserRegisterTouchPadCapable
NtUserGetRawPointerDeviceData
NtUserGetPointerDeviceCursors
NtUserGetPointerDeviceRects
NtUserRegisterPointerDeviceNotifications
NtUserGetPointerDeviceProperties
NtUserGetPointerDevice
NtUserGetPointerDevices
NtUserEnableTouchPad
NtUserGetPrecisionTouchPadConfiguration
NtUserSetPrecisionTouchPadConfiguration
NtUserPromotePointer
NtUserDiscardPointerFrameMessages
NtUserRegisterPointerInputTarget
NtUserGetPointerFrameArrivalTimes
NtUserGetPointerInputTransform
NtUserGetPointerInfoList
NtUserGetPointerCursorId
NtUserGetPointerType
NtUserGetGestureConfig
NtUserSetGestureConfig
NtUserGetGestureExtArgs
NtUserGetGestureInfo
NtUserInjectGesture
NtUserChangeWindowMessageFilterEx
NtGdiXLATEOBJ_hGetColorTransform
NtGdiXLATEOBJ_iXlate
NtGdiXLATEOBJ_cGetPalette
NtGdiEngDeleteClip
NtGdiEngCreateClip
NtGdiEngDeletePath
NtGdiCLIPOBJ_ppoGetPath
NtGdiCLIPOBJ_cEnumStart
NtGdiCLIPOBJ_bEnum
NtGdiBRUSHOBJ_hGetColorTransform
NtGdiBRUSHOBJ_pvGetRbrush
NtGdiBRUSHOBJ_pvAllocRbrush
NtGdiBRUSHOBJ_ulGetBrushColor
NtGdiXFORMOBJ_iGetXform
NtGdiXFORMOBJ_bApplyXform
NtGdiFONTOBJ_pQueryGlyphAttrs
NtGdiFONTOBJ_pfdg
NtGdiFONTOBJ_pifi
NtGdiFONTOBJ_cGetGlyphs
NtGdiFONTOBJ_pxoGetXform
NtGdiFONTOBJ_vGetInfo
NtGdiFONTOBJ_cGetAllGlyphHandles
NtGdiFONTOBJ_pvTrueTypeFontFile
NtGdiSTROBJ_dwGetCodePage
NtGdiSTROBJ_vEnumStart
NtGdiSTROBJ_bGetAdvanceWidths
NtGdiSTROBJ_bEnumPositionsOnly
NtGdiSTROBJ_bEnum
NtGdiPATHOBJ_bEnumClipLines
NtGdiPATHOBJ_vEnumStartClipLines
NtGdiPATHOBJ_vEnumStart
NtGdiPATHOBJ_bEnum
NtGdiPATHOBJ_vGetBounds
NtGdiEngCheckAbort
NtGdiGetDhpdev
NtGdiHT_Get8BPPMaskPalette
NtGdiHT_Get8BPPFormatPalette
NtGdiUpdateTransform
NtGdiUMPDEngFreeUserMem
NtGdiBRUSHOBJ_DeleteRbrush
NtGdiSetPUMPDOBJ
NtGdiSetUMPDSandboxState
NtGdiDrawStream
NtGdiHLSurfSetInformation
NtGdiHLSurfGetInformation
NtGdiDwmCreatedBitmapRemotingOutput
NtGdiDdDDIGetScanLine
NtGdiDdDDIReleaseProcessVidPnSourceOwners
NtGdiDdDDIGetProcessSchedulingPriorityClass
NtGdiDdDDISetProcessSchedulingPriorityClass
NtGdiDdDDIGetContextSchedulingPriority
NtGdiDdDDISetContextSchedulingPriority
NtGdiDdDDIDestroyDCFromMemory
NtGdiDdDDICreateDCFromMemory
NtGdiDdDDIGetDeviceState
NtGdiDdDDISetGammaRamp
NtGdiDdDDIWaitForVerticalBlankEvent
NtGdiDdDDIDestroyOverlay
NtGdiDdDDIFlipOverlay
NtGdiDdDDIUpdateOverlay
NtGdiDdDDICreateOverlay
NtGdiDdDDIGetPresentQueueEvent
NtGdiDdDDIGetPresentHistory
NtGdiDdDDISetVidPnSourceOwner1
NtGdiDdDDISetVidPnSourceOwner
NtGdiDdDDIQueryStatistics
NtGdiDdDDIEscape
NtGdiDdDDIGetSharedPrimaryHandle
NtGdiDdDDICloseAdapter
NtGdiDdDDIOpenAdapterFromLuid
NtGdiDdDDIEnumAdapters
NtGdiDdDDIEnumAdapters2
NtGdiDdDDIOpenAdapterFromHdc
NtGdiDdDDIOpenAdapterFromDeviceName
NtGdiDdDDIRender
NtGdiDdDDIPresent
NtGdiDdDDIGetMultisampleMethodList
NtGdiDdDDISetDisplayMode
NtGdiDdDDIGetDisplayModeList
NtGdiDdDDIUnlock
NtGdiDdDDILock
NtGdiDdDDIQueryAdapterInfo
NtGdiDdDDIGetRuntimeData
NtGdiDdDDISignalSynchronizationObject
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDIDestroySynchronizationObject
NtGdiDdDDIOpenSynchronizationObject
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIDestroyContext
NtGdiDdDDICreateContext
NtGdiDdDDIDestroyDevice
NtGdiDdDDICreateDevice
NtGdiDdDDIQueryAllocationResidency
NtGdiDdDDISetAllocationPriority
NtGdiDdDDIDestroyAllocation
NtGdiDdDDIDestroyAllocation2
NtGdiDdDDIOpenResourceFromNtHandle
NtGdiDdDDIOpenSyncObjectFromNtHandle
NtGdiDdDDIOpenSyncObjectFromNtHandle2
NtGdiDdDDIOpenResource
NtGdiDdDDIOpenNtHandleFromName
NtGdiDdDDIOpenSyncObjectNtHandleFromName
NtGdiDdDDIShareObjects
NtGdiDdDDIQueryResourceInfoFromNtHandle
NtGdiDdDDIQueryResourceInfo
NtGdiDdDDICreateAllocation
NtGdiDdDDIOutputDuplReleaseFrame
NtGdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName
NtGdiDdDDIOutputDuplPresent
NtGdiDdDDIReleaseKeyedMutex2
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDIOutputDuplGetPointerShapeData
NtGdiDdDDIOutputDuplGetMetaData
NtGdiDdDDIOutputDuplGetFrameInfo
NtGdiDdDDIDestroyOutputDupl
NtGdiDdDDICreateOutputDupl
NtGdiDdDDIReclaimAllocations
NtGdiDdDDIOfferAllocations
NtGdiDdDDICheckSharedResourceAccess
NtGdiDdDDICheckVidPnExclusiveOwnership
NtGdiDdDDIGetOverlayState
NtGdiDdDDIConfigureSharedResource
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDICreateKeyedMutex
NtGdiDdDDISharedPrimaryUnLockNotification
NtGdiDdDDISharedPrimaryLockNotification
NtGdiDdDDISetDisplayPrivateDriverFormat
NtGdiDdDDICheckExclusiveOwnership
NtGdiDdDDICheckMonitorPowerState
NtGdiDdDDIWaitForIdle
NtGdiDdDDICheckOcclusion
NtGdiDdDDIInvalidateActiveVidPn
NtGdiDdDDIPollDisplayChildren
NtGdiDdDDISetQueuedLimit
NtGdiDdDDIPinDirectFlipResources
NtGdiDdDDIUnpinDirectFlipResources
NtGdiDdDDIWaitForVerticalBlankEvent2
NtGdiDdDDIGetDWMVerticalBlankEvent
NtGdiDdDDISetSyncRefreshCountWaitTarget
NtGdiDdDDISetContextInProcessSchedulingPriority
NtGdiDdDDIGetContextInProcessSchedulingPriority
NtGdiDdDDIGetSharedResourceAdapterLuid
NtGdiDdDDISetStereoEnabled
NtGdiDdDDIPresentMultiPlaneOverlay
NtGdiDdDDICheckMultiPlaneOverlaySupport
NtGdiDdDDIMakeResident
NtGdiDdDDIEvict
NtGdiDdDDIUpdateAllocationProperty
NtGdiDdDDIWaitForSynchronizationObjectFromCpu
NtGdiDdDDISignalSynchronizationObjectFromCpu
NtGdiDdDDIWaitForSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu2
NtGdiDdDDICreatePagingQueue
NtGdiDdDDIDestroyPagingQueue
NtGdiDdDDILock2
NtGdiDdDDIUnlock2
NtGdiDdDDIInvalidateCache
NtGdiDdDDIGetResourcePresentPrivateDriverData
NtGdiDdDDIMapGpuVirtualAddress
NtGdiDdDDIReserveGpuVirtualAddress
NtGdiDdDDIFreeGpuVirtualAddress
NtGdiDdDDIUpdateGpuVirtualAddress
NtGdiDdDDICreateContextVirtual
NtGdiDdDDISubmitCommand
NtGdiDdDDIGetCachedHybridQueryValue
NtGdiDdDDICacheHybridQueryValue
NtGdiDdDDINetDispGetNextChunkInfo
NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport
NtGdiDdDDINetDispStartMiracastDisplayDevice
NtGdiDdDDINetDispStopMiracastDisplayDevice
NtGdiDdDDINetDispQueryMiracastDisplayDeviceStatus
NtGdiDdDDINetDispStopSessions
NtGdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDIChangeVideoMemoryReservation
NtGdiDdDDICreateSwapChain
NtGdiDdDDIOpenSwapChain
NtGdiDdDDIGetSetSwapChainMetadata
NtGdiDdDDIAcquireSwapChain
NtGdiDdDDIReleaseSwapChain
NtGdiDdDDIAbandonSwapChain
NtGdiDdDDISetDodIndirectSwapchain
NtGdiDdDDICheckMultiPlaneOverlaySupport2
NtGdiDdDDIPresentMultiPlaneOverlay2
NtGdiDdDDIReclaimAllocations2
NtGdiDdDDISetStablePowerState
NtGdiDdDDIQueryClockCalibration
NtGdiDdDDIQueryVidPnExclusiveOwnership
NtGdiDdDDIAdjustFullscreenGamma
NtGdiDdDDISetVidPnSourceHwProtection
NtGdiDdDDIMarkDeviceAsError
NtGdiDdDDIFlushHeapTransitions
NtGdiDdDDISetHwProtectionTeardownRecovery
NtGdiDdDDIQueryProcessOfferInfo
NtGdiDdDDITrimProcessCommitment
NtGdiDdDDICheckMultiPlaneOverlaySupport3
NtGdiDdDDIPresentMultiPlaneOverlay3
NtGdiDdDDISetFSEBlock
NtGdiDdDDIQueryFSEBlock
NtGdiDdDDICreateHwContext
NtGdiDdDDIDestroyHwContext
NtGdiDdDDICreateHwQueue
NtGdiDdDDIDestroyHwQueue
NtGdiDdDDISubmitCommandToHwQueue
NtGdiDdDDISubmitWaitForSyncObjectsToHwQueue
NtGdiDdDDISubmitSignalSyncObjectsToHwQueue
NtGdiMakeObjectUnXferable
NtGdiMakeObjectXferable
NtGdiDestroyPhysicalMonitor
NtGdiGetPhysicalMonitorDescription
NtGdiGetPhysicalMonitors
NtGdiGetNumberOfPhysicalMonitors
NtGdiDDCCIGetTimingReport
NtGdiDDCCIGetCapabilitiesString
NtGdiDDCCIGetCapabilitiesStringLength
NtGdiDDCCISaveCurrentSettings
NtGdiDDCCISetVCPFeature
NtGdiDDCCIGetVCPFeature
NtGdiDdQueryVisRgnUniqueness
NtGdiDdDestroyFullscreenSprite
NtGdiDdNotifyFullscreenSpriteUpdate
NtGdiDdCreateFullscreenSprite
NtGdiGetProcessSessionFonts
NtGdiGetPublicFontTableChangeCookie
NtUserShowSystemCursor
NtUserSetMirrorRendering
NtUserMagGetContextInformation
NtUserMagSetContextInformation
NtUserMagControl
NtUserSlicerControl
NtUserHwndSetRedirectionInfo
NtUserHwndQueryRedirectionInfo
NtCreateCompositionSurfaceHandle
NtValidateCompositionSurfaceHandle
NtBindCompositionSurface
NtUnBindCompositionSurface
NtQueryCompositionSurfaceBinding
NtNotifyPresentToCompositionSurface
NtQueryCompositionSurfaceStatistics
NtOpenCompositionSurfaceSectionInfo
NtOpenCompositionSurfaceSwapChainHandleInfo
NtQueryCompositionSurfaceRenderingRealization
NtOpenCompositionSurfaceDirtyRegion
NtQueryCompositionSurfaceHDRMetaData
NtSetCompositionSurfaceHDRMetaData
NtSetCompositionSurfaceDirectFlipState
NtSetCompositionSurfaceStatistics
NtSetCompositionSurfaceBufferCompositionModeAndOrientation
NtSetCompositionSurfaceIndependentFlipInfo
NtDesktopCaptureBits
NtDCompositionEnableMMCSS
NtVisualCaptureBits
NtDCompositionEnableDDASupport
NtDCompositionCreateSharedVisualHandle
NtCreateCompositionInputSink
NtCreateImplicitCompositionInputSink
NtDuplicateCompositionInputSink
NtQueryCompositionInputSink
NtQueryCompositionInputSinkLuid
NtQueryCompositionInputSinkViewId
NtUpdateInputSinkTransforms
NtCompositionInputThread
NtQueryCompositionInputQueueAndTransform
NtQueryCompositionInputIsImplicit
NtCompositionSetDropTarget
NtTokenManagerOpenSectionAndEvents
NtTokenManagerThread
NtTokenManagerCreateCompositionTokenHandle
NtTokenManagerGetAnalogExclusiveTokenEvent
NtTokenManagerGetAnalogExclusiveSurfaceUpdates
NtTokenManagerConfirmOutstandingAnalogToken
NtSetCompositionSurfaceAnalogExclusive
NtDCompositionBeginFrame
NtDCompositionConfirmFrame
NtDCompositionRetireFrame
NtDCompositionDiscardFrame
NtDCompositionGetFrameSurfaceUpdates
NtDCompositionGetFrameLegacyTokens
NtDCompositionDestroyConnection
NtDCompositionGetConnectionBatch
NtDCompositionGetFrameStatistics
NtDCompositionGetDeletedResources
NtDCompositionCreateConnection
NtDCompositionDestroyChannel
NtDCompositionReleaseAllResources
NtDCompositionSubmitDWMBatch
NtDCompositionProcessChannelBatchBuffer
NtDCompositionCommitChannel
NtDCompositionWaitForChannel
NtDCompositionSetChannelCommitCompletionEvent
NtDCompositionTelemetryTouchInteractionBegin
NtDCompositionTelemetryTouchInteractionUpdate
NtDCompositionTelemetryTouchInteractionEnd
NtDCompositionTelemetrySetApplicationId
NtDCompositionTelemetryAnimationScenarioBegin
NtDCompositionTelemetryAnimationScenarioReference
NtDCompositionTelemetryAnimationScenarioUnreference
NtDCompositionCurrentBatchId
NtDCompositionRemoveCrossDeviceVisualChild
NtDCompositionAddCrossDeviceVisualChild
NtDCompositionCreateDwmChannel
NtDCompositionCreateChannel
NtDCompositionSynchronize
NtDCompositionReferenceSharedResourceOnDwmChannel
NtDCompositionCreateAndBindSharedSection
NtDCompositionSetDebugCounter
NtDCompositionGetChannels
NtDCompositionConnectPipe
NtDCompositionRegisterThumbnailVisual
NtDCompositionRegisterVirtualDesktopVisual
NtDCompositionDuplicateHandleToProcess
NtDCompositionUpdatePointerCapture
NtDCompositionSetChannelCallbackId
NtDCompositionDuplicateSwapchainHandleToDwm
NtUserDestroyDCompositionHwndTarget
NtUserCreateDCompositionHwndTarget
NtUserWaitForRedirectionStartComplete
NtUserSignalRedirectionStartComplete
NtUserSetActiveProcessForMonitor
NtUserGetDisplayAutoRotationPreferencesByProcessId
NtUserGetDisplayAutoRotationPreferences
NtUserSetDisplayAutoRotationPreferences
NtUserSetAutoRotation
NtUserGetAutoRotationState
NtUserAutoRotateScreen
NtUserAcquireIAMKey
NtUserSetActivationFilter
NtUserSetFallbackForeground
NtUserSetBrokeredForeground
NtUserDisableImmersiveOwner
NtUserClearForeground
NtUserEnableIAMAccess
NtUserGetProcessUIContextInformation
NtUserSetProcessRestrictionExemption
NtUserSetWindowArrangement
NtUserSetWindowShowState
NtUserUpdateWindowTrackingInfo
NtUserEnableMouseInPointer
NtUserIsMouseInPointerEnabled
NtUserPromoteMouseInPointer
NtUserAutoPromoteMouseInPointer
NtUserEnableMouseInputForCursorSuppression
NtUserIsMouseInputEnabled
NtUserInternalClipCursor
NtUserCheckProcessForClipboardAccess
NtUserGetClipboardAccessToken
NtUserGetQueueStatusReadonly
NtUserCompositionInputSinkLuidFromPoint
NtUserCompositionInputSinkViewInstanceIdFromPoint
NtUserUpdateWindowInputSinkHints
NtUserTransformPoint
NtUserTransformRect
NtUserGetHimetricScaleFactorFromPixelLocation
NtUserGetDpiForMonitor
NtUserReportInertia
NtUserLinkDpiCursor
NtUserGetCursorDims
NtUserInitializeInputDeviceInjection
NtUserInitializePointerDeviceInjection
NtUserRemoveInjectionDevice
NtUserSetFeatureReportResponse
NtUserInjectDeviceInput
NtUserInjectMouseInput
NtUserInjectKeyboardInput
NtUserInjectPointerInput
NtUserInitializePointerDeviceInjectionEx
NtRIMRegisterForInput
NtRIMReadInput
NtRIMGetDevicePreparsedData
NtRIMGetDeviceProperties
NtRIMAreSiblingDevices
NtRIMFreeInputBuffer
NtRIMOnPnpNotification
NtRIMOnTimerNotification
NtRIMDeviceIoControl
NtRIMUnregisterForInput
NtRIMSetTestModeStatus
NtRIMGetPhysicalDeviceRect
NtRIMGetSourceProcessId
NtRIMAddInputObserver
NtRIMRemoveInputObserver
NtRIMUpdateInputObserverRegistration
NtRIMObserveNextInput
NtRIMGetDevicePreparsedDataLockfree
NtUserSetCoreWindow
NtUserSetCoreWindowPartner
NtUserNavigateFocus
NtHWCursorUpdatePointer
NtUserAcquireInteractiveControlBackgroundAccess
NtUserGetInteractiveControlInfo
NtUserGetInteractiveControlDeviceInfo
NtUserSendInteractiveControlHapticsReport
NtUserSetInteractiveControlFocus
NtUserInteractiveControlQueryUsage
NtUserSetInteractiveCtrlRotationAngle
NtUserGetInteractiveCtrlSupportedWaveforms
NtUserBeginInkFeedbackSession
NtUserEndInkFeedbackSession
NtUserSendInkFeedbackPayload
NtUserSetProcessInteractionFlags

↧

W32pServiceTable from windows 10 build 14931 x64

September 22, 2016, 8:30 am

≫ Next: simple wnf id decoder

≪ Previous: W32pServiceTable from windows 10 build 14931

W32pServiceLimit .eq. 0x48C

NtUserGetOwnerTransformedMonitorRect
NtUserYieldTask
NtUserSetSensorPresence
NtUserGetThreadState
NtUserPeekMessage
NtUserCallOneParam
NtUserGetKeyState
NtUserInvalidateRect
NtUserCallNoParam
NtUserGetMessage
NtUserMessageCall
NtGdiBitBlt
NtGdiGetCharSet
NtUserGetDC
NtGdiSelectBitmap
NtUserWaitMessage
NtUserTranslateMessage
NtUserGetProp
NtUserPostMessage
NtUserQueryWindow
NtUserTranslateAccelerator
NtGdiFlush
NtUserRedrawWindow
NtUserWindowFromPoint
NtUserCallMsgFilter
NtUserValidateTimerCallback
NtUserBeginPaint
NtUserSetTimer
NtUserEndPaint
NtUserSetCursor
NtUserKillTimer
NtUserBuildHwndList
NtUserSelectPalette
NtUserCallNextHookEx
NtUserHideCaret
NtGdiIntersectClipRect
NtUserCallHwndLock
NtUserGetProcessWindowStation
NtGdiDeleteObjectApp
NtUserSetWindowPos
NtUserShowCaret
NtUserEndDeferWindowPosEx
NtUserCallHwndParamLock
NtUserVkKeyScanEx
NtGdiSetDIBitsToDeviceInternal
NtUserCallTwoParam
NtGdiGetRandomRgn
NtUserCopyAcceleratorTable
NtUserNotifyWinEvent
NtGdiExtSelectClipRgn
NtUserIsClipboardFormatAvailable
NtUserSetScrollInfo
NtGdiStretchBlt
NtUserCreateCaret
NtGdiRectVisible
NtGdiCombineRgn
NtGdiGetDCObject
NtUserDispatchMessage
NtUserRegisterWindowMessage
NtGdiExtTextOutW
NtGdiSelectFont
NtGdiRestoreDC
NtGdiSaveDC
NtUserGetForegroundWindow
NtUserShowScrollBar
NtUserFindExistingCursorIcon
NtGdiGetDCDword
NtGdiGetRegionData
NtGdiLineTo
NtUserSystemParametersInfo
NtGdiGetAppClipBox
NtUserGetAsyncKeyState
NtUserGetCPD
NtUserRemoveProp
NtGdiDoPalette
NtGdiPolyPolyDraw
NtUserSetCapture
NtUserEnumDisplayMonitors
NtGdiCreateCompatibleBitmap
NtUserSetProp
NtGdiGetTextCharsetInfo
NtUserSBGetParms
NtUserGetIconInfo
NtUserExcludeUpdateRgn
NtUserSetFocus
NtGdiExtGetObjectW
NtUserGetUpdateRect
NtGdiCreateCompatibleDC
NtUserGetClipboardSequenceNumber
NtGdiCreatePen
NtUserShowWindow
NtUserGetKeyboardLayoutList
NtGdiPatBlt
NtUserMapVirtualKeyEx
NtUserSetWindowLong
NtGdiHfontCreate
NtUserMoveWindow
NtUserPostThreadMessage
NtUserDrawIconEx
NtUserGetSystemMenu
NtGdiDrawStream
NtUserInternalGetWindowText
NtUserGetWindowDC
NtGdiD3dDrawPrimitives2
NtGdiInvertRgn
NtGdiGetRgnBox
NtGdiGetAndSetDCDword
NtGdiMaskBlt
NtGdiGetWidthTable
NtUserScrollDC
NtUserGetObjectInformation
NtGdiCreateBitmap
NtUserFindWindowEx
NtGdiPolyPatBlt
NtUserUnhookWindowsHookEx
NtGdiGetNearestColor
NtGdiTransformPoints
NtGdiGetDCPoint
NtGdiCreateDIBBrush
NtGdiGetTextMetricsW
NtUserCreateWindowEx
NtUserSetParent
NtUserGetKeyboardState
NtUserToUnicodeEx
NtUserGetControlBrush
NtUserGetClassName
NtGdiAlphaBlend
NtGdiDdBlt
NtGdiOffsetRgn
NtUserDefSetText
NtGdiGetTextFaceW
NtGdiStretchDIBitsInternal
NtUserSendInput
NtUserGetThreadDesktop
NtGdiCreateRectRgn
NtGdiGetDIBitsInternal
NtUserGetUpdateRgn
NtGdiDeleteClientObj
NtUserGetIconSize
NtUserFillWindow
NtGdiExtCreateRegion
NtGdiComputeXformCoefficients
NtUserSetWindowsHookEx
NtUserNotifyProcessCreate
NtGdiUnrealizeObject
NtUserGetTitleBarInfo
NtGdiRectangle
NtUserSetThreadDesktop
NtUserGetDCEx
NtUserGetScrollBarInfo
NtGdiGetTextExtent
NtUserSetWindowFNID
NtGdiSetLayout
NtUserCalcMenuBar
NtUserThunkedMenuItemInfo
NtGdiExcludeClipRect
NtGdiCreateDIBSection
NtGdiGetDCforBitmap
NtUserDestroyCursor
NtUserDestroyWindow
NtUserCallHwndParam
NtGdiCreateDIBitmapInternal
NtUserOpenWindowStation
NtGdiDdDeleteSurfaceObject
NtGdiDdCanCreateSurface
NtGdiDdCreateSurface
NtUserSetCursorIconData
NtGdiDdDestroySurface
NtUserCloseDesktop
NtUserOpenDesktop
NtUserSetProcessWindowStation
NtUserGetAtomName
NtGdiDdResetVisrgn
NtGdiExtCreatePen
NtGdiCreatePaletteInternal
NtGdiSetBrushOrg
NtUserBuildNameList
NtGdiSetPixel
NtUserRegisterClassExWOW
NtGdiCreatePatternBrushInternal
NtUserGetAncestor
NtGdiGetOutlineTextMetricsInternalW
NtGdiSetBitmapBits
NtUserCloseWindowStation
NtUserGetDoubleClickTime
NtUserEnableScrollBar
NtGdiCreateSolidBrush
NtUserGetClassInfoEx
NtGdiCreateClientObj
NtUserUnregisterClass
NtUserDeleteMenu
NtGdiRectInRegion
NtUserScrollWindowEx
NtGdiGetPixel
NtUserSetClassLong
NtUserGetMenuBarInfo
NtGdiDdCreateSurfaceEx
NtGdiDdCreateSurfaceObject
NtGdiGetNearestPaletteIndex
NtGdiDdLockD3D
NtGdiDdUnlockD3D
NtGdiGetCharWidthW
NtUserInvalidateRgn
NtUserGetClipboardOwner
NtUserSetWindowRgn
NtUserBitBltSysBmp
NtGdiGetCharWidthInfo
NtUserValidateRect
NtUserCloseClipboard
NtUserOpenClipboard
NtUserSetClipboardData
NtUserEnableMenuItem
NtUserAlterWindowStyle
NtGdiFillRgn
NtUserGetWindowPlacement
NtGdiModifyWorldTransform
NtGdiGetFontData
NtUserGetOpenClipboardWindow
NtUserSetThreadState
NtGdiOpenDCW
NtUserTrackMouseEvent
NtGdiGetTransform
NtUserDestroyMenu
NtGdiGetBitmapBits
NtUserConsoleControl
NtUserSetActiveWindow
NtUserSetInformationThread
NtUserSetWindowPlacement
NtUserGetControlColor
NtGdiSetMetaRgn
NtGdiSetMiterLimit
NtGdiSetVirtualResolution
NtGdiGetRasterizerCaps
NtUserSetWindowWord
NtUserGetClipboardFormatName
NtUserRealInternalGetMessage
NtUserCreateLocalMemHandle
NtUserAttachThreadInput
NtGdiCreateHalftonePalette
NtUserPaintMenuBar
NtUserSetKeyboardState
NtGdiCombineTransform
NtUserCreateAcceleratorTable
NtUserGetCursorFrameInfo
NtUserGetAltTabInfo
NtUserGetCaretBlinkTime
NtGdiQueryFontAssocInfo
NtUserProcessConnect
NtUserEnumDisplayDevices
NtUserEmptyClipboard
NtUserGetClipboardData
NtUserRemoveMenu
NtGdiSetBoundsRect
NtGdiGetBitmapDimension
NtUserConvertMemHandle
NtUserDestroyAcceleratorTable
NtUserGetGUIThreadInfo
NtGdiCloseFigure
NtUserSetWindowsHookAW
NtUserSetMenuDefaultItem
NtUserCheckMenuItem
NtUserSetWinEventHook
NtUserUnhookWinEvent
NtUserLockWindowUpdate
NtUserSetSystemMenu
NtUserThunkedMenuInfo
NtGdiBeginPath
NtGdiEndPath
NtGdiFillPath
NtUserCallHwnd
NtUserDdeInitialize
NtUserModifyUserStartupInfoFlags
NtUserCountClipboardFormats
NtGdiAddFontMemResourceEx
NtGdiEqualRgn
NtGdiGetSystemPaletteUse
NtGdiRemoveFontMemResourceEx
NtUserEnumDisplaySettings
NtUserPaintDesktop
NtGdiExtEscape
NtGdiSetBitmapDimension
NtGdiSetFontEnumeration
NtUserChangeClipboardChain
NtUserSetClipboardViewer
NtUserShowWindowAsync
NtGdiCreateColorSpace
NtGdiDeleteColorSpace
NtUserActivateKeyboardLayout
NtBindCompositionSurface
NtCompositionInputThread
NtCompositionSetDropTarget
NtCreateCompositionInputSink
NtCreateCompositionSurfaceHandle
NtCreateImplicitCompositionInputSink
NtDCompositionAddCrossDeviceVisualChild
NtDCompositionBeginFrame
NtDCompositionCommitChannel
NtDCompositionConfirmFrame
NtDCompositionConnectPipe
NtDCompositionCreateAndBindSharedSection
NtDCompositionCreateChannel
NtDCompositionCreateConnection
NtDCompositionCreateDwmChannel
NtDCompositionCreateSharedVisualHandle
NtDCompositionCurrentBatchId
NtDCompositionDestroyChannel
NtDCompositionDestroyConnection
NtDCompositionDiscardFrame
NtDCompositionDuplicateHandleToProcess
NtDCompositionDuplicateSwapchainHandleToDwm
NtDCompositionEnableDDASupport
NtDCompositionEnableMMCSS
NtDCompositionGetChannels
NtDCompositionGetConnectionBatch
NtDCompositionGetDeletedResources
NtDCompositionGetFrameLegacyTokens
NtDCompositionGetFrameStatistics
NtDCompositionGetFrameSurfaceUpdates
NtDCompositionProcessChannelBatchBuffer
NtDCompositionReferenceSharedResourceOnDwmChannel
NtDCompositionRegisterThumbnailVisual
NtDCompositionRegisterVirtualDesktopVisual
NtDCompositionReleaseAllResources
NtDCompositionRemoveCrossDeviceVisualChild
NtDCompositionRetireFrame
NtDCompositionSetChannelCallbackId
NtDCompositionSetChannelCommitCompletionEvent
NtDCompositionSetDebugCounter
NtDCompositionSubmitDWMBatch
NtDCompositionSynchronize
NtDCompositionTelemetryAnimationScenarioBegin
NtDCompositionTelemetryAnimationScenarioReference
NtDCompositionTelemetryAnimationScenarioUnreference
NtDCompositionTelemetrySetApplicationId
NtDCompositionTelemetryTouchInteractionBegin
NtDCompositionTelemetryTouchInteractionEnd
NtDCompositionTelemetryTouchInteractionUpdate
NtDCompositionUpdatePointerCapture
NtDCompositionWaitForChannel
NtDesktopCaptureBits
NtDuplicateCompositionInputSink
NtGdiAbortDoc
NtGdiAbortPath
NtGdiAddEmbFontToDC
NtGdiAddFontResourceW
NtGdiAddRemoteFontToDC
NtGdiAddRemoteMMInstanceToDC
NtGdiAngleArc
NtGdiAnyLinkedFonts
NtGdiArcInternal
NtGdiBRUSHOBJ_DeleteRbrush
NtGdiBRUSHOBJ_hGetColorTransform
NtGdiBRUSHOBJ_pvAllocRbrush
NtGdiBRUSHOBJ_pvGetRbrush
NtGdiBRUSHOBJ_ulGetBrushColor
NtGdiBeginGdiRendering
NtGdiCLIPOBJ_bEnum
NtGdiCLIPOBJ_cEnumStart
NtGdiCLIPOBJ_ppoGetPath
NtGdiCancelDC
NtGdiChangeGhostFont
NtGdiCheckBitmapBits
NtGdiClearBitmapAttributes
NtGdiClearBrushAttributes
NtGdiColorCorrectPalette
NtGdiConfigureOPMProtectedOutput
NtGdiConvertMetafileRect
NtGdiCreateBitmapFromDxSurface
NtGdiCreateBitmapFromDxSurface2
NtGdiCreateColorTransform
NtGdiCreateEllipticRgn
NtGdiCreateHatchBrushInternal
NtGdiCreateMetafileDC
NtGdiCreateOPMProtectedOutput
NtGdiCreateOPMProtectedOutputs
NtGdiCreateRoundRectRgn
NtGdiCreateServerMetaFile
NtGdiCreateSessionMappedDIBSection
NtGdiD3dContextCreate
NtGdiD3dContextDestroy
NtGdiD3dContextDestroyAll
NtGdiD3dValidateTextureStageState
NtGdiDDCCIGetCapabilitiesString
NtGdiDDCCIGetCapabilitiesStringLength
NtGdiDDCCIGetTimingReport
NtGdiDDCCIGetVCPFeature
NtGdiDDCCISaveCurrentSettings
NtGdiDDCCISetVCPFeature
NtGdiDdAddAttachedSurface
NtGdiDdAlphaBlt
NtGdiDdAttachSurface
NtGdiDdBeginMoCompFrame
NtGdiDdCanCreateD3DBuffer
NtGdiDdColorControl
NtGdiDdCreateD3DBuffer
NtGdiDdCreateDirectDrawObject
NtGdiDdCreateFullscreenSprite
NtGdiDdCreateMoComp
NtGdiDdDDIAbandonSwapChain
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIAcquireSwapChain
NtGdiDdDDIAdjustFullscreenGamma
NtGdiDdDDICacheHybridQueryValue
NtGdiDdDDIChangeVideoMemoryReservation
NtGdiDdDDICheckExclusiveOwnership
NtGdiDdDDICheckMonitorPowerState
NtGdiDdDDICheckMultiPlaneOverlaySupport
NtGdiDdDDICheckMultiPlaneOverlaySupport2
NtGdiDdDDICheckMultiPlaneOverlaySupport3
NtGdiDdDDICheckOcclusion
NtGdiDdDDICheckSharedResourceAccess
NtGdiDdDDICheckVidPnExclusiveOwnership
NtGdiDdDDICloseAdapter
NtGdiDdDDIConfigureSharedResource
NtGdiDdDDICreateAllocation
NtGdiDdDDICreateContext
NtGdiDdDDICreateContextVirtual
NtGdiDdDDICreateDCFromMemory
NtGdiDdDDICreateDevice
NtGdiDdDDICreateHwContext
NtGdiDdDDICreateHwQueue
NtGdiDdDDICreateKeyedMutex
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDICreateOutputDupl
NtGdiDdDDICreateOverlay
NtGdiDdDDICreatePagingQueue
NtGdiDdDDICreateSwapChain
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIDestroyAllocation
NtGdiDdDDIDestroyAllocation2
NtGdiDdDDIDestroyContext
NtGdiDdDDIDestroyDCFromMemory
NtGdiDdDDIDestroyDevice
NtGdiDdDDIDestroyHwContext
NtGdiDdDDIDestroyHwQueue
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIDestroyOutputDupl
NtGdiDdDDIDestroyOverlay
NtGdiDdDDIDestroyPagingQueue
NtGdiDdDDIDestroySynchronizationObject
NtGdiDdDDIEnumAdapters
NtGdiDdDDIEnumAdapters2
NtGdiDdDDIEscape
NtGdiDdDDIEvict
NtGdiDdDDIFlipOverlay
NtGdiDdDDIFlushHeapTransitions
NtGdiDdDDIFreeGpuVirtualAddress
NtGdiDdDDIGetCachedHybridQueryValue
NtGdiDdDDIGetContextInProcessSchedulingPriority
NtGdiDdDDIGetContextSchedulingPriority
NtGdiDdDDIGetDWMVerticalBlankEvent
NtGdiDdDDIGetDeviceState
NtGdiDdDDIGetDisplayModeList
NtGdiDdDDIGetMultisampleMethodList
NtGdiDdDDIGetOverlayState
NtGdiDdDDIGetPresentHistory
NtGdiDdDDIGetPresentQueueEvent
NtGdiDdDDIGetProcessSchedulingPriorityClass
NtGdiDdDDIGetResourcePresentPrivateDriverData
NtGdiDdDDIGetRuntimeData
NtGdiDdDDIGetScanLine
NtGdiDdDDIGetSetSwapChainMetadata
NtGdiDdDDIGetSharedPrimaryHandle
NtGdiDdDDIGetSharedResourceAdapterLuid
NtGdiDdDDIInvalidateActiveVidPn
NtGdiDdDDIInvalidateCache
NtGdiDdDDILock
NtGdiDdDDILock2
NtGdiDdDDIMakeResident
NtGdiDdDDIMapGpuVirtualAddress
NtGdiDdDDIMarkDeviceAsError
NtGdiDdDDINetDispGetNextChunkInfo
NtGdiDdDDINetDispQueryMiracastDisplayDeviceStatus
NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport
NtGdiDdDDINetDispStartMiracastDisplayDevice
NtGdiDdDDINetDispStopMiracastDisplayDevice
NtGdiDdDDINetDispStopSessions
NtGdiDdDDIOfferAllocations
NtGdiDdDDIOpenAdapterFromDeviceName
NtGdiDdDDIOpenAdapterFromHdc
NtGdiDdDDIOpenAdapterFromLuid
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDIOpenNtHandleFromName
NtGdiDdDDIOpenResource
NtGdiDdDDIOpenResourceFromNtHandle
NtGdiDdDDIOpenSwapChain
NtGdiDdDDIOpenSyncObjectFromNtHandle
NtGdiDdDDIOpenSyncObjectFromNtHandle2
NtGdiDdDDIOpenSyncObjectNtHandleFromName
NtGdiDdDDIOpenSynchronizationObject
NtGdiDdDDIOutputDuplGetFrameInfo
NtGdiDdDDIOutputDuplGetMetaData
NtGdiDdDDIOutputDuplGetPointerShapeData
NtGdiDdDDIOutputDuplPresent
NtGdiDdDDIOutputDuplReleaseFrame
NtGdiDdDDIPinDirectFlipResources
NtGdiDdDDIPollDisplayChildren
NtGdiDdDDIPresent
NtGdiDdDDIPresentMultiPlaneOverlay
NtGdiDdDDIPresentMultiPlaneOverlay2
NtGdiDdDDIPresentMultiPlaneOverlay3
NtGdiDdDDIQueryAdapterInfo
NtGdiDdDDIQueryAllocationResidency
NtGdiDdDDIQueryClockCalibration
NtGdiDdDDIQueryFSEBlock
NtGdiDdDDIQueryProcessOfferInfo
NtGdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName
NtGdiDdDDIQueryResourceInfo
NtGdiDdDDIQueryResourceInfoFromNtHandle
NtGdiDdDDIQueryStatistics
NtGdiDdDDIQueryVidPnExclusiveOwnership
NtGdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDIReclaimAllocations
NtGdiDdDDIReclaimAllocations2
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIReleaseKeyedMutex2
NtGdiDdDDIReleaseProcessVidPnSourceOwners
NtGdiDdDDIReleaseSwapChain
NtGdiDdDDIRender
NtGdiDdDDIReserveGpuVirtualAddress
NtGdiDdDDISetAllocationPriority
NtGdiDdDDISetContextInProcessSchedulingPriority
NtGdiDdDDISetContextSchedulingPriority
NtGdiDdDDISetDisplayMode
NtGdiDdDDISetDisplayPrivateDriverFormat
NtGdiDdDDISetDodIndirectSwapchain
NtGdiDdDDISetFSEBlock
NtGdiDdDDISetGammaRamp
NtGdiDdDDISetHwProtectionTeardownRecovery
NtGdiDdDDISetProcessSchedulingPriorityClass
NtGdiDdDDISetQueuedLimit
NtGdiDdDDISetStablePowerState
NtGdiDdDDISetStereoEnabled
NtGdiDdDDISetSyncRefreshCountWaitTarget
NtGdiDdDDISetVidPnSourceHwProtection
NtGdiDdDDISetVidPnSourceOwner
NtGdiDdDDISetVidPnSourceOwner1
NtGdiDdDDIShareObjects
NtGdiDdDDISharedPrimaryLockNotification
NtGdiDdDDISharedPrimaryUnLockNotification
NtGdiDdDDISignalSynchronizationObject
NtGdiDdDDISignalSynchronizationObjectFromCpu
NtGdiDdDDISignalSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu2
NtGdiDdDDISubmitCommand
NtGdiDdDDISubmitCommandToHwQueue
NtGdiDdDDISubmitSignalSyncObjectsToHwQueue
NtGdiDdDDISubmitWaitForSyncObjectsToHwQueue
NtGdiDdDDITrimProcessCommitment
NtGdiDdDDIUnlock
NtGdiDdDDIUnlock2
NtGdiDdDDIUnpinDirectFlipResources
NtGdiDdDDIUpdateAllocationProperty
NtGdiDdDDIUpdateGpuVirtualAddress
NtGdiDdDDIUpdateOverlay
NtGdiDdDDIWaitForIdle
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDIWaitForSynchronizationObjectFromCpu
NtGdiDdDDIWaitForSynchronizationObjectFromGpu
NtGdiDdDDIWaitForVerticalBlankEvent
NtGdiDdDDIWaitForVerticalBlankEvent2
NtGdiDdDeleteDirectDrawObject
NtGdiDdDestroyD3DBuffer
NtGdiDdDestroyFullscreenSprite
NtGdiDdDestroyMoComp
NtGdiDdEndMoCompFrame
NtGdiDdFlip
NtGdiDdFlipToGDISurface
NtGdiDdGetAvailDriverMemory
NtGdiDdGetBltStatus
NtGdiDdGetDC
NtGdiDdGetDriverInfo
NtGdiDdGetDriverState
NtGdiDdGetDxHandle
NtGdiDdGetFlipStatus
NtGdiDdGetInternalMoCompInfo
NtGdiDdGetMoCompBuffInfo
NtGdiDdGetMoCompFormats
NtGdiDdGetMoCompGuids
NtGdiDdGetScanLine
NtGdiDdLock
NtGdiDdNotifyFullscreenSpriteUpdate
NtGdiDdQueryDirectDrawObject
NtGdiDdQueryMoCompStatus
NtGdiDdQueryVisRgnUniqueness
NtGdiDdReenableDirectDrawObject
NtGdiDdReleaseDC
NtGdiDdRenderMoComp
NtGdiDdSetColorKey
NtGdiDdSetExclusiveMode
NtGdiDdSetGammaRamp
NtGdiDdSetOverlayPosition
NtGdiDdUnattachSurface
NtGdiDdUnlock
NtGdiDdUpdateOverlay
NtGdiDdWaitForVerticalBlank
NtGdiDeleteColorTransform
NtGdiDescribePixelFormat
NtGdiDestroyOPMProtectedOutput
NtGdiDestroyPhysicalMonitor
NtGdiDoBanding
NtGdiDrawEscape
NtGdiDvpAcquireNotification
NtGdiDvpCanCreateVideoPort
NtGdiDvpColorControl
NtGdiDvpCreateVideoPort
NtGdiDvpDestroyVideoPort
NtGdiDvpFlipVideoPort
NtGdiDvpGetVideoPortBandwidth
NtGdiDvpGetVideoPortConnectInfo
NtGdiDvpGetVideoPortField
NtGdiDvpGetVideoPortFlipStatus
NtGdiDvpGetVideoPortInputFormats
NtGdiDvpGetVideoPortLine
NtGdiDvpGetVideoPortOutputFormats
NtGdiDvpGetVideoSignalStatus
NtGdiDvpReleaseNotification
NtGdiDvpUpdateVideoPort
NtGdiDvpWaitForVideoPortSync
NtGdiDwmCreatedBitmapRemotingOutput
NtGdiDxgGenericThunk
NtGdiEllipse
NtGdiEnableEudc
NtGdiEndDoc
NtGdiEndGdiRendering
NtGdiEndPage
NtGdiEngAlphaBlend
NtGdiEngAssociateSurface
NtGdiEngBitBlt
NtGdiEngCheckAbort
NtGdiEngComputeGlyphSet
NtGdiEngCopyBits
NtGdiEngCreateBitmap
NtGdiEngCreateClip
NtGdiEngCreateDeviceBitmap
NtGdiEngCreateDeviceSurface
NtGdiEngCreatePalette
NtGdiEngDeleteClip
NtGdiEngDeletePalette
NtGdiEngDeletePath
NtGdiEngDeleteSurface
NtGdiEngEraseSurface
NtGdiEngFillPath
NtGdiEngGradientFill
NtGdiEngLineTo
NtGdiEngLockSurface
NtGdiEngMarkBandingSurface
NtGdiEngPaint
NtGdiEngPlgBlt
NtGdiEngStretchBlt
NtGdiEngStretchBltROP
NtGdiEngStrokeAndFillPath
NtGdiEngStrokePath
NtGdiEngTextOut
NtGdiEngTransparentBlt
NtGdiEngUnlockSurface
NtGdiEnumFonts
NtGdiEnumObjects
NtGdiEudcLoadUnloadLink
NtGdiExtFloodFill
NtGdiFONTOBJ_cGetAllGlyphHandles
NtGdiFONTOBJ_cGetGlyphs
NtGdiFONTOBJ_pQueryGlyphAttrs
NtGdiFONTOBJ_pfdg
NtGdiFONTOBJ_pifi
NtGdiFONTOBJ_pvTrueTypeFontFile
NtGdiFONTOBJ_pxoGetXform
NtGdiFONTOBJ_vGetInfo
NtGdiFlattenPath
NtGdiFontIsLinked
NtGdiForceUFIMapping
NtGdiFrameRgn
NtGdiFullscreenControl
NtGdiGetBoundsRect
NtGdiGetCOPPCompatibleOPMInformation
NtGdiGetCertificate
NtGdiGetCertificateByHandle
NtGdiGetCertificateSize
NtGdiGetCertificateSizeByHandle
NtGdiGetCharABCWidthsW
NtGdiGetCharacterPlacementW
NtGdiGetColorAdjustment
NtGdiGetColorSpaceforBitmap
NtGdiGetCurrentDpiInfo
NtGdiGetDeviceCaps
NtGdiGetDeviceCapsAll
NtGdiGetDeviceGammaRamp
NtGdiGetDeviceWidth
NtGdiGetDhpdev
NtGdiGetETM
NtGdiGetEmbUFI
NtGdiGetEmbedFonts
NtGdiGetEntry
NtGdiGetEudcTimeStampEx
NtGdiGetFontFileData
NtGdiGetFontFileInfo
NtGdiGetFontResourceInfoInternalW
NtGdiGetFontUnicodeRanges
NtGdiGetGlyphIndicesW
NtGdiGetGlyphIndicesWInternal
NtGdiGetGlyphOutline
NtGdiGetKerningPairs
NtGdiGetLinkedUFIs
NtGdiGetMiterLimit
NtGdiGetMonitorID
NtGdiGetNumberOfPhysicalMonitors
NtGdiGetOPMInformation
NtGdiGetOPMRandomNumber
NtGdiGetObjectBitmapHandle
NtGdiGetPath
NtGdiGetPerBandInfo
NtGdiGetPhysicalMonitorDescription
NtGdiGetPhysicalMonitors
NtGdiGetProcessSessionFonts
NtGdiGetPublicFontTableChangeCookie
NtGdiGetRealizationInfo
NtGdiGetServerMetaFileBits
NtGdiGetSpoolMessage
NtGdiGetStats
NtGdiGetStringBitmapW
NtGdiGetSuggestedOPMProtectedOutputArraySize
NtGdiGetTextExtentExW
NtGdiGetUFI
NtGdiGetUFIPathname
NtGdiGradientFill
NtGdiHLSurfGetInformation
NtGdiHLSurfSetInformation
NtGdiHT_Get8BPPFormatPalette
NtGdiHT_Get8BPPMaskPalette
NtGdiIcmBrushInfo
NtGdiInit
NtGdiInitSpool
NtGdiMakeFontDir
NtGdiMakeInfoDC
NtGdiMakeObjectUnXferable
NtGdiMakeObjectXferable
NtGdiMirrorWindowOrg
NtGdiMonoBitmap
NtGdiMoveTo
NtGdiOffsetClipRgn
NtGdiPATHOBJ_bEnum
NtGdiPATHOBJ_bEnumClipLines
NtGdiPATHOBJ_vEnumStart
NtGdiPATHOBJ_vEnumStartClipLines
NtGdiPATHOBJ_vGetBounds
NtGdiPathToRegion
NtGdiPlgBlt
NtGdiPolyDraw
NtGdiPolyTextOutW
NtGdiPtInRegion
NtGdiPtVisible
NtGdiQueryFonts
NtGdiRemoveFontResourceW
NtGdiRemoveMergeFont
NtGdiResetDC
NtGdiResizePalette
NtGdiRoundRect
NtGdiSTROBJ_bEnum
NtGdiSTROBJ_bEnumPositionsOnly
NtGdiSTROBJ_bGetAdvanceWidths
NtGdiSTROBJ_dwGetCodePage
NtGdiSTROBJ_vEnumStart
NtGdiScaleViewportExtEx
NtGdiScaleWindowExtEx
NtGdiSelectBrush
NtGdiSelectClipPath
NtGdiSelectPen
NtGdiSetBitmapAttributes
NtGdiSetBrushAttributes
NtGdiSetColorAdjustment
NtGdiSetColorSpace
NtGdiSetDeviceGammaRamp
NtGdiSetFontXform
NtGdiSetIcmMode
NtGdiSetLinkedUFIs
NtGdiSetMagicColors
NtGdiSetOPMSigningKeyAndSequenceNumbers
NtGdiSetPUMPDOBJ
NtGdiSetPixelFormat
NtGdiSetRectRgn
NtGdiSetSizeDevice
NtGdiSetSystemPaletteUse
NtGdiSetTextJustification
NtGdiSetUMPDSandboxState
NtGdiStartDoc
NtGdiStartPage
NtGdiStrokeAndFillPath
NtGdiStrokePath
NtGdiSwapBuffers
NtGdiTransparentBlt
NtGdiUMPDEngFreeUserMem
NtGdiUnloadPrinterDriver
NtGdiUnmapMemFont
NtGdiUpdateColors
NtGdiUpdateTransform
NtGdiWidenPath
NtGdiXFORMOBJ_bApplyXform
NtGdiXFORMOBJ_iGetXform
NtGdiXLATEOBJ_cGetPalette
NtGdiXLATEOBJ_hGetColorTransform
NtGdiXLATEOBJ_iXlate
NtHWCursorUpdatePointer
NtNotifyPresentToCompositionSurface
NtOpenCompositionSurfaceDirtyRegion
NtOpenCompositionSurfaceSectionInfo
NtOpenCompositionSurfaceSwapChainHandleInfo
NtQueryCompositionInputIsImplicit
NtQueryCompositionInputQueueAndTransform
NtQueryCompositionInputSink
NtQueryCompositionInputSinkLuid
NtQueryCompositionInputSinkViewId
NtQueryCompositionSurfaceBinding
NtQueryCompositionSurfaceHDRMetaData
NtQueryCompositionSurfaceRenderingRealization
NtQueryCompositionSurfaceStatistics
NtRIMAddInputObserver
NtRIMAreSiblingDevices
NtRIMDeviceIoControl
NtRIMFreeInputBuffer
NtRIMGetDevicePreparsedData
NtRIMGetDevicePreparsedDataLockfree
NtRIMGetDeviceProperties
NtRIMGetPhysicalDeviceRect
NtRIMGetSourceProcessId
NtRIMObserveNextInput
NtRIMOnPnpNotification
NtRIMOnTimerNotification
NtRIMReadInput
NtRIMRegisterForInput
NtRIMRemoveInputObserver
NtRIMSetTestModeStatus
NtRIMUnregisterForInput
NtRIMUpdateInputObserverRegistration
NtSetCompositionSurfaceAnalogExclusive
NtSetCompositionSurfaceBufferCompositionModeAndOrientation
NtSetCompositionSurfaceDirectFlipState
NtSetCompositionSurfaceHDRMetaData
NtSetCompositionSurfaceIndependentFlipInfo
NtSetCompositionSurfaceStatistics
NtTokenManagerConfirmOutstandingAnalogToken
NtTokenManagerCreateCompositionTokenHandle
NtTokenManagerGetAnalogExclusiveSurfaceUpdates
NtTokenManagerGetAnalogExclusiveTokenEvent
NtTokenManagerOpenSectionAndEvents
NtTokenManagerThread
NtUnBindCompositionSurface
NtUpdateInputSinkTransforms
NtUserAcquireIAMKey
NtUserAcquireInteractiveControlBackgroundAccess
NtUserAddClipboardFormatListener
NtUserAssociateInputContext
NtUserAutoPromoteMouseInPointer
NtUserAutoRotateScreen
NtUserBeginInkFeedbackSession
NtUserBlockInput
NtUserBroadcastThemeChangeEvent
NtUserBuildHimcList
NtUserBuildPropList
NtUserCalculatePopupWindowPosition
NtUserCallHwndOpt
NtUserCanBrokerForceForeground
NtUserChangeDisplaySettings
NtUserChangeWindowMessageFilterEx
NtUserCheckAccessForIntegrityLevel
NtUserCheckProcessForClipboardAccess
NtUserCheckProcessSession
NtUserCheckWindowThreadDesktop
NtUserChildWindowFromPointEx
NtUserClearForeground
NtUserClipCursor
NtUserCompositionInputSinkLuidFromPoint
NtUserCompositionInputSinkViewInstanceIdFromPoint
NtUserCreateDCompositionHwndTarget
NtUserCreateDesktopEx
NtUserCreateInputContext
NtUserCreateWindowStation
NtUserCtxDisplayIOCtl
NtUserDeferWindowPosAndBand
NtUserDelegateCapturePointers
NtUserDelegateInput
NtUserDestroyDCompositionHwndTarget
NtUserDestroyInputContext
NtUserDisableImmersiveOwner
NtUserDisableProcessWindowFiltering
NtUserDisableThreadIme
NtUserDiscardPointerFrameMessages
NtUserDisplayConfigGetDeviceInfo
NtUserDisplayConfigSetDeviceInfo
NtUserDoSoundConnect
NtUserDoSoundDisconnect
NtUserDragDetect
NtUserDragObject
NtUserDrawAnimatedRects
NtUserDrawCaption
NtUserDrawCaptionTemp
NtUserDrawMenuBarTemp
NtUserDwmGetRemoteSessionOcclusionEvent
NtUserDwmGetRemoteSessionOcclusionState
NtUserDwmKernelShutdown
NtUserDwmKernelStartup
NtUserDwmValidateWindow
NtUserEnableChildWindowDpiMessage
NtUserEnableIAMAccess
NtUserEnableMouseInPointer
NtUserEnableMouseInputForCursorSuppression
NtUserEnableNonClientDpiScaling
NtUserEnableTouchPad
NtUserEndInkFeedbackSession
NtUserEndMenu
NtUserEvent
NtUserFlashWindowEx
NtUserFrostCrashedWindow
NtUserGetAppImeLevel
NtUserGetAutoRotationState
NtUserGetCIMSSM
NtUserGetCaretPos
NtUserGetClipCursor
NtUserGetClipboardAccessToken
NtUserGetClipboardViewer
NtUserGetComboBoxInfo
NtUserGetCurrentInputMessageSource
NtUserGetCursorDims
NtUserGetCursorInfo
NtUserGetDManipHookInitFunction
NtUserGetDesktopID
NtUserGetDisplayAutoRotationPreferences
NtUserGetDisplayAutoRotationPreferencesByProcessId
NtUserGetDisplayConfigBufferSizes
NtUserGetDpiForMonitor
NtUserGetGestureConfig
NtUserGetGestureExtArgs
NtUserGetGestureInfo
NtUserGetGuiResources
NtUserGetHimetricScaleFactorFromPixelLocation
NtUserGetImeHotKey
NtUserGetImeInfoEx
NtUserGetInputLocaleInfo
NtUserGetInteractiveControlDeviceInfo
NtUserGetInteractiveControlInfo
NtUserGetInteractiveCtrlSupportedWaveforms
NtUserGetInternalWindowPos
NtUserGetKeyNameText
NtUserGetKeyboardLayoutName
NtUserGetLayeredWindowAttributes
NtUserGetListBoxInfo
NtUserGetMenuIndex
NtUserGetMenuItemRect
NtUserGetMouseMovePointsEx
NtUserGetPhysicalDeviceRect
NtUserGetPointerCursorId
NtUserGetPointerDevice
NtUserGetPointerDeviceCursors
NtUserGetPointerDeviceProperties
NtUserGetPointerDeviceRects
NtUserGetPointerDevices
NtUserGetPointerFrameArrivalTimes
NtUserGetPointerInfoList
NtUserGetPointerInputTransform
NtUserGetPointerType
NtUserGetPrecisionTouchPadConfiguration
NtUserGetPriorityClipboardFormat
NtUserGetProcessDpiAwarenessContext
NtUserGetProcessUIContextInformation
NtUserGetQueueStatusReadonly
NtUserGetRawInputBuffer
NtUserGetRawInputData
NtUserGetRawInputDeviceInfo
NtUserGetRawInputDeviceList
NtUserGetRawPointerDeviceData
NtUserGetRegisteredRawInputDevices
NtUserGetTopLevelWindow
NtUserGetTouchInputInfo
NtUserGetTouchValidationStatus
NtUserGetUpdatedClipboardFormats
NtUserGetWOWClass
NtUserGetWindowBand
NtUserGetWindowCompositionAttribute
NtUserGetWindowCompositionInfo
NtUserGetWindowDisplayAffinity
NtUserGetWindowFeedbackSetting
NtUserGetWindowMinimizeRect
NtUserGetWindowRgnEx
NtUserGhostWindowFromHungWindow
NtUserHandleDelegatedInput
NtUserHardErrorControl
NtUserHidePointerContactVisualization
NtUserHiliteMenuItem
NtUserHungWindowFromGhostWindow
NtUserHwndQueryRedirectionInfo
NtUserHwndSetRedirectionInfo
NtUserImpersonateDdeClientWindow
NtUserInheritWindowMonitor
NtUserInitTask
NtUserInitialize
NtUserInitializeClientPfnArrays
NtUserInitializeInputDeviceInjection
NtUserInitializePointerDeviceInjection
NtUserInitializePointerDeviceInjectionEx
NtUserInitializeTouchInjection
NtUserInjectDeviceInput
NtUserInjectGesture
NtUserInjectKeyboardInput
NtUserInjectMouseInput
NtUserInjectPointerInput
NtUserInjectTouchInput
NtUserInteractiveControlQueryUsage
NtUserInternalClipCursor
NtUserInternalGetWindowIcon
NtUserIsChildWindowDpiMessageEnabled
NtUserIsMouseInPointerEnabled
NtUserIsMouseInputEnabled
NtUserIsNonClientDpiScalingEnabled
NtUserIsTopLevelWindow
NtUserIsTouchWindow
NtUserIsWindowBroadcastingDpiToChildren
NtUserLayoutCompleted
NtUserLinkDpiCursor
NtUserLoadKeyboardLayoutEx
NtUserLockWindowStation
NtUserLockWorkStation
NtUserLogicalToPerMonitorDPIPhysicalPoint
NtUserLogicalToPhysicalPoint
NtUserMNDragLeave
NtUserMNDragOver
NtUserMagControl
NtUserMagGetContextInformation
NtUserMagSetContextInformation
NtUserMenuItemFromPoint
NtUserMinMaximize
NtUserModifyWindowTouchCapability
NtUserNavigateFocus
NtUserNotifyIMEStatus
NtUserOpenInputDesktop
NtUserOpenThreadDesktop
NtUserPaintMonitor
NtUserPerMonitorDPIPhysicalToLogicalPoint
NtUserPhysicalToLogicalPoint
NtUserPrintWindow
NtUserPromoteMouseInPointer
NtUserPromotePointer
NtUserQueryBSDRWindow
NtUserQueryDisplayConfig
NtUserQueryInformationThread
NtUserQueryInputContext
NtUserQuerySendMessage
NtUserRealChildWindowFromPoint
NtUserRealWaitMessageEx
NtUserRegisterBSDRWindow
NtUserRegisterDManipHook
NtUserRegisterEdgy
NtUserRegisterErrorReportingDialog
NtUserRegisterHotKey
NtUserRegisterManipulationThread
NtUserRegisterPointerDeviceNotifications
NtUserRegisterPointerInputTarget
NtUserRegisterRawInputDevices
NtUserRegisterServicesProcess
NtUserRegisterSessionPort
NtUserRegisterShellPTPListener
NtUserRegisterTasklist
NtUserRegisterTouchHitTestingWindow
NtUserRegisterTouchPadCapable
NtUserRegisterUserApiHook
NtUserReleaseDwmHitTestWaiters
NtUserRemoteConnect
NtUserRemoteRedrawRectangle
NtUserRemoteRedrawScreen
NtUserRemoteStopScreenUpdates
NtUserRemoveClipboardFormatListener
NtUserRemoveInjectionDevice
NtUserReportInertia
NtUserResolveDesktopForWOW
NtUserSendEventMessage
NtUserSendInkFeedbackPayload
NtUserSendInteractiveControlHapticsReport
NtUserSetActivationFilter
NtUserSetActiveProcessForMonitor
NtUserSetAppImeLevel
NtUserSetAutoRotation
NtUserSetBrokeredForeground
NtUserSetCalibrationData
NtUserSetChildWindowNoActivate
NtUserSetClassWord
NtUserSetCoreWindow
NtUserSetCoreWindowPartner
NtUserSetCursorContents
NtUserSetDisplayAutoRotationPreferences
NtUserSetDisplayConfig
NtUserSetDisplayMapping
NtUserSetFallbackForeground
NtUserSetFeatureReportResponse
NtUserSetGestureConfig
NtUserSetImeHotKey
NtUserSetImeInfoEx
NtUserSetImeOwnerWindow
NtUserSetInteractiveControlFocus
NtUserSetInteractiveCtrlRotationAngle
NtUserSetInternalWindowPos
NtUserSetLayeredWindowAttributes
NtUserSetManipulationInputTarget
NtUserSetMenu
NtUserSetMenuContextHelpId
NtUserSetMenuFlagRtoL
NtUserSetMirrorRendering
NtUserSetObjectInformation
NtUserSetPrecisionTouchPadConfiguration
NtUserSetProcessDpiAwarenessContext
NtUserSetProcessInteractionFlags
NtUserSetProcessRestrictionExemption
NtUserSetProcessUIAccessZorder
NtUserSetShellWindowEx
NtUserSetSysColors
NtUserSetSystemCursor
NtUserSetSystemTimer
NtUserSetThreadInputBlocked
NtUserSetThreadLayoutHandles
NtUserSetWindowArrangement
NtUserSetWindowBand
NtUserSetWindowCompositionAttribute
NtUserSetWindowCompositionTransition
NtUserSetWindowDisplayAffinity
NtUserSetWindowFeedbackSetting
NtUserSetWindowRgnEx
NtUserSetWindowShowState
NtUserSetWindowStationUser
NtUserShowSystemCursor
NtUserShutdownBlockReasonCreate
NtUserShutdownBlockReasonQuery
NtUserShutdownReasonDestroy
NtUserSignalRedirectionStartComplete
NtUserSlicerControl
NtUserSoundSentry
NtUserSwitchDesktop
NtUserSystemParametersInfoForDpi
NtUserTestForInteractiveUser
NtUserTrackPopupMenuEx
NtUserTransformPoint
NtUserTransformRect
NtUserUndelegateInput
NtUserUnloadKeyboardLayout
NtUserUnlockWindowStation
NtUserUnregisterHotKey
NtUserUnregisterSessionPort
NtUserUnregisterUserApiHook
NtUserUpdateDefaultDesktopThumbnail
NtUserUpdateInputContext
NtUserUpdateInstance
NtUserUpdateLayeredWindow
NtUserUpdatePerUserSystemParameters
NtUserUpdateWindowInputSinkHints
NtUserUpdateWindowTrackingInfo
NtUserUserHandleGrantAccess
NtUserValidateHandleSecure
NtUserWaitAvailableMessageEx
NtUserWaitForInputIdle
NtUserWaitForMsgAndEvent
NtUserWaitForRedirectionStartComplete
NtUserWindowFromPhysicalPoint
NtValidateCompositionSurfaceHandle
NtVisualCaptureBits
NtUserSetClassLongPtr
NtUserSetWindowLongPtr

↧

simple wnf id decoder

October 4, 2016, 8:43 am

≫ Next: another cross-process scan

≪ Previous: W32pServiceTable from windows 10 build 14931 x64

extern"C"int__stdcall check_id(PDWORD);
extern"C"int__stdcall get_wnf_value(PDWORD);

int_tmain(int argc, _TCHAR* argv[])
{
if ( argc ==3 )
  {
wchar_t*end;
    DWORD ids[2];
    ids[0] = wcstoul(argv[1], &end, 16);
    ids[1] = wcstoul(argv[2], &end, 16);
int whut = check_id(ids);
if ( whut )
      printf("invalid pair\n");
else
      printf("id1 %X id2 %X index %d\n", ids[0] ^0xA3BC0074, ids[1] ^0x41C64E6D, get_wnf_value(ids) );
  }

return0;

the main part of code is functions check_id & get_wnf_value. I am too lazy so just ripped piece of code from ntoskrnl.exe!ExpCaptureWnfStateName function:

    BITS 32
    global _check_id@4
    global _get_wnf_value@4

; code was ripped from kernel ExpCaptureWnfStateName
; no stack frame !
; return 0 if all ok
_check_id@4:
        mov     ecx, [esp + 4]
    mov     eax, [ecx]      ; id1
    mov     ecx, [ecx+4]    ; id2
    xor     eax, 0xA3BC0074
    xor     ecx, 0x41C64E6D
    push    esi
    mov     esi, eax
    and     eax, 0xF
    push    edi
    mov     edi, ecx
    cmp     eax, 1
    jnz     short .bad_id
    mov     ecx, esi
    mov     eax, edi
    shrd    ecx, eax, 6
    mov     edx, esi
    shr     eax, 6
    and     ecx, 0xF
    mov     eax, edi
    shrd    esi, edi, 4
    shrd    edx, eax, 0xA
    and     esi, 3
    shr     edi, 4
    shr     eax, 0xA
    and     edx, 1
    cmp     esi, 3
    ja      short .bad_id
    cmp     ecx, 4
    ja      short .bad_id
    test    edx, edx
    jnz     short .loc_70387F
.loc_703877:   
    xor     eax, eax
.loc_703879:
    pop     edi
    pop     esi
    retn 4
.bad_id:
    mov eax, 1
    jmp     short .loc_703879
.loc_70387F:
    test    ecx, ecx
    jz      short .loc_703877
    jmp     .loc_7EF37B
.loc_7EF37B:
    cmp     ecx, 2
    jz      .loc_703877
    cmp     ecx, 4
    jnz     .bad_id
    jmp     .loc_703877
   

; return value
_get_wnf_value@4:
    mov     ecx, [esp + 4]
    mov     eax, [ecx]      ; id1
    mov     ecx, [ecx+4]    ; id2
    xor     eax, 0xA3BC0074
    xor     ecx, 0x41C64E6D
    push    esi
    mov     esi, eax
    and     eax, 0xF
    push    edi
    mov     edi, ecx
    cmp     eax, 1
    jnz     short .bad_id
    mov     ecx, esi
    mov     eax, edi
    shrd    ecx, eax, 6
    mov     edx, esi
    shr     eax, 6
    and     ecx, 0xF
    mov     eax, edi
    shrd    esi, edi, 4
    shrd    edx, eax, 0xA
    and     esi, 3
    shr     edi, 4
    shr     eax, 0xA
    and     edx, 1
    cmp     esi, 3
    ja      short .bad_id
    cmp     ecx, 4
    ja      short .bad_id
    test    edx, edx
    jnz     short .loc_70387F
.loc_703877:   
    mov     eax, ecx
.loc_703879:
    pop     edi
    pop     esi
    retn 4
.bad_id:
    xor     eax, eax
    jmp     short .loc_703879
.loc_70387F:
    test    ecx, ecx
    jz      short .loc_703877
    jmp     .loc_7EF37B
.loc_7EF37B:
    cmp     ecx, 2
    jz      .loc_703877
    cmp     ecx, 4
    jnz     .bad_id
    jmp     .loc_703877

Sample of using:

wnf_decode A3BC0835 F840539

id1 841 id2 4E424B54 index 1

↧

another cross-process scan

October 10, 2016, 10:18 am

≫ Next: rfg patches in windows 10 build 14942

≪ Previous: simple wnf id decoder

you can use EPROCESS.WnfContext to find list of processes. Lets see how this can be done:

kd> ? nt!ExpWnfProcessesListHead
Evaluate expression: -8781752063864 = fffff803`56c9a888
kd> dp fffff803`56c9a888
fffff803`56c9a888  fffff8a0`00125750 fffff8a0`021fb760
fffff803`56c9a898  00000000`00840082 fffff803`56a43460
fffff803`56c9a8a8  00000000`00120010 fffff803`56a43448
fffff803`56c9a8b8  00000000`00000060 00000000`00000058
fffff803`56c9a8c8  fffff803`56693df0 fffff803`56693dd8
fffff803`56c9a8d8  00000000`00760074 fffff803`56a41cd0
fffff803`56c9a8e8  00000000`00240022 fffff803`56a416c0
fffff803`56c9a8f8  00000000`00140012 fffff803`56a416a8
kd> !pool fffff8a0`00125750 2
Pool page fffff8a000125750 region is Paged pool
*fffff8a000125730 size:   f0 previous size:   90  (Allocated) *Wnf 
        Pooltag Wnf  : Windows Notification Facility, Binary : nt!wnf
kd> dp fffff8a0`00125740
fffff8a0`00125740  00000000`00d80906fffffa80`018a46c0
fffff8a0`00125750  fffff8a0`0010b9e0 fffff803`56c9a888
fffff8a0`00125760  00000000`00000000 00000000`00000000
fffff8a0`00125770  00000000`00000000 00000000`00000000
fffff8a0`00125780  fffff8a0`020c5a50 fffff8a0`00f03690
fffff8a0`00125790  00000000`00000000 fffff8a0`00129028
fffff8a0`001257a0  fffff8a0`015ee5c8 00000000`00000000
fffff8a0`001257b0  fffff8a0`001257b0 fffff8a0`001257b0
kd> !process fffffa80`018a46c0 0
PROCESS fffffa80018a46c0
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 00187000  ObjectTable: fffff8a000003000  HandleCount: 
    Image: System

kd> dp fffff8a0`0010b9d0
fffff8a0`0010b9d0  00000000`00d80906fffffa80`038b4940
fffff8a0`0010b9e0  fffff8a0`058ed020 fffff8a0`00125750
fffff8a0`0010b9f0  fffff8a0`00117f40 00000000`00000000
fffff8a0`0010ba00  00000000`00000000 00000000`00000000
fffff8a0`0010ba10  fffff8a0`0010ba10 fffff8a0`0010ba10
fffff8a0`0010ba20  00000000`00000000 fffff8a0`0010b938
fffff8a0`0010ba30  fffff8a0`0587f968 00000000`00000000
fffff8a0`0010ba40  fffff8a0`0010ba40 fffff8a0`0010ba40
kd> !process fffffa80`038b4940 0
PROCESS fffffa80038b4940
    SessionId: 0  Cid: 0148    Peb: 7f630624000  ParentCid: 0140
    DirBase: 10feb000  ObjectTable: fffff8a000555cc0  HandleCount: 
    Image: csrss.exe

WnfContext created in function ExpWnfCreateProcessContext and looks like:

struct _wnf_ctx_internal
{
  PVOID sign; /* 880906/

d80906 for x64 */
  PEPROCESS proc;
  LIST_ENTRY Entry;
};

so it`s easy to iterate over list of WnfContexts where head of list stored in nt!ExpWnfProcessesListHead

↧

rfg patches in windows 10 build 14942

October 19, 2016, 6:28 am

≫ Next: how to find nt!KeServiceDescriptorTableFilter

≪ Previous: another cross-process scan

Lets see for example body of function user32!GetCursor:

.text:00000001800026E0             GetCursor       proc near          .text:00000001800026E0 66 90                   xchg    ax, ax
.text:00000001800026E2 0F 1F 80 00 00 00 00    nop     dword ptr [rax+00000000h]
.text:00000001800026E9 B9 06 00 00 00          mov     ecx, 6
.text:00000001800026EE 48 FF 25 EB 76 09 00    jmp cs:__imp_NtUserGetThreadState
.text:00000001800026EE                         GetCursor       endp
.text:00000001800026F5 90 90 90 90 90 90 90 90                 db 8 dup(90h)

and in debugger:

0:007> ? user32!GetCursor
Evaluate expression: 140732937348832 = 00007ffe`f0bd26e0
0:007> u 00007ffe`f0bd26e0
USER32!GetCursor:
00007ffe`f0bd26e0 488b0424        mov     rax,qword ptr [rsp]
00007ffe`f0bd26e4 6448890424      mov     qword ptr fs:[rsp],rax
00007ffe`f0bd26e9 b906000000      mov     ecx,6
00007ffe`f0bd26ee 644c8b1c24      mov     r11,qword ptr fs:[rsp]
00007ffe`f0bd26f3 4c3b1c24        cmp     r11,qword ptr [rsp]
00007ffe`f0bd26f7 0f85a3e40300    jne     USER32!_guard_ss_verify_failure (00007ffe`f0c10ba0)
00007ffe`f0bd26fd 48ff25dc760900  jmp     qword ptr [USER32!_imp_NtUserGetThreadState (00007ffe`f0c69de0)]

dramatic differences ! it seems that this code has some compiler support and changes in kernel
Signature search in kernel gives us several places:

.rdata:0000000140261680 MiRfgNopPrologueBytes db  66h .rdata:0000000140261681                 db  90h ; Р
.rdata:0000000140261682                 db  0Fh
.rdata:0000000140261683                 db  1Fh
.rdata:0000000140261684                 db  80h ; А

...

.rdata:0000000140261690 MiRfgInstrumentedEpilogueBytes db  64h .rdata:0000000140261691                 db  4Ch ; L
.rdata:0000000140261692                 db  8Bh ; Л
.rdata:0000000140261693                 db  1Ch
.rdata:0000000140261694                 db  24h ; $
.rdata:0000000140261695                 db  4Ch ; L
.rdata:0000000140261696                 db  3Bh ; ;
.rdata:0000000140261697                 db  1Ch
.rdata:0000000140261698 unk_140261698   db  24h ; $ .rdata:0000000140261699                 db  0Fh
.rdata:000000014026169A                 db  85h ; Е

...

.rdata:00000001402616A0 MiRfgInstrumentedPrologueBytes db  48h ; H
.rdata:00000001402616A1                 db  8Bh ; Л
.rdata:00000001402616A2                 db    4
.rdata:00000001402616A3                 db  24h ; $
.rdata:00000001402616A4                 db  64h ; d
.rdata:00000001402616A5                 db  48h ; H
.rdata:00000001402616A6                 db  89h ; Й
.rdata:00000001402616A7                 db    4
.rdata:00000001402616A8                 db  24h ; $

all references from function MiPerformRfgFixups. Time to debugger:

kd> ? nt!MiRevertRfgFixups
Evaluate expression: -8783434753244 = fffff802`f27ddb24
kd> bp fffff802`f27ddb24
kd> k
 # Child-SP          RetAddr           Call Site
00 ffff8181`75c5a5d8 fffff802`f2854e8b nt!MiRevertRfgFixups
01 ffff8181`75c5a5e0 fffff802`f2890047 nt!MiValidateSectionCreate+0x423
02 ffff8181`75c5a7a0 fffff802`f288f6dc nt!MiCreateSection+0x927
03 ffff8181`75c5a970 fffff802`f288f4f8 nt!MmCreateSection+0xec
04 ffff8181`75c5aa00 fffff802`f257e093 nt!NtCreateSection+0x158
05 ffff8181`75c5aa90 00007ffe`f0f56cf4 nt!KiSystemServiceCopyEnd+0x13
06 00000047`d267b6a8 00007ffe`f0ef76ad 0x00007ffe`f0f56cf4
07 00000047`d267b6b0 0000021d`3ec4e7a0 0x00007ffe`f0ef76ad
08 00000047`d267b6b8 00000047`d267bca0 0x0000021d`3ec4e7a0
09 00000047`d267b6c0 00000000`00000000 0x00000047`d267bca0

Also we have MmEnableRfg kernel option in Session Manager\\Kernel with value name EnableRfg

List of patched modules:
C:\Program Files\Windows Defender\MpCommu.dll
C:\Program Files\Windows Defender\mpclient.dll
C:\Program Files\Windows Defender\shellext.dll
C:\Windows\SYSTEM32\Bcp47Langs.dll
C:\Windows\SYSTEM32\CRYPTBASE.dll
C:\Windows\SYSTEM32\CRYPTSP.dll
C:\Windows\SYSTEM32\CSRSRV.dll
C:\Windows\SYSTEM32\CSystemEventsBrokerClient.dll
C:\Windows\SYSTEM32\Cabinet.dll
C:\Windows\SYSTEM32\ConhostV2.dll
C:\Windows\SYSTEM32\DABAPI.dll
C:\Windows\SYSTEM32\DEVOBJ.dll
C:\Windows\SYSTEM32\DEVRTL.dll
C:\Windows\SYSTEM32\DNSAPI.dll
C:\Windows\SYSTEM32\DWrite.dll
C:\Windows\SYSTEM32\EdgeManager.dll
C:\Windows\SYSTEM32\EventAggregation.dll
C:\Windows\SYSTEM32\Fwpuclnt.dll
C:\Windows\SYSTEM32\JoinUtil.dll
C:\Windows\SYSTEM32\LINKINFO.dll
C:\Windows\SYSTEM32\MLANG.dll
C:\Windows\SYSTEM32\MPR.dll
C:\Windows\SYSTEM32\MicrosoftAccountCloudAP.dll
C:\Windows\SYSTEM32\MrmCoreR.dll
C:\Windows\SYSTEM32\NETAPI32.dll
C:\Windows\SYSTEM32\NInput.dll
C:\Windows\SYSTEM32\NTASN1.dll
C:\Windows\SYSTEM32\Netapi32.dll
C:\Windows\SYSTEM32\OLEACC.dll
C:\Windows\SYSTEM32\PROPSYS.dll
C:\Windows\SYSTEM32\PhotoMetadataHandler.dll
C:\Windows\SYSTEM32\PortableDeviceApi.dll
C:\Windows\SYSTEM32\QuickActionsDataModel.dll
C:\Windows\SYSTEM32\SLC.dll
C:\Windows\SYSTEM32\Secur32.dll
C:\Windows\SYSTEM32\SpeechPal.dll
C:\Windows\SYSTEM32\SspiCli.dll
C:\Windows\SYSTEM32\SspiSrv.dll
C:\Windows\SYSTEM32\StateRepository.Core.dll
C:\Windows\SYSTEM32\TWINAPI.dll
C:\Windows\SYSTEM32\TextInputFramework.dll
C:\Windows\SYSTEM32\USERENV.dll
C:\Windows\SYSTEM32\UserDataTypeHelperUtil.dll
C:\Windows\SYSTEM32\UxTheme.dll
C:\Windows\SYSTEM32\VEEventDispatcher.dll
C:\Windows\SYSTEM32\VERSION.dll
C:\Windows\SYSTEM32\WINBRAND.dll
C:\Windows\SYSTEM32\WINHTTP.dll
C:\Windows\SYSTEM32\WININET.dll
C:\Windows\SYSTEM32\WINMMBASE.dll
C:\Windows\SYSTEM32\WINSTA.dll
C:\Windows\SYSTEM32\WPTaskScheduler.dll
C:\Windows\SYSTEM32\WSOCK32.dll
C:\Windows\SYSTEM32\WTSAPI32.dll
C:\Windows\SYSTEM32\WUDFPlatform.dll
C:\Windows\SYSTEM32\WindowsCodecs.dll
C:\Windows\SYSTEM32\XmlLite.dll
C:\Windows\SYSTEM32\aepic.dll
C:\Windows\SYSTEM32\apphelp.dll
C:\Windows\SYSTEM32\appinfoext.dll
C:\Windows\SYSTEM32\atlthunk.dll
C:\Windows\SYSTEM32\bcrypt.dll
C:\Windows\SYSTEM32\bi.dll
C:\Windows\SYSTEM32\capauthz.dll
C:\Windows\SYSTEM32\cdp.dll
C:\Windows\SYSTEM32\chakra.dll
C:\Windows\SYSTEM32\clipc.dll
C:\Windows\SYSTEM32\cmintegrator.dll
C:\Windows\SYSTEM32\coreaudiopolicymanagerext.dll
C:\Windows\SYSTEM32\cryptnet.dll
C:\Windows\SYSTEM32\cryptsp.dll
C:\Windows\SYSTEM32\cscapi.dll
C:\Windows\SYSTEM32\d2d1.dll
C:\Windows\SYSTEM32\d3d10warp.dll
C:\Windows\SYSTEM32\d3d11.dll
C:\Windows\SYSTEM32\dcomp.dll
C:\Windows\SYSTEM32\dsreg.dll
C:\Windows\SYSTEM32\dwmapi.dll
C:\Windows\SYSTEM32\dwmghost.dll
C:\Windows\SYSTEM32\dwminit.dll
C:\Windows\SYSTEM32\dwmredir.dll
C:\Windows\SYSTEM32\dwrite.dll
C:\Windows\SYSTEM32\dxgi.dll
C:\Windows\SYSTEM32\edgehtml.dll
C:\Windows\SYSTEM32\edputil.dll
C:\Windows\SYSTEM32\elscore.dll
C:\Windows\SYSTEM32\embeddedmodesvcapi.dll
C:\Windows\SYSTEM32\firewallapi.dll
C:\Windows\SYSTEM32\fontgroupsoverride.dll
C:\Windows\SYSTEM32\fwbase.dll
C:\Windows\SYSTEM32\globcollationhost.dll
C:\Windows\SYSTEM32\globinputhost.dll
C:\Windows\SYSTEM32\gpapi.dll
C:\Windows\SYSTEM32\httpprxc.dll
C:\Windows\SYSTEM32\ieapfltr.dll
C:\Windows\SYSTEM32\iertutil.dll
C:\Windows\SYSTEM32\inputhost.dll
C:\Windows\SYSTEM32\ism.dll
C:\Windows\SYSTEM32\licensemanagerapi.dll
C:\Windows\SYSTEM32\logoncli.dll
C:\Windows\SYSTEM32\mrmcorer.dll
C:\Windows\SYSTEM32\msftedit.dll
C:\Windows\SYSTEM32\mskeyprotect.dll
C:\Windows\SYSTEM32\msvcp110_win.dll
C:\Windows\SYSTEM32\ncrypt.dll
C:\Windows\SYSTEM32\netjoin.dll
C:\Windows\SYSTEM32\netprovfw.dll
C:\Windows\SYSTEM32\netutils.dll
C:\Windows\SYSTEM32\ntmarta.dll
C:\Windows\SYSTEM32\ntshrui.dll
C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
C:\Windows\SYSTEM32\pcacli.dll
C:\Windows\SYSTEM32\policymanager.dll
C:\Windows\SYSTEM32\profext.dll
C:\Windows\SYSTEM32\profsvcext.dll
C:\Windows\SYSTEM32\psmserviceexthost.dll
C:\Windows\SYSTEM32\resourcepolicyclient.dll
C:\Windows\SYSTEM32\resourcepolicyserver.dll
C:\Windows\SYSTEM32\rmclient.dll
C:\Windows\SYSTEM32\samcli.dll
C:\Windows\SYSTEM32\samsrv.dll
C:\Windows\SYSTEM32\scesrv.dll
C:\Windows\SYSTEM32\settingsynccore.dll
C:\Windows\SYSTEM32\settingsyncpolicy.dll
C:\Windows\SYSTEM32\sfc_os.dll
C:\Windows\SYSTEM32\spinf.dll
C:\Windows\SYSTEM32\srpapi.dll
C:\Windows\SYSTEM32\srvcli.dll
C:\Windows\SYSTEM32\sscoreext.dll
C:\Windows\SYSTEM32\sxs.dll
C:\Windows\SYSTEM32\tdh.dll
C:\Windows\SYSTEM32\textinputframework.dll
C:\Windows\SYSTEM32\tokenbinding.dll
C:\Windows\SYSTEM32\twinapi.appcore.dll
C:\Windows\SYSTEM32\udwm.dll
C:\Windows\SYSTEM32\umpoext.dll
C:\Windows\SYSTEM32\urlmon.dll
C:\Windows\SYSTEM32\userenv.dll
C:\Windows\SYSTEM32\usermgrcli.dll
C:\Windows\SYSTEM32\vssapi.dll
C:\Windows\SYSTEM32\wbemcomn.dll
C:\Windows\SYSTEM32\webio.dll
C:\Windows\SYSTEM32\wer.dll
C:\Windows\SYSTEM32\wevtapi.dll
C:\Windows\SYSTEM32\windows.devices.radios.dll
C:\Windows\SYSTEM32\windows.globalization.dll
C:\Windows\SYSTEM32\windows.ui.core.textinput.dll
C:\Windows\SYSTEM32\winhttp.dll
C:\Windows\SYSTEM32\wininitext.dll
C:\Windows\SYSTEM32\winmm.dll
C:\Windows\SYSTEM32\winmmbase.dll
C:\Windows\SYSTEM32\winsta.dll
C:\Windows\SYSTEM32\wintypes.dll
C:\Windows\SYSTEM32\wkscli.dll
C:\Windows\SYSTEM32\wlanapi.dll
C:\Windows\SYSTEM32\wtsapi32.dll
C:\Windows\ShellExperiences\QuickActions.dll
C:\Windows\ShellExperiences\StartUI.dll
C:\Windows\ShellExperiences\Windows.UI.ActionCenter.dll
C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
C:\Windows\System32\ACPBackgroundManagerPolicy.dll
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\APHostClient.dll
C:\Windows\System32\AVRT.dll
C:\Windows\System32\AboveLockAppHost.dll
C:\Windows\System32\AccountAccessor.dll
C:\Windows\System32\ActXPrxy.dll
C:\Windows\System32\Actioncenter.dll
C:\Windows\System32\AppContracts.dll
C:\Windows\System32\AppMon.dll
C:\Windows\System32\AppXDeploymentClient.dll
C:\Windows\System32\ApplicationFrame.dll
C:\Windows\System32\AppointmentActivation.dll
C:\Windows\System32\BackgroundMediaPolicy.dll
C:\Windows\System32\Bcp47Langs.dll
C:\Windows\System32\CEMAPI.dll
C:\Windows\System32\CFGMGR32.dll
C:\Windows\System32\CRYPT32.dll
C:\Windows\System32\CRYPTBASE.dll
C:\Windows\System32\CRYPTSP.dll
C:\Windows\System32\Cabinet.dll
C:\Windows\System32\ClipboardServer.dll
C:\Windows\System32\ContentDeliveryManager.Utilities.dll
C:\Windows\System32\CourtesyEngine.dll
C:\Windows\System32\DDORes.dll
C:\Windows\System32\DEVOBJ.dll
C:\Windows\System32\DEVRTL.dll
C:\Windows\System32\DNSAPI.dll
C:\Windows\System32\DSROLE.dll
C:\Windows\System32\DUser.dll
C:\Windows\System32\DevDispItemProvider.dll
C:\Windows\System32\DevPropMgr.dll
C:\Windows\System32\DeviceDriverRetrievalClient.dll
C:\Windows\System32\DeviceMetadataRetrievalClient.dll
C:\Windows\System32\ESENT.dll
C:\Windows\System32\EhStorAPI.dll
C:\Windows\System32\EhStorShell.dll
C:\Windows\System32\EthernetMediaManager.dll
C:\Windows\System32\EventAggregation.dll
C:\Windows\System32\FWPolicyIOMgr.dll
C:\Windows\System32\FirewallAPI.dll
C:\Windows\System32\FlightSettings.dll
C:\Windows\System32\FunDisc.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\HrtfApo.dll
C:\Windows\System32\IDStore.dll
C:\Windows\System32\IMM32.dll
C:\Windows\System32\IPPMon.dll
C:\Windows\System32\InputSwitch.dll
C:\Windows\System32\LINKINFO.dll
C:\Windows\System32\MCCSEngineShared.dll
C:\Windows\System32\MMDevApi.dll
C:\Windows\System32\MPR.dll
C:\Windows\System32\MSASN1.dll
C:\Windows\System32\MSCTF.dll
C:\Windows\System32\MSWB7.dll
C:\Windows\System32\MrmCoreR.dll
C:\Windows\System32\NSI.dll
C:\Windows\System32\NTASN1.dll
C:\Windows\System32\NetSetupShim.dll
C:\Windows\System32\NetworkUXBroker.dll
C:\Windows\System32\NotificationController.dll
C:\Windows\System32\NotificationControllerPS.dll
C:\Windows\System32\NotificationObjFactory.dll
C:\Windows\System32\NotificationPlatformComponent.dll
C:\Windows\System32\OnDemandBrokerClient.dll
C:\Windows\System32\OneCoreCommonProxyStub.dll
C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
C:\Windows\System32\PIMSTORE.dll
C:\Windows\System32\POWRPROF.dll
C:\Windows\System32\PROPSYS.dll
C:\Windows\System32\PhoneUtil.dll
C:\Windows\System32\PlaySndSrv.dll
C:\Windows\System32\PlayToDevice.dll
C:\Windows\System32\PortableDeviceApi.dll
C:\Windows\System32\PortableDeviceTypes.dll
C:\Windows\System32\PrintIsolationProxy.dll
C:\Windows\System32\ProximityService.dll
C:\Windows\System32\RMCLIENT.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\RTMediaFrame.dll
C:\Windows\System32\ResourcePolicyClient.dll
C:\Windows\System32\SAMLIB.dll
C:\Windows\System32\SETUPAPI.dll
C:\Windows\System32\SHCORE.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\SHLWAPI.dll
C:\Windows\System32\SLC.dll
C:\Windows\System32\SSDPAPI.dll
C:\Windows\System32\Secur32.dll
C:\Windows\System32\SecureTimeAggregator.dll
C:\Windows\System32\SharedStartModel.dll
C:\Windows\System32\ShellCommonCommonProxyStub.dll
C:\Windows\System32\SpatializerApo.dll
C:\Windows\System32\Speech_OneCore\Common\sapi_onecore.dll
C:\Windows\System32\SspiCli.dll
C:\Windows\System32\StartTileData.dll
C:\Windows\System32\StateRepository.Core.dll
C:\Windows\System32\StructuredQuery.dll
C:\Windows\System32\SyncCenter.dll
C:\Windows\System32\SyncController.dll
C:\Windows\System32\SystemCredentialManager.dll
C:\Windows\System32\SystemEventsBrokerClient.dll
C:\Windows\System32\TOKENBINDING.dll
C:\Windows\System32\TextInputFramework.dll
C:\Windows\System32\TokenBroker.dll
C:\Windows\System32\UIAnimation.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\USERENV.dll
C:\Windows\System32\UiaManager.dll
C:\Windows\System32\UserDataLanguageUtil.dll
C:\Windows\System32\UserDataTypeHelperUtil.dll
C:\Windows\System32\Userenv.dll
C:\Windows\System32\VEEventDispatcher.dll
C:\Windows\System32\WINHTTP.dll
C:\Windows\System32\WININET.dll
C:\Windows\System32\WINMM.dll
C:\Windows\System32\WINMMBASE.dll
C:\Windows\System32\WINSTA.dll
C:\Windows\System32\WINTRUST.dll
C:\Windows\System32\WLDAP32.dll
C:\Windows\System32\WMALFXGFXDSP.dll
C:\Windows\System32\WS2_32.dll
C:\Windows\System32\WSCAPI.dll
C:\Windows\System32\WSDMon.dll
C:\Windows\System32\WTSAPI32.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\System32\Windows.ApplicationModel.Background.SystemEventsBroker.dll
C:\Windows\System32\Windows.ApplicationModel.Background.TimeBroker.dll
C:\Windows\System32\Windows.ApplicationModel.dll
C:\Windows\System32\Windows.Cortana.ProxyStub.dll
C:\Windows\System32\Windows.Gaming.Input.dll
C:\Windows\System32\Windows.Globalization.Fontgroups.dll
C:\Windows\System32\Windows.Globalization.dll
C:\Windows\System32\Windows.Graphics.dll
C:\Windows\System32\Windows.Media.Speech.dll
C:\Windows\System32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
C:\Windows\System32\Windows.Networking.Connectivity.dll
C:\Windows\System32\Windows.Networking.HostName.dll
C:\Windows\System32\Windows.Networking.Sockets.PushEnabledApplication.dll
C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll
C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll
C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll
C:\Windows\System32\Windows.StateRepository.dll
C:\Windows\System32\Windows.StateRepositoryBroker.dll
C:\Windows\System32\Windows.Storage.ApplicationData.dll
C:\Windows\System32\Windows.Storage.dll
C:\Windows\System32\Windows.System.Launcher.dll
C:\Windows\System32\Windows.UI.Immersive.dll
C:\Windows\System32\Windows.UI.Shell.dll
C:\Windows\System32\Windows.UI.Xaml.dll
C:\Windows\System32\Windows.UI.dll
C:\Windows\System32\Windows.Web.Http.dll
C:\Windows\System32\Windows.Web.dll
C:\Windows\System32\WorkfoldersShell.dll
C:\Windows\System32\XmlLite.dll
C:\Windows\System32\advapi32.dll
C:\Windows\System32\appresolver.dll
C:\Windows\System32\appsruprov.dll
C:\Windows\System32\audioeng.dll
C:\Windows\System32\audioses.dll
C:\Windows\System32\bcd.dll
C:\Windows\System32\bcrypt.dll
C:\Windows\System32\bcryptPrimitives.dll
C:\Windows\System32\bcryptprimitives.dll
C:\Windows\System32\biwinrt.dll
C:\Windows\System32\canonurl.dll
C:\Windows\System32\cdp.dll
C:\Windows\System32\cdprt.dll
C:\Windows\System32\certca.dll
C:\Windows\System32\certenroll.dll
C:\Windows\System32\cfgmgr32.dll
C:\Windows\System32\chakra.dll
C:\Windows\System32\clbcatq.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\coml2.dll
C:\Windows\System32\container.dll
C:\Windows\System32\cryptcatsvc.dll
C:\Windows\System32\cryptnet.dll
C:\Windows\System32\crypttpmeksvc.dll
C:\Windows\System32\cscapi.dll
C:\Windows\System32\cscobj.dll
C:\Windows\System32\cscui.dll
C:\Windows\System32\d2d1.dll
C:\Windows\System32\daxexec.dll
C:\Windows\System32\deviceaccess.dll
C:\Windows\System32\deviceassociation.dll
C:\Windows\System32\dhcpcore6.dll
C:\Windows\System32\dlnashext.dll
C:\Windows\System32\drvstore.dll
C:\Windows\System32\dsclient.dll
C:\Windows\System32\edputil.dll
C:\Windows\System32\eeprov.dll
C:\Windows\System32\elscore.dll
C:\Windows\System32\energyprov.dll
C:\Windows\System32\execmodelclient.dll
C:\Windows\System32\fdPnp.dll
C:\Windows\System32\fdproxy.dll
C:\Windows\System32\fdssdp.dll
C:\Windows\System32\fdwsd.dll
C:\Windows\System32\framedynos.dll
C:\Windows\System32\fwbase.dll
C:\Windows\System32\fwpuclnt.dll
C:\Windows\System32\gameux.dll
C:\Windows\System32\gdi32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\hcproviders.dll
C:\Windows\System32\hgcpl.dll
C:\Windows\System32\iertutil.dll
C:\Windows\System32\imagehlp.dll
C:\Windows\System32\imapi2.dll
C:\Windows\System32\imm32.dll
C:\Windows\System32\inetpp.dll
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\localspl.dll
C:\Windows\System32\modernexecserver.dll
C:\Windows\System32\msctf.dll
C:\Windows\System32\msdelta.dll
C:\Windows\System32\msvcp110_win.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\System32\msxml6.dll
C:\Windows\System32\ncrypt.dll
C:\Windows\System32\ncuprov.dll
C:\Windows\System32\nduprov.dll
C:\Windows\System32\netprofm.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\newdev.dll
C:\Windows\System32\ngcpopkeysrv.dll
C:\Windows\System32\nlaapi.dll
C:\Windows\System32\npmproxy.dll
C:\Windows\System32\npsm.dll
C:\Windows\System32\pcwum.dll
C:\Windows\System32\pnidui.dll
C:\Windows\System32\portabledeviceconnectapi.dll
C:\Windows\System32\powrprof.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\provsvc.dll
C:\Windows\System32\psapi.dll
C:\Windows\System32\rasadhlp.dll
C:\Windows\System32\rmclient.dll
C:\Windows\System32\samcli.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\setupapi.dll
C:\Windows\System32\sfc_os.dll
C:\Windows\System32\shacct.dll
C:\Windows\System32\shacctprofile.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\shell32.dll
C:\Windows\System32\shlwapi.dll
C:\Windows\System32\smartscreenps.dll
C:\Windows\System32\snmpapi.dll
C:\Windows\System32\srchadmin.dll
C:\Windows\System32\srumapi.dll
C:\Windows\System32\srumsvc.dll
C:\Windows\System32\srvcli.dll
C:\Windows\System32\ssdpapi.dll
C:\Windows\System32\sspicli.dll
C:\Windows\System32\taskschd.dll
C:\Windows\System32\tcpmon.dll
C:\Windows\System32\threadpoolwinrt.dll
C:\Windows\System32\thumbcache.dll
C:\Windows\System32\twinapi.appcore.dll
C:\Windows\System32\twinapi.dll
C:\Windows\System32\twinui.appcore.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\updatehandlers.dll
C:\Windows\System32\urlmon.dll
C:\Windows\System32\usbmon.dll
C:\Windows\System32\user32.dll
C:\Windows\System32\usermgrproxy.dll
C:\Windows\System32\usoapi.dll
C:\Windows\System32\vaultcli.dll
C:\Windows\System32\vaultsvc.dll
C:\Windows\System32\wcmapi.dll
C:\Windows\System32\webio.dll
C:\Windows\System32\webservices.dll
C:\Windows\System32\wer.dll
C:\Windows\System32\werconcpl.dll
C:\Windows\System32\wevtapi.dll
C:\Windows\System32\win32spl.dll
C:\Windows\System32\win32u.dll
C:\Windows\System32\windowmanagement.dll
C:\Windows\System32\windows.immersiveshell.serviceprovider.dll
C:\Windows\System32\windows.storage.dll
C:\Windows\System32\wkscli.dll
C:\Windows\System32\wlidprov.dll
C:\Windows\System32\wpnapps.dll
C:\Windows\System32\wpncore.dll
C:\Windows\System32\wpnprv.dll
C:\Windows\System32\wpnsruprov.dll
C:\Windows\System32\ws2_32.dll
C:\Windows\System32\wscinterop.dll
C:\Windows\System32\wsdapi.dll
C:\Windows\System32\wship6.dll
C:\Windows\System32\wshirda.dll
C:\Windows\System32\wsnmp32.dll
C:\Windows\System32\wuapi.dll
C:\Windows\System32\wwapi.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionMgr.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\BingConfigurationClient.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14942.1000_none_896d6963577866fb\Comctl32.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14942.1000_none_896d6963577866fb\comctl32.dll
C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14942.1000_none_ba585c48b20ae0c9\gdiplus.dll
C:\Windows\system32\ACTIVEDS.dll
C:\Windows\system32\AUTHZ.dll
C:\Windows\system32\BatMeter.dll
C:\Windows\system32\Bcp47Langs.dll
C:\Windows\system32\Bcrypt.dll
C:\Windows\system32\CLDAPI.dll
C:\Windows\system32\CLUSAPI.dll
C:\Windows\system32\CRYPTBASE.dll
C:\Windows\system32\CRYPTSP.dll
C:\Windows\system32\Cabinet.dll
C:\Windows\system32\CbtBackgroundManagerPolicy.dll
C:\Windows\system32\CredentialMigrationHandler.dll
C:\Windows\system32\D3DCOMPILER_47.dll
C:\Windows\system32\DAFWSD.dll
C:\Windows\system32\DEVOBJ.dll
C:\Windows\system32\DEVRTL.dll
C:\Windows\system32\DNSAPI.dll
C:\Windows\system32\DPAPI.dll
C:\Windows\system32\DSROLE.dll
C:\Windows\system32\DataExchange.dll
C:\Windows\system32\ESENT.dll
C:\Windows\system32\EditBufferTestHook.dll
C:\Windows\system32\ElsLad.dll
C:\Windows\system32\ExecModelClient.dll
C:\Windows\system32\FWPolicyIOMgr.dll
C:\Windows\system32\FirewallAPI.dll
C:\Windows\system32\InputLocaleManager.dll
C:\Windows\system32\InputService.dll
C:\Windows\system32\KerbClientShared.dll
C:\Windows\system32\LINKINFO.dll
C:\Windows\system32\MPR.dll
C:\Windows\system32\MSUTB.dll
C:\Windows\system32\MTFServer.dll
C:\Windows\system32\MsCtfMonitor.dll
C:\Windows\system32\Msidle.dll
C:\Windows\system32\NTASN1.dll
C:\Windows\system32\NtlmShared.dll
C:\Windows\system32\PCPKsp.dll
C:\Windows\system32\PROPSYS.dll
C:\Windows\system32\PersonaX.dll
C:\Windows\system32\ProximityCommon.dll
C:\Windows\system32\ProximityCommonPal.dll
C:\Windows\system32\ProximityServicePAL.dll
C:\Windows\system32\RmClient.dll
C:\Windows\system32\RpcRtRemote.dll
C:\Windows\system32\SAMLIB.dll
C:\Windows\system32\SHDOCVW.dll
C:\Windows\system32\SPINF.dll
C:\Windows\system32\SSDPAPI.dll
C:\Windows\system32\SebBackgroundManagerPolicy.dll
C:\Windows\system32\SettingMonitor.dll
C:\Windows\system32\SettingSync.dll
C:\Windows\system32\ShareHost.dll
C:\Windows\system32\SmartCardBackgroundPolicy.dll
C:\Windows\system32\SspiCli.dll
C:\Windows\system32\StateRepository.Core.dll
C:\Windows\system32\Syncreg.dll
C:\Windows\system32\TextInputFramework.dll
C:\Windows\system32\USERENV.dll
C:\Windows\system32\UXINIT.dll
C:\Windows\system32\UxTheme.dll
C:\Windows\system32\VEEventDispatcher.dll
C:\Windows\system32\VERSION.dll
C:\Windows\system32\WINHTTP.dll
C:\Windows\system32\WINSTA.dll
C:\Windows\system32\WMICLNT.dll
C:\Windows\system32\Windows.Internal.Shell.Broker.dll
C:\Windows\system32\Windows.Storage.Search.dll
C:\Windows\system32\WindowsCodecs.dll
C:\Windows\system32\WlanApi.dll
C:\Windows\system32\WpPortingLibrary.dll
C:\Windows\system32\XmlLite.dll
C:\Windows\system32\acppage.dll
C:\Windows\system32\activationmanager.dll
C:\Windows\system32\adhapi.dll
C:\Windows\system32\adhsvc.dll
C:\Windows\system32\adsldp.dll
C:\Windows\system32\adsldpc.dll
C:\Windows\system32\apphelp.dll
C:\Windows\system32\authui.dll
C:\Windows\system32\avrt.dll
C:\Windows\system32\bcrypt.dll
C:\Windows\system32\bitsigd.dll
C:\Windows\system32\c_g18030.dll
C:\Windows\system32\c_gsm7.dll
C:\Windows\system32\c_is2022.dll
C:\Windows\system32\c_iscii.dll
C:\Windows\system32\cdp.dll
C:\Windows\system32\cryptdll.dll
C:\Windows\system32\cscapi.dll
C:\Windows\system32\d2d1.dll
C:\Windows\system32\d3d10warp.dll
C:\Windows\system32\d3d11.dll
C:\Windows\system32\dafupnp.dll
C:\Windows\system32\dataexchange.dll
C:\Windows\system32\dbghelp.dll
C:\Windows\system32\dcomp.dll
C:\Windows\system32\desktopshellext.dll
C:\Windows\system32\deviceassociation.dll
C:\Windows\system32\diagperf.dll
C:\Windows\system32\directmanipulation.dll
C:\Windows\system32\dpapisrv.dll
C:\Windows\system32\drvstore.dll
C:\Windows\system32\dssenh.dll
C:\Windows\system32\dtsh.dll
C:\Windows\system32\dwmapi.dll
C:\Windows\system32\dwmcore.dll
C:\Windows\system32\dxgi.dll
C:\Windows\system32\dxp.dll
C:\Windows\system32\edputil.dll
C:\Windows\system32\efslsaext.dll
C:\Windows\system32\es.dll
C:\Windows\system32\execmodelproxy.dll
C:\Windows\system32\explorerframe.dll
C:\Windows\system32\fwbase.dll
C:\Windows\system32\fwpuclnt.dll
C:\Windows\system32\gmsaclient.dll
C:\Windows\system32\hmkd.dll
C:\Windows\system32\hnetcfg.dll
C:\Windows\system32\hnetcfgclient.dll
C:\Windows\system32\httpprxm.dll
C:\Windows\system32\iertutil.dll
C:\Windows\system32\keepaliveprovider.dll
C:\Windows\system32\keyiso.dll
C:\Windows\system32\logoncli.dll
C:\Windows\system32\lsasrv.dll
C:\Windows\system32\mi.dll
C:\Windows\system32\miutils.dll
C:\Windows\system32\mlang.dll
C:\Windows\system32\msi.dll
C:\Windows\system32\msimtf.dll
C:\Windows\system32\mssph.dll
C:\Windows\system32\mssprxy.dll
C:\Windows\system32\mssrch.dll
C:\Windows\system32\msvcp110_win.dll
C:\Windows\system32\mswsock.dll
C:\Windows\system32\ncrypt.dll
C:\Windows\system32\ncryptprov.dll
C:\Windows\system32\ncryptsslp.dll
C:\Windows\system32\netutils.dll
C:\Windows\system32\ntmarta.dll
C:\Windows\system32\perftrack.dll
C:\Windows\system32\pnpts.dll
C:\Windows\system32\prnfldr.dll
C:\Windows\system32\propsys.dll
C:\Windows\system32\radardt.dll
C:\Windows\system32\rsaenh.dll
C:\Windows\system32\samcli.dll
C:\Windows\system32\secur32.dll
C:\Windows\system32\shellcompositor.dll
C:\Windows\system32\spool\PRTPROCS\x64\winprint.dll
C:\Windows\system32\sqmapi.dll
C:\Windows\system32\sspicli.dll
C:\Windows\system32\stobject.dll
C:\Windows\system32\sxs.dll
C:\Windows\system32\taskcomp.dll
C:\Windows\system32\tbs.dll
C:\Windows\system32\tcpipcfg.dll
C:\Windows\system32\twext.dll
C:\Windows\system32\twinapi.appcore.dll
C:\Windows\system32\twinapi.dll
C:\Windows\system32\twinui.dll
C:\Windows\system32\twinui.pcshell.dll
C:\Windows\system32\upnp.dll
C:\Windows\system32\urlmon.dll
C:\Windows\system32\uxtheme.dll
C:\Windows\system32\wbem\FastProx.dll
C:\Windows\system32\wbem\esscli.dll
C:\Windows\system32\wbem\fastprox.dll
C:\Windows\system32\wbem\ncprov.dll
C:\Windows\system32\wbem\repdrvfs.dll
C:\Windows\system32\wbem\wbemcore.dll
C:\Windows\system32\wbem\wbemess.dll
C:\Windows\system32\wbem\wbemprox.dll
C:\Windows\system32\wbem\wbemsvc.dll
C:\Windows\system32\wbem\wmiprvsd.dll
C:\Windows\system32\wbem\wmiutils.dll
C:\Windows\system32\wcmcsp.dll
C:\Windows\system32\webio.dll
C:\Windows\system32\webservices.dll
C:\Windows\system32\windows.cortana.Desktop.dll
C:\Windows\system32\windows.cortana.onecore.dll
C:\Windows\system32\windows.cortana.pal.desktop.dll
C:\Windows\system32\windowscodecs.dll
C:\Windows\system32\wininet.dll
C:\Windows\system32\wmidcom.dll
C:\Windows\system32\wpdshserviceobj.dll
C:\Windows\system32\wsdapi.dll
C:\Windows\system32\wshhyperv.dll
C:\Windows\system32\wship6.dll
C:\Windows\system32\wshqos.dll
C:\Windows\system32\wtsapi32.dll
c:\windows\system32\AUDIOSRVPOLICYMANAGER.dll
c:\windows\system32\AUTHZ.dll
c:\windows\system32\BrokerLib.dll
c:\windows\system32\CRYPTSP.dll
c:\windows\system32\CRYPTXML.dll
c:\windows\system32\DAB.dll
c:\windows\system32\DABAPI.dll
c:\windows\system32\DEVOBJ.dll
c:\windows\system32\DMCmnUtils.dll
c:\windows\system32\DNSAPI.dll
c:\windows\system32\DSROLE.dll
c:\windows\system32\ESENT.dll
c:\windows\system32\EventAggregation.dll
c:\windows\system32\FVEAPI.dll
c:\windows\system32\FWPolicyIOMgr.dll
c:\windows\system32\FirewallAPI.dll
c:\windows\system32\FontProvider.dll
c:\windows\system32\HTTPAPI.dll
c:\windows\system32\InprocLogger.dll
c:\windows\system32\MCCSPal.dll
c:\windows\system32\NCI.dll
c:\windows\system32\NTASN1.dll
c:\windows\system32\NTMARTA.dll
c:\windows\system32\NetSetupApi.dll
c:\windows\system32\NetworkHelper.dll
c:\windows\system32\PROPSYS.dll
c:\windows\system32\RMCLIENT.dll
c:\windows\system32\ResourcePolicyClient.dll
c:\windows\system32\SAMLIB.dll
c:\windows\system32\SYNCUTIL.dll
c:\windows\system32\SYSNTFY.dll
c:\windows\system32\SspiCli.dll
c:\windows\system32\StateRepository.Core.dll
c:\windows\system32\SystemEventsBrokerClient.dll
c:\windows\system32\TimeBrokerClient.dll
c:\windows\system32\UBPM.dll
c:\windows\system32\USERENV.dll
c:\windows\system32\UpdatePolicy.dll
c:\windows\system32\UserDataPlatformHelperUtil.dll
c:\windows\system32\VEEventDispatcher.dll
c:\windows\system32\WDSCORE.dll
c:\windows\system32\WINHTTP.dll
c:\windows\system32\WINSTA.dll
c:\windows\system32\WMICLNT.dll
c:\windows\system32\WTSAPI32.dll
c:\windows\system32\WindowsPerformanceRecorderControl.dll
c:\windows\system32\XmlLite.dll
c:\windows\system32\aphostservice.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\appinfo.dll
c:\windows\system32\audioendpointbuilder.dll
c:\windows\system32\audiosrv.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bfe.dll
c:\windows\system32\bisrv.dll
c:\windows\system32\bitsperf.dll
c:\windows\system32\cdp.dll
c:\windows\system32\cdpsvc.dll
c:\windows\system32\cdpusersvc.dll
c:\windows\system32\cryptsvc.dll
c:\windows\system32\das.dll
c:\windows\system32\deviceassociation.dll
c:\windows\system32\dhcpcore.dll
c:\windows\system32\diagtrack.dll
c:\windows\system32\dnsrslvr.dll
c:\windows\system32\dosvc.dll
c:\windows\system32\dps.dll
c:\windows\system32\dusmsvc.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\es.dll
c:\windows\system32\fdphost.dll
c:\windows\system32\fdrespub.dll
c:\windows\system32\fntcache.dll
c:\windows\system32\fwbase.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\gpsvc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\iphlpsvc.dll
c:\windows\system32\ipsecsvc.dll
c:\windows\system32\lmhsvc.dll
c:\windows\system32\logoncli.dll
c:\windows\system32\lsm.dll
c:\windows\system32\mintdh.dll
c:\windows\system32\mpssvc.dll
c:\windows\system32\msvcp110_win.dll
c:\windows\system32\ncbservice.dll
c:\windows\system32\ncdautosetup.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\ncsi.dll
c:\windows\system32\netprofmsvc.dll
c:\windows\system32\netutils.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\nlasvc.dll
c:\windows\system32\nsisvc.dll
c:\windows\system32\pcasvc.dll
c:\windows\system32\profsvc.dll
c:\windows\system32\provsvc.dll
c:\windows\system32\psmsrv.dll
c:\windows\system32\qmgr.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcss.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sbservicetrigger.dll
c:\windows\system32\schedsvc.dll
c:\windows\system32\sens.dll
c:\windows\system32\shsvcs.dll
c:\windows\system32\srvsvc.dll
c:\windows\system32\ssdpsrv.dll
c:\windows\system32\sysmain.dll
c:\windows\system32\systemeventsbrokerserver.dll
c:\windows\system32\themeservice.dll
c:\windows\system32\tileobjserver.dll
c:\windows\system32\timebrokerserver.dll
c:\windows\system32\trkwks.dll
c:\windows\system32\umpnpmgr.dll
c:\windows\system32\umpo.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\usermgr.dll
c:\windows\system32\usocore.dll
c:\windows\system32\wbem\wmisvc.dll
c:\windows\system32\wcmsvc.dll
c:\windows\system32\wdi.dll
c:\windows\system32\webio.dll
c:\windows\system32\webservices.dll
c:\windows\system32\wevtsvc.dll
c:\windows\system32\windows.staterepository.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\wkssvc.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\wpnservice.dll
c:\windows\system32\wscsvc.dll
c:\windows\system32\wsdapi.dll
c:\windows\system32\wudfsvc.dll
c:\windows\system32\wwapi.dll

↧

how to find nt!KeServiceDescriptorTableFilter

October 28, 2016, 7:31 am

≫ Next: IMAGE_LOAD_CONFIG_DIRECTORY from sdk 14951

≪ Previous: rfg patches in windows 10 build 14942

Unfortunately all xrefs to KeServiceDescriptorTableFilter are from non-exported functions, for example PsConvertToGuiThread:

     test    dword ptr [edi+2E8h], 18000h ; EPROCESS.Flags3
     jnz     short loc_6CAD9D

...
loc_6CAD9D:
mov dword ptr [esi+3Ch], offset _KeServiceDescriptorTableFilter

But we can used signatures search for part of test dword ptr [edi+2E8h], 18000h.
We first need to find offset to EPROCESS.Flags3. This can be done from exported function PsIsProcessCommitRelinquished:

  mov     edi, edi
  push    ebp
  mov     ebp, esp
  mov     eax, [ebp+arg_0]
  mov     eax, [eax+2E8h]
  shr     eax, 12h
  and     al, 1

nothing special, bit of disasm and we have EPROCESS.Flags3 YYXX. Next search bytes
XX YY 00 00 00 80 01 00
in PAGE section. Follow jnz and you`ll get KeServiceDescriptorTableFilter

↧

IMAGE_LOAD_CONFIG_DIRECTORY from sdk 14951

October 29, 2016, 11:53 pm

≫ Next: ntstatus.idc for WDK 10.0.14931.0

≪ Previous: how to find nt!KeServiceDescriptorTableFilter

typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY {
    WORD    Flags;          // Flags to indicate if CI information is available, etc.
    WORD    Catalog;        // 0xFFFF means not available
    DWORD   CatalogOffset;
    DWORD   Reserved;       // Additional bitmask to be defined later
} IMAGE_LOAD_CONFIG_CODE_INTEGRITY, *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;

//
// Dynamic value relocation table in loadconfig
//

typedef struct _IMAGE_DYNAMIC_RELOCATION_TABLE {
    DWORD Version;
    DWORD Size;
//  IMAGE_DYNAMIC_RELOCATION DynamicRelocations[0];
} IMAGE_DYNAMIC_RELOCATION_TABLE, *PIMAGE_DYNAMIC_RELOCATION_TABLE;

//
// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
//

typedef struct _IMAGE_DYNAMIC_RELOCATION {
    PVOID Symbol;
    DWORD BaseRelocSize;
//  IMAGE_BASE_RELOCATION BaseRelocations[0];
} IMAGE_DYNAMIC_RELOCATION, *PIMAGE_DYNAMIC_RELOCATION;

//
// Defined symbolic dynamic relocation entries.
//

#define IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE 0x00000001
#define IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE 0x00000002

//
// Load Configuration Directory Entry
//

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32 {
    DWORD   Size;
    DWORD   TimeDateStamp;
    WORD    MajorVersion;
    WORD    MinorVersion;
    DWORD   GlobalFlagsClear;
    DWORD   GlobalFlagsSet;
    DWORD   CriticalSectionDefaultTimeout;
    DWORD   DeCommitFreeBlockThreshold;
    DWORD   DeCommitTotalFreeThreshold;
    DWORD   LockPrefixTable;                // VA
    DWORD   MaximumAllocationSize;
    DWORD   VirtualMemoryThreshold;
    DWORD   ProcessHeapFlags;
    DWORD   ProcessAffinityMask;
    WORD    CSDVersion;
    WORD    DependentLoadFlags;
    DWORD   EditList;                       // VA
    DWORD   SecurityCookie;                 // VA
    DWORD   SEHandlerTable;                 // VA
    DWORD   SEHandlerCount;
    DWORD   GuardCFCheckFunctionPointer;    // VA
    DWORD   GuardCFDispatchFunctionPointer; // VA
    DWORD   GuardCFFunctionTable;           // VA
    DWORD   GuardCFFunctionCount;
    DWORD   GuardFlags;
    IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
    DWORD   GuardAddressTakenIatEntryTable; // VA
    DWORD   GuardAddressTakenIatEntryCount;
    DWORD   GuardLongJumpTargetTable;       // VA
    DWORD   GuardLongJumpTargetCount;
    DWORD   DynamicValueRelocTable;         // VA
    DWORD   CHPEMetadataPointer;
    DWORD   GuardRFFailureRoutine;          // VA
    DWORD   GuardRFFailureRoutineFunctionPointer; // VA
    DWORD   DynamicValueRelocTableOffset;
    WORD    DynamicValueRelocTableSection;
    WORD    Reserved2;
} IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64 {
    DWORD      Size;
    DWORD      TimeDateStamp;
    WORD       MajorVersion;
    WORD       MinorVersion;
    DWORD      GlobalFlagsClear;
    DWORD      GlobalFlagsSet;
    DWORD      CriticalSectionDefaultTimeout;
    ULONGLONG  DeCommitFreeBlockThreshold;
    ULONGLONG  DeCommitTotalFreeThreshold;
    ULONGLONG  LockPrefixTable;                // VA
    ULONGLONG  MaximumAllocationSize;
    ULONGLONG  VirtualMemoryThreshold;
    ULONGLONG  ProcessAffinityMask;
    DWORD      ProcessHeapFlags;
    WORD       CSDVersion;
    WORD       DependentLoadFlags;
    ULONGLONG  EditList;                       // VA
    ULONGLONG  SecurityCookie;                 // VA
    ULONGLONG  SEHandlerTable;                 // VA
    ULONGLONG  SEHandlerCount;
    ULONGLONG  GuardCFCheckFunctionPointer;    // VA
    ULONGLONG  GuardCFDispatchFunctionPointer; // VA
    ULONGLONG  GuardCFFunctionTable;           // VA
    ULONGLONG  GuardCFFunctionCount;
    DWORD      GuardFlags;
    IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
    ULONGLONG  GuardAddressTakenIatEntryTable; // VA
    ULONGLONG  GuardAddressTakenIatEntryCount;
    ULONGLONG  GuardLongJumpTargetTable;       // VA
    ULONGLONG  GuardLongJumpTargetCount;
    ULONGLONG  DynamicValueRelocTable;         // VA
    ULONGLONG  CHPEMetadataPointer;            // VA
    ULONGLONG  GuardRFFailureRoutine;          // VA
    ULONGLONG  GuardRFFailureRoutineFunctionPointer; // VA
    DWORD      DynamicValueRelocTableOffset;
    WORD       DynamicValueRelocTableSection;
    WORD       Reserved2;
} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;

#define IMAGE_GUARD_CF_INSTRUMENTED                    0x00000100 // Module performs control flow integrity checks using system-supplied support
#define IMAGE_GUARD_CFW_INSTRUMENTED                   0x00000200 // Module performs control flow and write integrity checks
#define IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT          0x00000400 // Module contains valid control flow target metadata
#define IMAGE_GUARD_SECURITY_COOKIE_UNUSED             0x00000800 // Module does not make use of the /GS security cookie
#define IMAGE_GUARD_PROTECT_DELAYLOAD_IAT              0x00001000 // Module supports read only delay load IAT
#define IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION   0x00002000 // Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
#define IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT 0x00004000 // Module contains suppressed export information
#define IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION       0x00008000 // Module enables suppression of exports
#define IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT          0x00010000 // Module contains longjmp target information
#define IMAGE_GUARD_RF_INSTRUMENTED                    0x00020000 // Module contains return flow instrumentation and metadata
#define IMAGE_GUARD_RF_ENABLE                          0x00040000 // Module requests that the OS enable return flow protection
#define IMAGE_GUARD_RF_STRICT                          0x00080000 // Module requests that the OS enable return flow protection in strict mode
#define IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK        0xF0000000 // Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
#define IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT       28         // Shift to right-justify Guard CF function table stride

↧

ntstatus.idc for WDK 10.0.14931.0

October 30, 2016, 7:50 am

≫ Next: rfg longjumps

≪ Previous: IMAGE_LOAD_CONFIG_DIRECTORY from sdk 14951

added 95 new NTSTATUS values

#include 

static Enums(void) 
{
  auto id,cid;
  id = AddEnum( 0, "NTSTATUS", 0x1100000 );
  if ( id == -1 )
  {
    id = GetEnum("NTSTATUS");
  }
  if ( id != -1 )
  {
    AddConstEx( id, "STATUS_WAIT_0", 0x0, -1);
    AddConstEx( id, "STATUS_WAIT_1", 0x1, -1);
    AddConstEx( id, "STATUS_WAIT_2", 0x2, -1);
    AddConstEx( id, "STATUS_WAIT_3", 0x3, -1);
    AddConstEx( id, "STATUS_WAIT_63", 0x3F, -1);
    AddConstEx( id, "STATUS_ABANDONED", 0x80, -1);
    AddConstEx( id, "STATUS_ABANDONED_WAIT_63", 0xBF, -1);
    AddConstEx( id, "STATUS_USER_APC", 0xC0, -1);
    AddConstEx( id, "STATUS_ALREADY_COMPLETE", 0xFF, -1);
    AddConstEx( id, "STATUS_KERNEL_APC", 0x100, -1);
    AddConstEx( id, "STATUS_ALERTED", 0x101, -1);
    AddConstEx( id, "STATUS_TIMEOUT", 0x102, -1);
    AddConstEx( id, "STATUS_PENDING", 0x103, -1);
    AddConstEx( id, "STATUS_REPARSE", 0x104, -1);
    AddConstEx( id, "STATUS_MORE_ENTRIES", 0x105, -1);
    AddConstEx( id, "STATUS_NOT_ALL_ASSIGNED", 0x106, -1);
    AddConstEx( id, "STATUS_SOME_NOT_MAPPED", 0x107, -1);
    AddConstEx( id, "STATUS_OPLOCK_BREAK_IN_PROGRESS", 0x108, -1);
    AddConstEx( id, "STATUS_VOLUME_MOUNTED", 0x109, -1);
    AddConstEx( id, "STATUS_RXACT_COMMITTED", 0x10A, -1);
    AddConstEx( id, "STATUS_NOTIFY_CLEANUP", 0x10B, -1);
    AddConstEx( id, "STATUS_NOTIFY_ENUM_DIR", 0x10C, -1);
    AddConstEx( id, "STATUS_NO_QUOTAS_FOR_ACCOUNT", 0x10D, -1);
    AddConstEx( id, "STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED", 0x10E, -1);
    AddConstEx( id, "STATUS_PAGE_FAULT_TRANSITION", 0x110, -1);
    AddConstEx( id, "STATUS_PAGE_FAULT_DEMAND_ZERO", 0x111, -1);
    AddConstEx( id, "STATUS_PAGE_FAULT_COPY_ON_WRITE", 0x112, -1);
    AddConstEx( id, "STATUS_PAGE_FAULT_GUARD_PAGE", 0x113, -1);
    AddConstEx( id, "STATUS_PAGE_FAULT_PAGING_FILE", 0x114, -1);
    AddConstEx( id, "STATUS_CACHE_PAGE_LOCKED", 0x115, -1);
    AddConstEx( id, "STATUS_CRASH_DUMP", 0x116, -1);
    AddConstEx( id, "STATUS_BUFFER_ALL_ZEROS", 0x117, -1);
    AddConstEx( id, "STATUS_REPARSE_OBJECT", 0x118, -1);
    AddConstEx( id, "STATUS_RESOURCE_REQUIREMENTS_CHANGED", 0x119, -1);
    AddConstEx( id, "STATUS_TRANSLATION_COMPLETE", 0x120, -1);
    AddConstEx( id, "STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY", 0x121, -1);
    AddConstEx( id, "STATUS_NOTHING_TO_TERMINATE", 0x122, -1);
    AddConstEx( id, "STATUS_PROCESS_NOT_IN_JOB", 0x123, -1);
    AddConstEx( id, "STATUS_PROCESS_IN_JOB", 0x124, -1);
    AddConstEx( id, "STATUS_VOLSNAP_HIBERNATE_READY", 0x125, -1);
    AddConstEx( id, "STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY", 0x126, -1);
    AddConstEx( id, "STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED", 0x127, -1);
    AddConstEx( id, "STATUS_INTERRUPT_STILL_CONNECTED", 0x128, -1);
    AddConstEx( id, "STATUS_PROCESS_CLONED", 0x129, -1);
    AddConstEx( id, "STATUS_FILE_LOCKED_WITH_ONLY_READERS", 0x12A, -1);
    AddConstEx( id, "STATUS_FILE_LOCKED_WITH_WRITERS", 0x12B, -1);
    AddConstEx( id, "STATUS_VALID_IMAGE_HASH", 0x12C, -1);
    AddConstEx( id, "STATUS_VALID_CATALOG_HASH", 0x12D, -1);
    AddConstEx( id, "STATUS_VALID_STRONG_CODE_HASH", 0x12E, -1);
    AddConstEx( id, "STATUS_GHOSTED", 0x12F, -1);
    AddConstEx( id, "STATUS_RESOURCEMANAGER_READ_ONLY", 0x202, -1);
    AddConstEx( id, "STATUS_RING_PREVIOUSLY_EMPTY", 0x210, -1);
    AddConstEx( id, "STATUS_RING_PREVIOUSLY_FULL", 0x211, -1);
    AddConstEx( id, "STATUS_RING_PREVIOUSLY_ABOVE_QUOTA", 0x212, -1);
    AddConstEx( id, "STATUS_RING_NEWLY_EMPTY", 0x213, -1);
    AddConstEx( id, "STATUS_RING_SIGNAL_OPPOSITE_ENDPOINT", 0x214, -1);
    AddConstEx( id, "STATUS_OPLOCK_SWITCHED_TO_NEW_HANDLE", 0x215, -1);
    AddConstEx( id, "STATUS_OPLOCK_HANDLE_CLOSED", 0x216, -1);
    AddConstEx( id, "STATUS_WAIT_FOR_OPLOCK", 0x367, -1);
    AddConstEx( id, "STATUS_REPARSE_GLOBAL", 0x368, -1);
    AddConstEx( id, "STATUS_FLT_IO_COMPLETE", 0x1C0001, -1);
    AddConstEx( id, "STATUS_RTPM_CONTEXT_CONTINUE", 0x293000, -1);
    AddConstEx( id, "STATUS_RTPM_CONTEXT_COMPLETE", 0x293001, -1);
    AddConstEx( id, "STATUS_HV_PENDING_PAGE_REQUESTS", 0x350059, -1);
    AddConstEx( id, "STATUS_SPACES_REPAIRED", 0xE70000, -1);
    AddConstEx( id, "STATUS_SPACES_PAUSE", 0xE70001, -1);
    AddConstEx( id, "STATUS_SPACES_COMPLETE", 0xE70002, -1);
    AddConstEx( id, "STATUS_SPACES_REDIRECT", 0xE70003, -1);
    AddConstEx( id, "STATUS_OBJECT_NAME_EXISTS", 0x40000000, -1);
    AddConstEx( id, "STATUS_THREAD_WAS_SUSPENDED", 0x40000001, -1);
    AddConstEx( id, "STATUS_WORKING_SET_LIMIT_RANGE", 0x40000002, -1);
    AddConstEx( id, "STATUS_IMAGE_NOT_AT_BASE", 0x40000003, -1);
    AddConstEx( id, "STATUS_RXACT_STATE_CREATED", 0x40000004, -1);
    AddConstEx( id, "STATUS_SEGMENT_NOTIFICATION", 0x40000005, -1);
    AddConstEx( id, "STATUS_LOCAL_USER_SESSION_KEY", 0x40000006, -1);
    AddConstEx( id, "STATUS_BAD_CURRENT_DIRECTORY", 0x40000007, -1);
    AddConstEx( id, "STATUS_SERIAL_MORE_WRITES", 0x40000008, -1);
    AddConstEx( id, "STATUS_REGISTRY_RECOVERED", 0x40000009, -1);
    AddConstEx( id, "STATUS_FT_READ_RECOVERY_FROM_BACKUP", 0x4000000A, -1);
    AddConstEx( id, "STATUS_FT_WRITE_RECOVERY", 0x4000000B, -1);
    AddConstEx( id, "STATUS_SERIAL_COUNTER_TIMEOUT", 0x4000000C, -1);
    AddConstEx( id, "STATUS_NULL_LM_PASSWORD", 0x4000000D, -1);
    AddConstEx( id, "STATUS_IMAGE_MACHINE_TYPE_MISMATCH", 0x4000000E, -1);
    AddConstEx( id, "STATUS_RECEIVE_PARTIAL", 0x4000000F, -1);
    AddConstEx( id, "STATUS_RECEIVE_EXPEDITED", 0x40000010, -1);
    AddConstEx( id, "STATUS_RECEIVE_PARTIAL_EXPEDITED", 0x40000011, -1);
    AddConstEx( id, "STATUS_EVENT_DONE", 0x40000012, -1);
    AddConstEx( id, "STATUS_EVENT_PENDING", 0x40000013, -1);
    AddConstEx( id, "STATUS_CHECKING_FILE_SYSTEM", 0x40000014, -1);
    AddConstEx( id, "STATUS_FATAL_APP_EXIT", 0x40000015, -1);
    AddConstEx( id, "STATUS_PREDEFINED_HANDLE", 0x40000016, -1);
    AddConstEx( id, "STATUS_WAS_UNLOCKED", 0x40000017, -1);
    AddConstEx( id, "STATUS_SERVICE_NOTIFICATION", 0x40000018, -1);
    AddConstEx( id, "STATUS_WAS_LOCKED", 0x40000019, -1);
    AddConstEx( id, "STATUS_LOG_HARD_ERROR", 0x4000001A, -1);
    AddConstEx( id, "STATUS_ALREADY_WIN32", 0x4000001B, -1);
    AddConstEx( id, "STATUS_WX86_UNSIMULATE", 0x4000001C, -1);
    AddConstEx( id, "STATUS_WX86_CONTINUE", 0x4000001D, -1);
    AddConstEx( id, "STATUS_WX86_SINGLE_STEP", 0x4000001E, -1);
    AddConstEx( id, "STATUS_WX86_BREAKPOINT", 0x4000001F, -1);
    AddConstEx( id, "STATUS_WX86_EXCEPTION_CONTINUE", 0x40000020, -1);
    AddConstEx( id, "STATUS_WX86_EXCEPTION_LASTCHANCE", 0x40000021, -1);
    AddConstEx( id, "STATUS_WX86_EXCEPTION_CHAIN", 0x40000022, -1);
    AddConstEx( id, "STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE", 0x40000023, -1);
    AddConstEx( id, "STATUS_NO_YIELD_PERFORMED", 0x40000024, -1);
    AddConstEx( id, "STATUS_TIMER_RESUME_IGNORED", 0x40000025, -1);
    AddConstEx( id, "STATUS_ARBITRATION_UNHANDLED", 0x40000026, -1);
    AddConstEx( id, "STATUS_CARDBUS_NOT_SUPPORTED", 0x40000027, -1);
    AddConstEx( id, "STATUS_WX86_CREATEWX86TIB", 0x40000028, -1);
    AddConstEx( id, "STATUS_MP_PROCESSOR_MISMATCH", 0x40000029, -1);
    AddConstEx( id, "STATUS_HIBERNATED", 0x4000002A, -1);
    AddConstEx( id, "STATUS_RESUME_HIBERNATION", 0x4000002B, -1);
    AddConstEx( id, "STATUS_FIRMWARE_UPDATED", 0x4000002C, -1);
    AddConstEx( id, "STATUS_DRIVERS_LEAKING_LOCKED_PAGES", 0x4000002D, -1);
    AddConstEx( id, "STATUS_MESSAGE_RETRIEVED", 0x4000002E, -1);
    AddConstEx( id, "STATUS_SYSTEM_POWERSTATE_TRANSITION", 0x4000002F, -1);
    AddConstEx( id, "STATUS_ALPC_CHECK_COMPLETION_LIST", 0x40000030, -1);
    AddConstEx( id, "STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION", 0x40000031, -1);
    AddConstEx( id, "STATUS_ACCESS_AUDIT_BY_POLICY", 0x40000032, -1);
    AddConstEx( id, "STATUS_ABANDON_HIBERFILE", 0x40000033, -1);
    AddConstEx( id, "STATUS_BIZRULES_NOT_ENABLED", 0x40000034, -1);
    AddConstEx( id, "STATUS_FT_READ_FROM_COPY", 0x40000035, -1);
    AddConstEx( id, "STATUS_IMAGE_AT_DIFFERENT_BASE", 0x40000036, -1);
    AddConstEx( id, "STATUS_WAKE_SYSTEM", 0x40000294, -1);
    AddConstEx( id, "STATUS_DS_SHUTTING_DOWN", 0x40000370, -1);
    AddConstEx( id, "STATUS_DISK_REPAIR_REDIRECTED", 0x40000807, -1);
    AddConstEx( id, "STATUS_SERVICES_FAILED_AUTOSTART", 0x4000A144, -1);
    AddConstEx( id, "STATUS_CTX_CDM_CONNECT", 0x400A0004, -1);
    AddConstEx( id, "STATUS_CTX_CDM_DISCONNECT", 0x400A0005, -1);
    AddConstEx( id, "STATUS_SXS_RELEASE_ACTIVATION_CONTEXT", 0x4015000D, -1);
    AddConstEx( id, "STATUS_HEURISTIC_DAMAGE_POSSIBLE", 0x40190001, -1);
    AddConstEx( id, "STATUS_RECOVERY_NOT_NEEDED", 0x40190034, -1);
    AddConstEx( id, "STATUS_RM_ALREADY_STARTED", 0x40190035, -1);
    AddConstEx( id, "STATUS_LOG_NO_RESTART", 0x401A000C, -1);
    AddConstEx( id, "STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST", 0x401B00EC, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PARTIAL_DATA_POPULATED", 0x401E000A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_SKIP_ALLOCATION_PREPARATION", 0x401E0201, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MODE_NOT_PINNED", 0x401E0307, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_PREFERRED_MODE", 0x401E031E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DATASET_IS_EMPTY", 0x401E034B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET", 0x401E034C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED", 0x401E0351, -1);
    AddConstEx( id, "STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS", 0x401E042F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_LEADLINK_START_DEFERRED", 0x401E0437, -1);
    AddConstEx( id, "STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY", 0x401E0439, -1);
    AddConstEx( id, "STATUS_GRAPHICS_START_DEFERRED", 0x401E043A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DEPENDABLE_CHILD_STATUS", 0x401E043C, -1);
    AddConstEx( id, "STATUS_NDIS_INDICATION_REQUIRED", 0x40230001, -1);
    AddConstEx( id, "STATUS_GUARD_PAGE_VIOLATION", 0x80000001, -1);
    AddConstEx( id, "STATUS_DATATYPE_MISALIGNMENT", 0x80000002, -1);
    AddConstEx( id, "STATUS_BREAKPOINT", 0x80000003, -1);
    AddConstEx( id, "STATUS_SINGLE_STEP", 0x80000004, -1);
    AddConstEx( id, "STATUS_BUFFER_OVERFLOW", 0x80000005, -1);
    AddConstEx( id, "STATUS_NO_MORE_FILES", 0x80000006, -1);
    AddConstEx( id, "STATUS_WAKE_SYSTEM_DEBUGGER", 0x80000007, -1);
    AddConstEx( id, "STATUS_HANDLES_CLOSED", 0x8000000A, -1);
    AddConstEx( id, "STATUS_NO_INHERITANCE", 0x8000000B, -1);
    AddConstEx( id, "STATUS_GUID_SUBSTITUTION_MADE", 0x8000000C, -1);
    AddConstEx( id, "STATUS_PARTIAL_COPY", 0x8000000D, -1);
    AddConstEx( id, "STATUS_DEVICE_PAPER_EMPTY", 0x8000000E, -1);
    AddConstEx( id, "STATUS_DEVICE_POWERED_OFF", 0x8000000F, -1);
    AddConstEx( id, "STATUS_DEVICE_OFF_LINE", 0x80000010, -1);
    AddConstEx( id, "STATUS_DEVICE_BUSY", 0x80000011, -1);
    AddConstEx( id, "STATUS_NO_MORE_EAS", 0x80000012, -1);
    AddConstEx( id, "STATUS_INVALID_EA_NAME", 0x80000013, -1);
    AddConstEx( id, "STATUS_EA_LIST_INCONSISTENT", 0x80000014, -1);
    AddConstEx( id, "STATUS_INVALID_EA_FLAG", 0x80000015, -1);
    AddConstEx( id, "STATUS_VERIFY_REQUIRED", 0x80000016, -1);
    AddConstEx( id, "STATUS_EXTRANEOUS_INFORMATION", 0x80000017, -1);
    AddConstEx( id, "STATUS_RXACT_COMMIT_NECESSARY", 0x80000018, -1);
    AddConstEx( id, "STATUS_NO_MORE_ENTRIES", 0x8000001A, -1);
    AddConstEx( id, "STATUS_FILEMARK_DETECTED", 0x8000001B, -1);
    AddConstEx( id, "STATUS_MEDIA_CHANGED", 0x8000001C, -1);
    AddConstEx( id, "STATUS_BUS_RESET", 0x8000001D, -1);
    AddConstEx( id, "STATUS_END_OF_MEDIA", 0x8000001E, -1);
    AddConstEx( id, "STATUS_BEGINNING_OF_MEDIA", 0x8000001F, -1);
    AddConstEx( id, "STATUS_MEDIA_CHECK", 0x80000020, -1);
    AddConstEx( id, "STATUS_SETMARK_DETECTED", 0x80000021, -1);
    AddConstEx( id, "STATUS_NO_DATA_DETECTED", 0x80000022, -1);
    AddConstEx( id, "STATUS_REDIRECTOR_HAS_OPEN_HANDLES", 0x80000023, -1);
    AddConstEx( id, "STATUS_SERVER_HAS_OPEN_HANDLES", 0x80000024, -1);
    AddConstEx( id, "STATUS_ALREADY_DISCONNECTED", 0x80000025, -1);
    AddConstEx( id, "STATUS_LONGJUMP", 0x80000026, -1);
    AddConstEx( id, "STATUS_CLEANER_CARTRIDGE_INSTALLED", 0x80000027, -1);
    AddConstEx( id, "STATUS_PLUGPLAY_QUERY_VETOED", 0x80000028, -1);
    AddConstEx( id, "STATUS_UNWIND_CONSOLIDATE", 0x80000029, -1);
    AddConstEx( id, "STATUS_REGISTRY_HIVE_RECOVERED", 0x8000002A, -1);
    AddConstEx( id, "STATUS_DLL_MIGHT_BE_INSECURE", 0x8000002B, -1);
    AddConstEx( id, "STATUS_DLL_MIGHT_BE_INCOMPATIBLE", 0x8000002C, -1);
    AddConstEx( id, "STATUS_STOPPED_ON_SYMLINK", 0x8000002D, -1);
    AddConstEx( id, "STATUS_CANNOT_GRANT_REQUESTED_OPLOCK", 0x8000002E, -1);
    AddConstEx( id, "STATUS_NO_ACE_CONDITION", 0x8000002F, -1);
    AddConstEx( id, "STATUS_DEVICE_SUPPORT_IN_PROGRESS", 0x80000030, -1);
    AddConstEx( id, "STATUS_DEVICE_POWER_CYCLE_REQUIRED", 0x80000031, -1);
    AddConstEx( id, "STATUS_NO_WORK_DONE", 0x80000032, -1);
    AddConstEx( id, "STATUS_DEVICE_REQUIRES_CLEANING", 0x80000288, -1);
    AddConstEx( id, "STATUS_DEVICE_DOOR_OPEN", 0x80000289, -1);
    AddConstEx( id, "STATUS_DATA_LOST_REPAIR", 0x80000803, -1);
    AddConstEx( id, "STATUS_GPIO_INTERRUPT_ALREADY_UNMASKED", 0x8000A127, -1);
    AddConstEx( id, "STATUS_CLOUD_FILE_PROPERTY_BLOB_CHECKSUM_MISMATCH", 0x8000CF00, -1);
    AddConstEx( id, "STATUS_CLOUD_FILE_PROPERTY_BLOB_TOO_LARGE", 0x8000CF04, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_ALREADY_UP", 0x80130001, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_ALREADY_DOWN", 0x80130002, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETWORK_ALREADY_ONLINE", 0x80130003, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE", 0x80130004, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_ALREADY_MEMBER", 0x80130005, -1);
    AddConstEx( id, "STATUS_COULD_NOT_RESIZE_LOG", 0x80190009, -1);
    AddConstEx( id, "STATUS_NO_TXF_METADATA", 0x80190029, -1);
    AddConstEx( id, "STATUS_CANT_RECOVER_WITH_HANDLE_OPEN", 0x80190031, -1);
    AddConstEx( id, "STATUS_TXF_METADATA_ALREADY_PRESENT", 0x80190041, -1);
    AddConstEx( id, "STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET", 0x80190042, -1);
    AddConstEx( id, "STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED", 0x801B00EB, -1);
    AddConstEx( id, "STATUS_FLT_BUFFER_TOO_SMALL", 0x801C0001, -1);
    AddConstEx( id, "STATUS_FVE_PARTIAL_METADATA", 0x80210001, -1);
    AddConstEx( id, "STATUS_FVE_TRANSIENT_STATE", 0x80210002, -1);
    AddConstEx( id, "STATUS_VID_REMOTE_NODE_PARENT_GPA_PAGES_USED", 0x80370001, -1);
    AddConstEx( id, "STATUS_VOLMGR_INCOMPLETE_REGENERATION", 0x80380001, -1);
    AddConstEx( id, "STATUS_VOLMGR_INCOMPLETE_DISK_MIGRATION", 0x80380002, -1);
    AddConstEx( id, "STATUS_BCD_NOT_ALL_ENTRIES_IMPORTED", 0x80390001, -1);
    AddConstEx( id, "STATUS_BCD_NOT_ALL_ENTRIES_SYNCHRONIZED", 0x80390003, -1);
    AddConstEx( id, "STATUS_QUERY_STORAGE_ERROR", 0x803A0001, -1);
    AddConstEx( id, "STATUS_GDI_HANDLE_LEAK", 0x803F0001, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_NOT_ENABLED", 0x80430006, -1);
    AddConstEx( id, "STATUS_UNSUCCESSFUL", 0xC0000001, -1);
    AddConstEx( id, "STATUS_NOT_IMPLEMENTED", 0xC0000002, -1);
    AddConstEx( id, "STATUS_INVALID_INFO_CLASS", 0xC0000003, -1);
    AddConstEx( id, "STATUS_INFO_LENGTH_MISMATCH", 0xC0000004, -1);
    AddConstEx( id, "STATUS_ACCESS_VIOLATION", 0xC0000005, -1);
    AddConstEx( id, "STATUS_IN_PAGE_ERROR", 0xC0000006, -1);
    AddConstEx( id, "STATUS_PAGEFILE_QUOTA", 0xC0000007, -1);
    AddConstEx( id, "STATUS_INVALID_HANDLE", 0xC0000008, -1);
    AddConstEx( id, "STATUS_BAD_INITIAL_STACK", 0xC0000009, -1);
    AddConstEx( id, "STATUS_BAD_INITIAL_PC", 0xC000000A, -1);
    AddConstEx( id, "STATUS_INVALID_CID", 0xC000000B, -1);
    AddConstEx( id, "STATUS_TIMER_NOT_CANCELED", 0xC000000C, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER", 0xC000000D, -1);
    AddConstEx( id, "STATUS_NO_SUCH_DEVICE", 0xC000000E, -1);
    AddConstEx( id, "STATUS_NO_SUCH_FILE", 0xC000000F, -1);
    AddConstEx( id, "STATUS_INVALID_DEVICE_REQUEST", 0xC0000010, -1);
    AddConstEx( id, "STATUS_END_OF_FILE", 0xC0000011, -1);
    AddConstEx( id, "STATUS_WRONG_VOLUME", 0xC0000012, -1);
    AddConstEx( id, "STATUS_NO_MEDIA_IN_DEVICE", 0xC0000013, -1);
    AddConstEx( id, "STATUS_UNRECOGNIZED_MEDIA", 0xC0000014, -1);
    AddConstEx( id, "STATUS_NONEXISTENT_SECTOR", 0xC0000015, -1);
    AddConstEx( id, "STATUS_MORE_PROCESSING_REQUIRED", 0xC0000016, -1);
    AddConstEx( id, "STATUS_NO_MEMORY", 0xC0000017, -1);
    AddConstEx( id, "STATUS_CONFLICTING_ADDRESSES", 0xC0000018, -1);
    AddConstEx( id, "STATUS_NOT_MAPPED_VIEW", 0xC0000019, -1);
    AddConstEx( id, "STATUS_UNABLE_TO_FREE_VM", 0xC000001A, -1);
    AddConstEx( id, "STATUS_UNABLE_TO_DELETE_SECTION", 0xC000001B, -1);
    AddConstEx( id, "STATUS_INVALID_SYSTEM_SERVICE", 0xC000001C, -1);
    AddConstEx( id, "STATUS_ILLEGAL_INSTRUCTION", 0xC000001D, -1);
    AddConstEx( id, "STATUS_INVALID_LOCK_SEQUENCE", 0xC000001E, -1);
    AddConstEx( id, "STATUS_INVALID_VIEW_SIZE", 0xC000001F, -1);
    AddConstEx( id, "STATUS_INVALID_FILE_FOR_SECTION", 0xC0000020, -1);
    AddConstEx( id, "STATUS_ALREADY_COMMITTED", 0xC0000021, -1);
    AddConstEx( id, "STATUS_ACCESS_DENIED", 0xC0000022, -1);
    AddConstEx( id, "STATUS_BUFFER_TOO_SMALL", 0xC0000023, -1);
    AddConstEx( id, "STATUS_OBJECT_TYPE_MISMATCH", 0xC0000024, -1);
    AddConstEx( id, "STATUS_NONCONTINUABLE_EXCEPTION", 0xC0000025, -1);
    AddConstEx( id, "STATUS_INVALID_DISPOSITION", 0xC0000026, -1);
    AddConstEx( id, "STATUS_UNWIND", 0xC0000027, -1);
    AddConstEx( id, "STATUS_BAD_STACK", 0xC0000028, -1);
    AddConstEx( id, "STATUS_INVALID_UNWIND_TARGET", 0xC0000029, -1);
    AddConstEx( id, "STATUS_NOT_LOCKED", 0xC000002A, -1);
    AddConstEx( id, "STATUS_PARITY_ERROR", 0xC000002B, -1);
    AddConstEx( id, "STATUS_UNABLE_TO_DECOMMIT_VM", 0xC000002C, -1);
    AddConstEx( id, "STATUS_NOT_COMMITTED", 0xC000002D, -1);
    AddConstEx( id, "STATUS_INVALID_PORT_ATTRIBUTES", 0xC000002E, -1);
    AddConstEx( id, "STATUS_PORT_MESSAGE_TOO_LONG", 0xC000002F, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_MIX", 0xC0000030, -1);
    AddConstEx( id, "STATUS_INVALID_QUOTA_LOWER", 0xC0000031, -1);
    AddConstEx( id, "STATUS_DISK_CORRUPT_ERROR", 0xC0000032, -1);
    AddConstEx( id, "STATUS_OBJECT_NAME_INVALID", 0xC0000033, -1);
    AddConstEx( id, "STATUS_OBJECT_NAME_NOT_FOUND", 0xC0000034, -1);
    AddConstEx( id, "STATUS_OBJECT_NAME_COLLISION", 0xC0000035, -1);
    AddConstEx( id, "STATUS_PORT_DO_NOT_DISTURB", 0xC0000036, -1);
    AddConstEx( id, "STATUS_PORT_DISCONNECTED", 0xC0000037, -1);
    AddConstEx( id, "STATUS_DEVICE_ALREADY_ATTACHED", 0xC0000038, -1);
    AddConstEx( id, "STATUS_OBJECT_PATH_INVALID", 0xC0000039, -1);
    AddConstEx( id, "STATUS_OBJECT_PATH_NOT_FOUND", 0xC000003A, -1);
    AddConstEx( id, "STATUS_OBJECT_PATH_SYNTAX_BAD", 0xC000003B, -1);
    AddConstEx( id, "STATUS_DATA_OVERRUN", 0xC000003C, -1);
    AddConstEx( id, "STATUS_DATA_LATE_ERROR", 0xC000003D, -1);
    AddConstEx( id, "STATUS_DATA_ERROR", 0xC000003E, -1);
    AddConstEx( id, "STATUS_CRC_ERROR", 0xC000003F, -1);
    AddConstEx( id, "STATUS_SECTION_TOO_BIG", 0xC0000040, -1);
    AddConstEx( id, "STATUS_PORT_CONNECTION_REFUSED", 0xC0000041, -1);
    AddConstEx( id, "STATUS_INVALID_PORT_HANDLE", 0xC0000042, -1);
    AddConstEx( id, "STATUS_SHARING_VIOLATION", 0xC0000043, -1);
    AddConstEx( id, "STATUS_QUOTA_EXCEEDED", 0xC0000044, -1);
    AddConstEx( id, "STATUS_INVALID_PAGE_PROTECTION", 0xC0000045, -1);
    AddConstEx( id, "STATUS_MUTANT_NOT_OWNED", 0xC0000046, -1);
    AddConstEx( id, "STATUS_SEMAPHORE_LIMIT_EXCEEDED", 0xC0000047, -1);
    AddConstEx( id, "STATUS_PORT_ALREADY_SET", 0xC0000048, -1);
    AddConstEx( id, "STATUS_SECTION_NOT_IMAGE", 0xC0000049, -1);
    AddConstEx( id, "STATUS_SUSPEND_COUNT_EXCEEDED", 0xC000004A, -1);
    AddConstEx( id, "STATUS_THREAD_IS_TERMINATING", 0xC000004B, -1);
    AddConstEx( id, "STATUS_BAD_WORKING_SET_LIMIT", 0xC000004C, -1);
    AddConstEx( id, "STATUS_INCOMPATIBLE_FILE_MAP", 0xC000004D, -1);
    AddConstEx( id, "STATUS_SECTION_PROTECTION", 0xC000004E, -1);
    AddConstEx( id, "STATUS_EAS_NOT_SUPPORTED", 0xC000004F, -1);
    AddConstEx( id, "STATUS_EA_TOO_LARGE", 0xC0000050, -1);
    AddConstEx( id, "STATUS_NONEXISTENT_EA_ENTRY", 0xC0000051, -1);
    AddConstEx( id, "STATUS_NO_EAS_ON_FILE", 0xC0000052, -1);
    AddConstEx( id, "STATUS_EA_CORRUPT_ERROR", 0xC0000053, -1);
    AddConstEx( id, "STATUS_FILE_LOCK_CONFLICT", 0xC0000054, -1);
    AddConstEx( id, "STATUS_LOCK_NOT_GRANTED", 0xC0000055, -1);
    AddConstEx( id, "STATUS_DELETE_PENDING", 0xC0000056, -1);
    AddConstEx( id, "STATUS_CTL_FILE_NOT_SUPPORTED", 0xC0000057, -1);
    AddConstEx( id, "STATUS_UNKNOWN_REVISION", 0xC0000058, -1);
    AddConstEx( id, "STATUS_REVISION_MISMATCH", 0xC0000059, -1);
    AddConstEx( id, "STATUS_INVALID_OWNER", 0xC000005A, -1);
    AddConstEx( id, "STATUS_INVALID_PRIMARY_GROUP", 0xC000005B, -1);
    AddConstEx( id, "STATUS_NO_IMPERSONATION_TOKEN", 0xC000005C, -1);
    AddConstEx( id, "STATUS_CANT_DISABLE_MANDATORY", 0xC000005D, -1);
    AddConstEx( id, "STATUS_NO_LOGON_SERVERS", 0xC000005E, -1);
    AddConstEx( id, "STATUS_NO_SUCH_LOGON_SESSION", 0xC000005F, -1);
    AddConstEx( id, "STATUS_NO_SUCH_PRIVILEGE", 0xC0000060, -1);
    AddConstEx( id, "STATUS_PRIVILEGE_NOT_HELD", 0xC0000061, -1);
    AddConstEx( id, "STATUS_INVALID_ACCOUNT_NAME", 0xC0000062, -1);
    AddConstEx( id, "STATUS_USER_EXISTS", 0xC0000063, -1);
    AddConstEx( id, "STATUS_NO_SUCH_USER", 0xC0000064, -1);
    AddConstEx( id, "STATUS_GROUP_EXISTS", 0xC0000065, -1);
    AddConstEx( id, "STATUS_NO_SUCH_GROUP", 0xC0000066, -1);
    AddConstEx( id, "STATUS_MEMBER_IN_GROUP", 0xC0000067, -1);
    AddConstEx( id, "STATUS_MEMBER_NOT_IN_GROUP", 0xC0000068, -1);
    AddConstEx( id, "STATUS_LAST_ADMIN", 0xC0000069, -1);
    AddConstEx( id, "STATUS_WRONG_PASSWORD", 0xC000006A, -1);
    AddConstEx( id, "STATUS_ILL_FORMED_PASSWORD", 0xC000006B, -1);
    AddConstEx( id, "STATUS_PASSWORD_RESTRICTION", 0xC000006C, -1);
    AddConstEx( id, "STATUS_LOGON_FAILURE", 0xC000006D, -1);
    AddConstEx( id, "STATUS_ACCOUNT_RESTRICTION", 0xC000006E, -1);
    AddConstEx( id, "STATUS_INVALID_LOGON_HOURS", 0xC000006F, -1);
    AddConstEx( id, "STATUS_INVALID_WORKSTATION", 0xC0000070, -1);
    AddConstEx( id, "STATUS_PASSWORD_EXPIRED", 0xC0000071, -1);
    AddConstEx( id, "STATUS_ACCOUNT_DISABLED", 0xC0000072, -1);
    AddConstEx( id, "STATUS_NONE_MAPPED", 0xC0000073, -1);
    AddConstEx( id, "STATUS_TOO_MANY_LUIDS_REQUESTED", 0xC0000074, -1);
    AddConstEx( id, "STATUS_LUIDS_EXHAUSTED", 0xC0000075, -1);
    AddConstEx( id, "STATUS_INVALID_SUB_AUTHORITY", 0xC0000076, -1);
    AddConstEx( id, "STATUS_INVALID_ACL", 0xC0000077, -1);
    AddConstEx( id, "STATUS_INVALID_SID", 0xC0000078, -1);
    AddConstEx( id, "STATUS_INVALID_SECURITY_DESCR", 0xC0000079, -1);
    AddConstEx( id, "STATUS_PROCEDURE_NOT_FOUND", 0xC000007A, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_FORMAT", 0xC000007B, -1);
    AddConstEx( id, "STATUS_NO_TOKEN", 0xC000007C, -1);
    AddConstEx( id, "STATUS_BAD_INHERITANCE_ACL", 0xC000007D, -1);
    AddConstEx( id, "STATUS_RANGE_NOT_LOCKED", 0xC000007E, -1);
    AddConstEx( id, "STATUS_DISK_FULL", 0xC000007F, -1);
    AddConstEx( id, "STATUS_SERVER_DISABLED", 0xC0000080, -1);
    AddConstEx( id, "STATUS_SERVER_NOT_DISABLED", 0xC0000081, -1);
    AddConstEx( id, "STATUS_TOO_MANY_GUIDS_REQUESTED", 0xC0000082, -1);
    AddConstEx( id, "STATUS_GUIDS_EXHAUSTED", 0xC0000083, -1);
    AddConstEx( id, "STATUS_INVALID_ID_AUTHORITY", 0xC0000084, -1);
    AddConstEx( id, "STATUS_AGENTS_EXHAUSTED", 0xC0000085, -1);
    AddConstEx( id, "STATUS_INVALID_VOLUME_LABEL", 0xC0000086, -1);
    AddConstEx( id, "STATUS_SECTION_NOT_EXTENDED", 0xC0000087, -1);
    AddConstEx( id, "STATUS_NOT_MAPPED_DATA", 0xC0000088, -1);
    AddConstEx( id, "STATUS_RESOURCE_DATA_NOT_FOUND", 0xC0000089, -1);
    AddConstEx( id, "STATUS_RESOURCE_TYPE_NOT_FOUND", 0xC000008A, -1);
    AddConstEx( id, "STATUS_RESOURCE_NAME_NOT_FOUND", 0xC000008B, -1);
    AddConstEx( id, "STATUS_ARRAY_BOUNDS_EXCEEDED", 0xC000008C, -1);
    AddConstEx( id, "STATUS_FLOAT_DENORMAL_OPERAND", 0xC000008D, -1);
    AddConstEx( id, "STATUS_FLOAT_DIVIDE_BY_ZERO", 0xC000008E, -1);
    AddConstEx( id, "STATUS_FLOAT_INEXACT_RESULT", 0xC000008F, -1);
    AddConstEx( id, "STATUS_FLOAT_INVALID_OPERATION", 0xC0000090, -1);
    AddConstEx( id, "STATUS_FLOAT_OVERFLOW", 0xC0000091, -1);
    AddConstEx( id, "STATUS_FLOAT_STACK_CHECK", 0xC0000092, -1);
    AddConstEx( id, "STATUS_FLOAT_UNDERFLOW", 0xC0000093, -1);
    AddConstEx( id, "STATUS_INTEGER_DIVIDE_BY_ZERO", 0xC0000094, -1);
    AddConstEx( id, "STATUS_INTEGER_OVERFLOW", 0xC0000095, -1);
    AddConstEx( id, "STATUS_PRIVILEGED_INSTRUCTION", 0xC0000096, -1);
    AddConstEx( id, "STATUS_TOO_MANY_PAGING_FILES", 0xC0000097, -1);
    AddConstEx( id, "STATUS_FILE_INVALID", 0xC0000098, -1);
    AddConstEx( id, "STATUS_ALLOTTED_SPACE_EXCEEDED", 0xC0000099, -1);
    AddConstEx( id, "STATUS_INSUFFICIENT_RESOURCES", 0xC000009A, -1);
    AddConstEx( id, "STATUS_DFS_EXIT_PATH_FOUND", 0xC000009B, -1);
    AddConstEx( id, "STATUS_DEVICE_DATA_ERROR", 0xC000009C, -1);
    AddConstEx( id, "STATUS_DEVICE_NOT_CONNECTED", 0xC000009D, -1);
    AddConstEx( id, "STATUS_DEVICE_POWER_FAILURE", 0xC000009E, -1);
    AddConstEx( id, "STATUS_FREE_VM_NOT_AT_BASE", 0xC000009F, -1);
    AddConstEx( id, "STATUS_MEMORY_NOT_ALLOCATED", 0xC00000A0, -1);
    AddConstEx( id, "STATUS_WORKING_SET_QUOTA", 0xC00000A1, -1);
    AddConstEx( id, "STATUS_MEDIA_WRITE_PROTECTED", 0xC00000A2, -1);
    AddConstEx( id, "STATUS_DEVICE_NOT_READY", 0xC00000A3, -1);
    AddConstEx( id, "STATUS_INVALID_GROUP_ATTRIBUTES", 0xC00000A4, -1);
    AddConstEx( id, "STATUS_BAD_IMPERSONATION_LEVEL", 0xC00000A5, -1);
    AddConstEx( id, "STATUS_CANT_OPEN_ANONYMOUS", 0xC00000A6, -1);
    AddConstEx( id, "STATUS_BAD_VALIDATION_CLASS", 0xC00000A7, -1);
    AddConstEx( id, "STATUS_BAD_TOKEN_TYPE", 0xC00000A8, -1);
    AddConstEx( id, "STATUS_BAD_MASTER_BOOT_RECORD", 0xC00000A9, -1);
    AddConstEx( id, "STATUS_INSTRUCTION_MISALIGNMENT", 0xC00000AA, -1);
    AddConstEx( id, "STATUS_INSTANCE_NOT_AVAILABLE", 0xC00000AB, -1);
    AddConstEx( id, "STATUS_PIPE_NOT_AVAILABLE", 0xC00000AC, -1);
    AddConstEx( id, "STATUS_INVALID_PIPE_STATE", 0xC00000AD, -1);
    AddConstEx( id, "STATUS_PIPE_BUSY", 0xC00000AE, -1);
    AddConstEx( id, "STATUS_ILLEGAL_FUNCTION", 0xC00000AF, -1);
    AddConstEx( id, "STATUS_PIPE_DISCONNECTED", 0xC00000B0, -1);
    AddConstEx( id, "STATUS_PIPE_CLOSING", 0xC00000B1, -1);
    AddConstEx( id, "STATUS_PIPE_CONNECTED", 0xC00000B2, -1);
    AddConstEx( id, "STATUS_PIPE_LISTENING", 0xC00000B3, -1);
    AddConstEx( id, "STATUS_INVALID_READ_MODE", 0xC00000B4, -1);
    AddConstEx( id, "STATUS_IO_TIMEOUT", 0xC00000B5, -1);
    AddConstEx( id, "STATUS_FILE_FORCED_CLOSED", 0xC00000B6, -1);
    AddConstEx( id, "STATUS_PROFILING_NOT_STARTED", 0xC00000B7, -1);
    AddConstEx( id, "STATUS_PROFILING_NOT_STOPPED", 0xC00000B8, -1);
    AddConstEx( id, "STATUS_COULD_NOT_INTERPRET", 0xC00000B9, -1);
    AddConstEx( id, "STATUS_FILE_IS_A_DIRECTORY", 0xC00000BA, -1);
    AddConstEx( id, "STATUS_NOT_SUPPORTED", 0xC00000BB, -1);
    AddConstEx( id, "STATUS_REMOTE_NOT_LISTENING", 0xC00000BC, -1);
    AddConstEx( id, "STATUS_DUPLICATE_NAME", 0xC00000BD, -1);
    AddConstEx( id, "STATUS_BAD_NETWORK_PATH", 0xC00000BE, -1);
    AddConstEx( id, "STATUS_NETWORK_BUSY", 0xC00000BF, -1);
    AddConstEx( id, "STATUS_DEVICE_DOES_NOT_EXIST", 0xC00000C0, -1);
    AddConstEx( id, "STATUS_TOO_MANY_COMMANDS", 0xC00000C1, -1);
    AddConstEx( id, "STATUS_ADAPTER_HARDWARE_ERROR", 0xC00000C2, -1);
    AddConstEx( id, "STATUS_INVALID_NETWORK_RESPONSE", 0xC00000C3, -1);
    AddConstEx( id, "STATUS_UNEXPECTED_NETWORK_ERROR", 0xC00000C4, -1);
    AddConstEx( id, "STATUS_BAD_REMOTE_ADAPTER", 0xC00000C5, -1);
    AddConstEx( id, "STATUS_PRINT_QUEUE_FULL", 0xC00000C6, -1);
    AddConstEx( id, "STATUS_NO_SPOOL_SPACE", 0xC00000C7, -1);
    AddConstEx( id, "STATUS_PRINT_CANCELLED", 0xC00000C8, -1);
    AddConstEx( id, "STATUS_NETWORK_NAME_DELETED", 0xC00000C9, -1);
    AddConstEx( id, "STATUS_NETWORK_ACCESS_DENIED", 0xC00000CA, -1);
    AddConstEx( id, "STATUS_BAD_DEVICE_TYPE", 0xC00000CB, -1);
    AddConstEx( id, "STATUS_BAD_NETWORK_NAME", 0xC00000CC, -1);
    AddConstEx( id, "STATUS_TOO_MANY_NAMES", 0xC00000CD, -1);
    AddConstEx( id, "STATUS_TOO_MANY_SESSIONS", 0xC00000CE, -1);
    AddConstEx( id, "STATUS_SHARING_PAUSED", 0xC00000CF, -1);
    AddConstEx( id, "STATUS_REQUEST_NOT_ACCEPTED", 0xC00000D0, -1);
    AddConstEx( id, "STATUS_REDIRECTOR_PAUSED", 0xC00000D1, -1);
    AddConstEx( id, "STATUS_NET_WRITE_FAULT", 0xC00000D2, -1);
    AddConstEx( id, "STATUS_PROFILING_AT_LIMIT", 0xC00000D3, -1);
    AddConstEx( id, "STATUS_NOT_SAME_DEVICE", 0xC00000D4, -1);
    AddConstEx( id, "STATUS_FILE_RENAMED", 0xC00000D5, -1);
    AddConstEx( id, "STATUS_VIRTUAL_CIRCUIT_CLOSED", 0xC00000D6, -1);
    AddConstEx( id, "STATUS_NO_SECURITY_ON_OBJECT", 0xC00000D7, -1);
    AddConstEx( id, "STATUS_CANT_WAIT", 0xC00000D8, -1);
    AddConstEx( id, "STATUS_PIPE_EMPTY", 0xC00000D9, -1);
    AddConstEx( id, "STATUS_CANT_ACCESS_DOMAIN_INFO", 0xC00000DA, -1);
    AddConstEx( id, "STATUS_CANT_TERMINATE_SELF", 0xC00000DB, -1);
    AddConstEx( id, "STATUS_INVALID_SERVER_STATE", 0xC00000DC, -1);
    AddConstEx( id, "STATUS_INVALID_DOMAIN_STATE", 0xC00000DD, -1);
    AddConstEx( id, "STATUS_INVALID_DOMAIN_ROLE", 0xC00000DE, -1);
    AddConstEx( id, "STATUS_NO_SUCH_DOMAIN", 0xC00000DF, -1);
    AddConstEx( id, "STATUS_DOMAIN_EXISTS", 0xC00000E0, -1);
    AddConstEx( id, "STATUS_DOMAIN_LIMIT_EXCEEDED", 0xC00000E1, -1);
    AddConstEx( id, "STATUS_OPLOCK_NOT_GRANTED", 0xC00000E2, -1);
    AddConstEx( id, "STATUS_INVALID_OPLOCK_PROTOCOL", 0xC00000E3, -1);
    AddConstEx( id, "STATUS_INTERNAL_DB_CORRUPTION", 0xC00000E4, -1);
    AddConstEx( id, "STATUS_INTERNAL_ERROR", 0xC00000E5, -1);
    AddConstEx( id, "STATUS_GENERIC_NOT_MAPPED", 0xC00000E6, -1);
    AddConstEx( id, "STATUS_BAD_DESCRIPTOR_FORMAT", 0xC00000E7, -1);
    AddConstEx( id, "STATUS_INVALID_USER_BUFFER", 0xC00000E8, -1);
    AddConstEx( id, "STATUS_UNEXPECTED_IO_ERROR", 0xC00000E9, -1);
    AddConstEx( id, "STATUS_UNEXPECTED_MM_CREATE_ERR", 0xC00000EA, -1);
    AddConstEx( id, "STATUS_UNEXPECTED_MM_MAP_ERROR", 0xC00000EB, -1);
    AddConstEx( id, "STATUS_UNEXPECTED_MM_EXTEND_ERR", 0xC00000EC, -1);
    AddConstEx( id, "STATUS_NOT_LOGON_PROCESS", 0xC00000ED, -1);
    AddConstEx( id, "STATUS_LOGON_SESSION_EXISTS", 0xC00000EE, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_1", 0xC00000EF, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_2", 0xC00000F0, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_3", 0xC00000F1, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_4", 0xC00000F2, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_5", 0xC00000F3, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_6", 0xC00000F4, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_7", 0xC00000F5, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_8", 0xC00000F6, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_9", 0xC00000F7, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_10", 0xC00000F8, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_11", 0xC00000F9, -1);
    AddConstEx( id, "STATUS_INVALID_PARAMETER_12", 0xC00000FA, -1);
    AddConstEx( id, "STATUS_REDIRECTOR_NOT_STARTED", 0xC00000FB, -1);
    AddConstEx( id, "STATUS_REDIRECTOR_STARTED", 0xC00000FC, -1);
    AddConstEx( id, "STATUS_STACK_OVERFLOW", 0xC00000FD, -1);
    AddConstEx( id, "STATUS_NO_SUCH_PACKAGE", 0xC00000FE, -1);
    AddConstEx( id, "STATUS_BAD_FUNCTION_TABLE", 0xC00000FF, -1);
    AddConstEx( id, "STATUS_VARIABLE_NOT_FOUND", 0xC0000100, -1);
    AddConstEx( id, "STATUS_DIRECTORY_NOT_EMPTY", 0xC0000101, -1);
    AddConstEx( id, "STATUS_FILE_CORRUPT_ERROR", 0xC0000102, -1);
    AddConstEx( id, "STATUS_NOT_A_DIRECTORY", 0xC0000103, -1);
    AddConstEx( id, "STATUS_BAD_LOGON_SESSION_STATE", 0xC0000104, -1);
    AddConstEx( id, "STATUS_LOGON_SESSION_COLLISION", 0xC0000105, -1);
    AddConstEx( id, "STATUS_NAME_TOO_LONG", 0xC0000106, -1);
    AddConstEx( id, "STATUS_FILES_OPEN", 0xC0000107, -1);
    AddConstEx( id, "STATUS_CONNECTION_IN_USE", 0xC0000108, -1);
    AddConstEx( id, "STATUS_MESSAGE_NOT_FOUND", 0xC0000109, -1);
    AddConstEx( id, "STATUS_PROCESS_IS_TERMINATING", 0xC000010A, -1);
    AddConstEx( id, "STATUS_INVALID_LOGON_TYPE", 0xC000010B, -1);
    AddConstEx( id, "STATUS_NO_GUID_TRANSLATION", 0xC000010C, -1);
    AddConstEx( id, "STATUS_CANNOT_IMPERSONATE", 0xC000010D, -1);
    AddConstEx( id, "STATUS_IMAGE_ALREADY_LOADED", 0xC000010E, -1);
    AddConstEx( id, "STATUS_ABIOS_NOT_PRESENT", 0xC000010F, -1);
    AddConstEx( id, "STATUS_ABIOS_LID_NOT_EXIST", 0xC0000110, -1);
    AddConstEx( id, "STATUS_ABIOS_LID_ALREADY_OWNED", 0xC0000111, -1);
    AddConstEx( id, "STATUS_ABIOS_NOT_LID_OWNER", 0xC0000112, -1);
    AddConstEx( id, "STATUS_ABIOS_INVALID_COMMAND", 0xC0000113, -1);
    AddConstEx( id, "STATUS_ABIOS_INVALID_LID", 0xC0000114, -1);
    AddConstEx( id, "STATUS_ABIOS_SELECTOR_NOT_AVAILABLE", 0xC0000115, -1);
    AddConstEx( id, "STATUS_ABIOS_INVALID_SELECTOR", 0xC0000116, -1);
    AddConstEx( id, "STATUS_NO_LDT", 0xC0000117, -1);
    AddConstEx( id, "STATUS_INVALID_LDT_SIZE", 0xC0000118, -1);
    AddConstEx( id, "STATUS_INVALID_LDT_OFFSET", 0xC0000119, -1);
    AddConstEx( id, "STATUS_INVALID_LDT_DESCRIPTOR", 0xC000011A, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_NE_FORMAT", 0xC000011B, -1);
    AddConstEx( id, "STATUS_RXACT_INVALID_STATE", 0xC000011C, -1);
    AddConstEx( id, "STATUS_RXACT_COMMIT_FAILURE", 0xC000011D, -1);
    AddConstEx( id, "STATUS_MAPPED_FILE_SIZE_ZERO", 0xC000011E, -1);
    AddConstEx( id, "STATUS_TOO_MANY_OPENED_FILES", 0xC000011F, -1);
    AddConstEx( id, "STATUS_CANCELLED", 0xC0000120, -1);
    AddConstEx( id, "STATUS_CANNOT_DELETE", 0xC0000121, -1);
    AddConstEx( id, "STATUS_INVALID_COMPUTER_NAME", 0xC0000122, -1);
    AddConstEx( id, "STATUS_FILE_DELETED", 0xC0000123, -1);
    AddConstEx( id, "STATUS_SPECIAL_ACCOUNT", 0xC0000124, -1);
    AddConstEx( id, "STATUS_SPECIAL_GROUP", 0xC0000125, -1);
    AddConstEx( id, "STATUS_SPECIAL_USER", 0xC0000126, -1);
    AddConstEx( id, "STATUS_MEMBERS_PRIMARY_GROUP", 0xC0000127, -1);
    AddConstEx( id, "STATUS_FILE_CLOSED", 0xC0000128, -1);
    AddConstEx( id, "STATUS_TOO_MANY_THREADS", 0xC0000129, -1);
    AddConstEx( id, "STATUS_THREAD_NOT_IN_PROCESS", 0xC000012A, -1);
    AddConstEx( id, "STATUS_TOKEN_ALREADY_IN_USE", 0xC000012B, -1);
    AddConstEx( id, "STATUS_PAGEFILE_QUOTA_EXCEEDED", 0xC000012C, -1);
    AddConstEx( id, "STATUS_COMMITMENT_LIMIT", 0xC000012D, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_LE_FORMAT", 0xC000012E, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_NOT_MZ", 0xC000012F, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_PROTECT", 0xC0000130, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_WIN_16", 0xC0000131, -1);
    AddConstEx( id, "STATUS_LOGON_SERVER_CONFLICT", 0xC0000132, -1);
    AddConstEx( id, "STATUS_TIME_DIFFERENCE_AT_DC", 0xC0000133, -1);
    AddConstEx( id, "STATUS_SYNCHRONIZATION_REQUIRED", 0xC0000134, -1);
    AddConstEx( id, "STATUS_DLL_NOT_FOUND", 0xC0000135, -1);
    AddConstEx( id, "STATUS_OPEN_FAILED", 0xC0000136, -1);
    AddConstEx( id, "STATUS_IO_PRIVILEGE_FAILED", 0xC0000137, -1);
    AddConstEx( id, "STATUS_ORDINAL_NOT_FOUND", 0xC0000138, -1);
    AddConstEx( id, "STATUS_ENTRYPOINT_NOT_FOUND", 0xC0000139, -1);
    AddConstEx( id, "STATUS_CONTROL_C_EXIT", 0xC000013A, -1);
    AddConstEx( id, "STATUS_LOCAL_DISCONNECT", 0xC000013B, -1);
    AddConstEx( id, "STATUS_REMOTE_DISCONNECT", 0xC000013C, -1);
    AddConstEx( id, "STATUS_REMOTE_RESOURCES", 0xC000013D, -1);
    AddConstEx( id, "STATUS_LINK_FAILED", 0xC000013E, -1);
    AddConstEx( id, "STATUS_LINK_TIMEOUT", 0xC000013F, -1);
    AddConstEx( id, "STATUS_INVALID_CONNECTION", 0xC0000140, -1);
    AddConstEx( id, "STATUS_INVALID_ADDRESS", 0xC0000141, -1);
    AddConstEx( id, "STATUS_DLL_INIT_FAILED", 0xC0000142, -1);
    AddConstEx( id, "STATUS_MISSING_SYSTEMFILE", 0xC0000143, -1);
    AddConstEx( id, "STATUS_UNHANDLED_EXCEPTION", 0xC0000144, -1);
    AddConstEx( id, "STATUS_APP_INIT_FAILURE", 0xC0000145, -1);
    AddConstEx( id, "STATUS_PAGEFILE_CREATE_FAILED", 0xC0000146, -1);
    AddConstEx( id, "STATUS_NO_PAGEFILE", 0xC0000147, -1);
    AddConstEx( id, "STATUS_INVALID_LEVEL", 0xC0000148, -1);
    AddConstEx( id, "STATUS_WRONG_PASSWORD_CORE", 0xC0000149, -1);
    AddConstEx( id, "STATUS_ILLEGAL_FLOAT_CONTEXT", 0xC000014A, -1);
    AddConstEx( id, "STATUS_PIPE_BROKEN", 0xC000014B, -1);
    AddConstEx( id, "STATUS_REGISTRY_CORRUPT", 0xC000014C, -1);
    AddConstEx( id, "STATUS_REGISTRY_IO_FAILED", 0xC000014D, -1);
    AddConstEx( id, "STATUS_NO_EVENT_PAIR", 0xC000014E, -1);
    AddConstEx( id, "STATUS_UNRECOGNIZED_VOLUME", 0xC000014F, -1);
    AddConstEx( id, "STATUS_SERIAL_NO_DEVICE_INITED", 0xC0000150, -1);
    AddConstEx( id, "STATUS_NO_SUCH_ALIAS", 0xC0000151, -1);
    AddConstEx( id, "STATUS_MEMBER_NOT_IN_ALIAS", 0xC0000152, -1);
    AddConstEx( id, "STATUS_MEMBER_IN_ALIAS", 0xC0000153, -1);
    AddConstEx( id, "STATUS_ALIAS_EXISTS", 0xC0000154, -1);
    AddConstEx( id, "STATUS_LOGON_NOT_GRANTED", 0xC0000155, -1);
    AddConstEx( id, "STATUS_TOO_MANY_SECRETS", 0xC0000156, -1);
    AddConstEx( id, "STATUS_SECRET_TOO_LONG", 0xC0000157, -1);
    AddConstEx( id, "STATUS_INTERNAL_DB_ERROR", 0xC0000158, -1);
    AddConstEx( id, "STATUS_FULLSCREEN_MODE", 0xC0000159, -1);
    AddConstEx( id, "STATUS_TOO_MANY_CONTEXT_IDS", 0xC000015A, -1);
    AddConstEx( id, "STATUS_LOGON_TYPE_NOT_GRANTED", 0xC000015B, -1);
    AddConstEx( id, "STATUS_NOT_REGISTRY_FILE", 0xC000015C, -1);
    AddConstEx( id, "STATUS_NT_CROSS_ENCRYPTION_REQUIRED", 0xC000015D, -1);
    AddConstEx( id, "STATUS_DOMAIN_CTRLR_CONFIG_ERROR", 0xC000015E, -1);
    AddConstEx( id, "STATUS_FT_MISSING_MEMBER", 0xC000015F, -1);
    AddConstEx( id, "STATUS_ILL_FORMED_SERVICE_ENTRY", 0xC0000160, -1);
    AddConstEx( id, "STATUS_ILLEGAL_CHARACTER", 0xC0000161, -1);
    AddConstEx( id, "STATUS_UNMAPPABLE_CHARACTER", 0xC0000162, -1);
    AddConstEx( id, "STATUS_UNDEFINED_CHARACTER", 0xC0000163, -1);
    AddConstEx( id, "STATUS_FLOPPY_VOLUME", 0xC0000164, -1);
    AddConstEx( id, "STATUS_FLOPPY_ID_MARK_NOT_FOUND", 0xC0000165, -1);
    AddConstEx( id, "STATUS_FLOPPY_WRONG_CYLINDER", 0xC0000166, -1);
    AddConstEx( id, "STATUS_FLOPPY_UNKNOWN_ERROR", 0xC0000167, -1);
    AddConstEx( id, "STATUS_FLOPPY_BAD_REGISTERS", 0xC0000168, -1);
    AddConstEx( id, "STATUS_DISK_RECALIBRATE_FAILED", 0xC0000169, -1);
    AddConstEx( id, "STATUS_DISK_OPERATION_FAILED", 0xC000016A, -1);
    AddConstEx( id, "STATUS_DISK_RESET_FAILED", 0xC000016B, -1);
    AddConstEx( id, "STATUS_SHARED_IRQ_BUSY", 0xC000016C, -1);
    AddConstEx( id, "STATUS_FT_ORPHANING", 0xC000016D, -1);
    AddConstEx( id, "STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT", 0xC000016E, -1);
    AddConstEx( id, "STATUS_PARTITION_FAILURE", 0xC0000172, -1);
    AddConstEx( id, "STATUS_INVALID_BLOCK_LENGTH", 0xC0000173, -1);
    AddConstEx( id, "STATUS_DEVICE_NOT_PARTITIONED", 0xC0000174, -1);
    AddConstEx( id, "STATUS_UNABLE_TO_LOCK_MEDIA", 0xC0000175, -1);
    AddConstEx( id, "STATUS_UNABLE_TO_UNLOAD_MEDIA", 0xC0000176, -1);
    AddConstEx( id, "STATUS_EOM_OVERFLOW", 0xC0000177, -1);
    AddConstEx( id, "STATUS_NO_MEDIA", 0xC0000178, -1);
    AddConstEx( id, "STATUS_NO_SUCH_MEMBER", 0xC000017A, -1);
    AddConstEx( id, "STATUS_INVALID_MEMBER", 0xC000017B, -1);
    AddConstEx( id, "STATUS_KEY_DELETED", 0xC000017C, -1);
    AddConstEx( id, "STATUS_NO_LOG_SPACE", 0xC000017D, -1);
    AddConstEx( id, "STATUS_TOO_MANY_SIDS", 0xC000017E, -1);
    AddConstEx( id, "STATUS_LM_CROSS_ENCRYPTION_REQUIRED", 0xC000017F, -1);
    AddConstEx( id, "STATUS_KEY_HAS_CHILDREN", 0xC0000180, -1);
    AddConstEx( id, "STATUS_CHILD_MUST_BE_VOLATILE", 0xC0000181, -1);
    AddConstEx( id, "STATUS_DEVICE_CONFIGURATION_ERROR", 0xC0000182, -1);
    AddConstEx( id, "STATUS_DRIVER_INTERNAL_ERROR", 0xC0000183, -1);
    AddConstEx( id, "STATUS_INVALID_DEVICE_STATE", 0xC0000184, -1);
    AddConstEx( id, "STATUS_IO_DEVICE_ERROR", 0xC0000185, -1);
    AddConstEx( id, "STATUS_DEVICE_PROTOCOL_ERROR", 0xC0000186, -1);
    AddConstEx( id, "STATUS_BACKUP_CONTROLLER", 0xC0000187, -1);
    AddConstEx( id, "STATUS_LOG_FILE_FULL", 0xC0000188, -1);
    AddConstEx( id, "STATUS_TOO_LATE", 0xC0000189, -1);
    AddConstEx( id, "STATUS_NO_TRUST_LSA_SECRET", 0xC000018A, -1);
    AddConstEx( id, "STATUS_NO_TRUST_SAM_ACCOUNT", 0xC000018B, -1);
    AddConstEx( id, "STATUS_TRUSTED_DOMAIN_FAILURE", 0xC000018C, -1);
    AddConstEx( id, "STATUS_TRUSTED_RELATIONSHIP_FAILURE", 0xC000018D, -1);
    AddConstEx( id, "STATUS_EVENTLOG_FILE_CORRUPT", 0xC000018E, -1);
    AddConstEx( id, "STATUS_EVENTLOG_CANT_START", 0xC000018F, -1);
    AddConstEx( id, "STATUS_TRUST_FAILURE", 0xC0000190, -1);
    AddConstEx( id, "STATUS_MUTANT_LIMIT_EXCEEDED", 0xC0000191, -1);
    AddConstEx( id, "STATUS_NETLOGON_NOT_STARTED", 0xC0000192, -1);
    AddConstEx( id, "STATUS_ACCOUNT_EXPIRED", 0xC0000193, -1);
    AddConstEx( id, "STATUS_POSSIBLE_DEADLOCK", 0xC0000194, -1);
    AddConstEx( id, "STATUS_NETWORK_CREDENTIAL_CONFLICT", 0xC0000195, -1);
    AddConstEx( id, "STATUS_REMOTE_SESSION_LIMIT", 0xC0000196, -1);
    AddConstEx( id, "STATUS_EVENTLOG_FILE_CHANGED", 0xC0000197, -1);
    AddConstEx( id, "STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT", 0xC0000198, -1);
    AddConstEx( id, "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT", 0xC0000199, -1);
    AddConstEx( id, "STATUS_NOLOGON_SERVER_TRUST_ACCOUNT", 0xC000019A, -1);
    AddConstEx( id, "STATUS_DOMAIN_TRUST_INCONSISTENT", 0xC000019B, -1);
    AddConstEx( id, "STATUS_FS_DRIVER_REQUIRED", 0xC000019C, -1);
    AddConstEx( id, "STATUS_IMAGE_ALREADY_LOADED_AS_DLL", 0xC000019D, -1);
    AddConstEx( id, "STATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING", 0xC000019E, -1);
    AddConstEx( id, "STATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME", 0xC000019F, -1);
    AddConstEx( id, "STATUS_SECURITY_STREAM_IS_INCONSISTENT", 0xC00001A0, -1);
    AddConstEx( id, "STATUS_INVALID_LOCK_RANGE", 0xC00001A1, -1);
    AddConstEx( id, "STATUS_INVALID_ACE_CONDITION", 0xC00001A2, -1);
    AddConstEx( id, "STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT", 0xC00001A3, -1);
    AddConstEx( id, "STATUS_NOTIFICATION_GUID_ALREADY_DEFINED", 0xC00001A4, -1);
    AddConstEx( id, "STATUS_INVALID_EXCEPTION_HANDLER", 0xC00001A5, -1);
    AddConstEx( id, "STATUS_DUPLICATE_PRIVILEGES", 0xC00001A6, -1);
    AddConstEx( id, "STATUS_NOT_ALLOWED_ON_SYSTEM_FILE", 0xC00001A7, -1);
    AddConstEx( id, "STATUS_REPAIR_NEEDED", 0xC00001A8, -1);
    AddConstEx( id, "STATUS_QUOTA_NOT_ENABLED", 0xC00001A9, -1);
    AddConstEx( id, "STATUS_NO_APPLICATION_PACKAGE", 0xC00001AA, -1);
    AddConstEx( id, "STATUS_FILE_METADATA_OPTIMIZATION_IN_PROGRESS", 0xC00001AB, -1);
    AddConstEx( id, "STATUS_NOT_SAME_OBJECT", 0xC00001AC, -1);
    AddConstEx( id, "STATUS_FATAL_MEMORY_EXHAUSTION", 0xC00001AD, -1);
    AddConstEx( id, "STATUS_ERROR_PROCESS_NOT_IN_JOB", 0xC00001AE, -1);
    AddConstEx( id, "STATUS_CPU_SET_INVALID", 0xC00001AF, -1);
    AddConstEx( id, "STATUS_NETWORK_OPEN_RESTRICTION", 0xC0000201, -1);
    AddConstEx( id, "STATUS_NO_USER_SESSION_KEY", 0xC0000202, -1);
    AddConstEx( id, "STATUS_USER_SESSION_DELETED", 0xC0000203, -1);
    AddConstEx( id, "STATUS_RESOURCE_LANG_NOT_FOUND", 0xC0000204, -1);
    AddConstEx( id, "STATUS_INSUFF_SERVER_RESOURCES", 0xC0000205, -1);
    AddConstEx( id, "STATUS_INVALID_BUFFER_SIZE", 0xC0000206, -1);
    AddConstEx( id, "STATUS_INVALID_ADDRESS_COMPONENT", 0xC0000207, -1);
    AddConstEx( id, "STATUS_INVALID_ADDRESS_WILDCARD", 0xC0000208, -1);
    AddConstEx( id, "STATUS_TOO_MANY_ADDRESSES", 0xC0000209, -1);
    AddConstEx( id, "STATUS_ADDRESS_ALREADY_EXISTS", 0xC000020A, -1);
    AddConstEx( id, "STATUS_ADDRESS_CLOSED", 0xC000020B, -1);
    AddConstEx( id, "STATUS_CONNECTION_DISCONNECTED", 0xC000020C, -1);
    AddConstEx( id, "STATUS_CONNECTION_RESET", 0xC000020D, -1);
    AddConstEx( id, "STATUS_TOO_MANY_NODES", 0xC000020E, -1);
    AddConstEx( id, "STATUS_TRANSACTION_ABORTED", 0xC000020F, -1);
    AddConstEx( id, "STATUS_TRANSACTION_TIMED_OUT", 0xC0000210, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NO_RELEASE", 0xC0000211, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NO_MATCH", 0xC0000212, -1);
    AddConstEx( id, "STATUS_TRANSACTION_RESPONDED", 0xC0000213, -1);
    AddConstEx( id, "STATUS_TRANSACTION_INVALID_ID", 0xC0000214, -1);
    AddConstEx( id, "STATUS_TRANSACTION_INVALID_TYPE", 0xC0000215, -1);
    AddConstEx( id, "STATUS_NOT_SERVER_SESSION", 0xC0000216, -1);
    AddConstEx( id, "STATUS_NOT_CLIENT_SESSION", 0xC0000217, -1);
    AddConstEx( id, "STATUS_CANNOT_LOAD_REGISTRY_FILE", 0xC0000218, -1);
    AddConstEx( id, "STATUS_DEBUG_ATTACH_FAILED", 0xC0000219, -1);
    AddConstEx( id, "STATUS_SYSTEM_PROCESS_TERMINATED", 0xC000021A, -1);
    AddConstEx( id, "STATUS_DATA_NOT_ACCEPTED", 0xC000021B, -1);
    AddConstEx( id, "STATUS_NO_BROWSER_SERVERS_FOUND", 0xC000021C, -1);
    AddConstEx( id, "STATUS_VDM_HARD_ERROR", 0xC000021D, -1);
    AddConstEx( id, "STATUS_DRIVER_CANCEL_TIMEOUT", 0xC000021E, -1);
    AddConstEx( id, "STATUS_REPLY_MESSAGE_MISMATCH", 0xC000021F, -1);
    AddConstEx( id, "STATUS_MAPPED_ALIGNMENT", 0xC0000220, -1);
    AddConstEx( id, "STATUS_IMAGE_CHECKSUM_MISMATCH", 0xC0000221, -1);
    AddConstEx( id, "STATUS_LOST_WRITEBEHIND_DATA", 0xC0000222, -1);
    AddConstEx( id, "STATUS_CLIENT_SERVER_PARAMETERS_INVALID", 0xC0000223, -1);
    AddConstEx( id, "STATUS_PASSWORD_MUST_CHANGE", 0xC0000224, -1);
    AddConstEx( id, "STATUS_NOT_FOUND", 0xC0000225, -1);
    AddConstEx( id, "STATUS_NOT_TINY_STREAM", 0xC0000226, -1);
    AddConstEx( id, "STATUS_RECOVERY_FAILURE", 0xC0000227, -1);
    AddConstEx( id, "STATUS_STACK_OVERFLOW_READ", 0xC0000228, -1);
    AddConstEx( id, "STATUS_FAIL_CHECK", 0xC0000229, -1);
    AddConstEx( id, "STATUS_DUPLICATE_OBJECTID", 0xC000022A, -1);
    AddConstEx( id, "STATUS_OBJECTID_EXISTS", 0xC000022B, -1);
    AddConstEx( id, "STATUS_CONVERT_TO_LARGE", 0xC000022C, -1);
    AddConstEx( id, "STATUS_RETRY", 0xC000022D, -1);
    AddConstEx( id, "STATUS_FOUND_OUT_OF_SCOPE", 0xC000022E, -1);
    AddConstEx( id, "STATUS_ALLOCATE_BUCKET", 0xC000022F, -1);
    AddConstEx( id, "STATUS_PROPSET_NOT_FOUND", 0xC0000230, -1);
    AddConstEx( id, "STATUS_MARSHALL_OVERFLOW", 0xC0000231, -1);
    AddConstEx( id, "STATUS_INVALID_VARIANT", 0xC0000232, -1);
    AddConstEx( id, "STATUS_DOMAIN_CONTROLLER_NOT_FOUND", 0xC0000233, -1);
    AddConstEx( id, "STATUS_ACCOUNT_LOCKED_OUT", 0xC0000234, -1);
    AddConstEx( id, "STATUS_HANDLE_NOT_CLOSABLE", 0xC0000235, -1);
    AddConstEx( id, "STATUS_CONNECTION_REFUSED", 0xC0000236, -1);
    AddConstEx( id, "STATUS_GRACEFUL_DISCONNECT", 0xC0000237, -1);
    AddConstEx( id, "STATUS_ADDRESS_ALREADY_ASSOCIATED", 0xC0000238, -1);
    AddConstEx( id, "STATUS_ADDRESS_NOT_ASSOCIATED", 0xC0000239, -1);
    AddConstEx( id, "STATUS_CONNECTION_INVALID", 0xC000023A, -1);
    AddConstEx( id, "STATUS_CONNECTION_ACTIVE", 0xC000023B, -1);
    AddConstEx( id, "STATUS_NETWORK_UNREACHABLE", 0xC000023C, -1);
    AddConstEx( id, "STATUS_HOST_UNREACHABLE", 0xC000023D, -1);
    AddConstEx( id, "STATUS_PROTOCOL_UNREACHABLE", 0xC000023E, -1);
    AddConstEx( id, "STATUS_PORT_UNREACHABLE", 0xC000023F, -1);
    AddConstEx( id, "STATUS_REQUEST_ABORTED", 0xC0000240, -1);
    AddConstEx( id, "STATUS_CONNECTION_ABORTED", 0xC0000241, -1);
    AddConstEx( id, "STATUS_BAD_COMPRESSION_BUFFER", 0xC0000242, -1);
    AddConstEx( id, "STATUS_USER_MAPPED_FILE", 0xC0000243, -1);
    AddConstEx( id, "STATUS_AUDIT_FAILED", 0xC0000244, -1);
    AddConstEx( id, "STATUS_TIMER_RESOLUTION_NOT_SET", 0xC0000245, -1);
    AddConstEx( id, "STATUS_CONNECTION_COUNT_LIMIT", 0xC0000246, -1);
    AddConstEx( id, "STATUS_LOGIN_TIME_RESTRICTION", 0xC0000247, -1);
    AddConstEx( id, "STATUS_LOGIN_WKSTA_RESTRICTION", 0xC0000248, -1);
    AddConstEx( id, "STATUS_IMAGE_MP_UP_MISMATCH", 0xC0000249, -1);
    AddConstEx( id, "STATUS_INSUFFICIENT_LOGON_INFO", 0xC0000250, -1);
    AddConstEx( id, "STATUS_BAD_DLL_ENTRYPOINT", 0xC0000251, -1);
    AddConstEx( id, "STATUS_BAD_SERVICE_ENTRYPOINT", 0xC0000252, -1);
    AddConstEx( id, "STATUS_LPC_REPLY_LOST", 0xC0000253, -1);
    AddConstEx( id, "STATUS_IP_ADDRESS_CONFLICT1", 0xC0000254, -1);
    AddConstEx( id, "STATUS_IP_ADDRESS_CONFLICT2", 0xC0000255, -1);
    AddConstEx( id, "STATUS_REGISTRY_QUOTA_LIMIT", 0xC0000256, -1);
    AddConstEx( id, "STATUS_PATH_NOT_COVERED", 0xC0000257, -1);
    AddConstEx( id, "STATUS_NO_CALLBACK_ACTIVE", 0xC0000258, -1);
    AddConstEx( id, "STATUS_LICENSE_QUOTA_EXCEEDED", 0xC0000259, -1);
    AddConstEx( id, "STATUS_PWD_TOO_SHORT", 0xC000025A, -1);
    AddConstEx( id, "STATUS_PWD_TOO_RECENT", 0xC000025B, -1);
    AddConstEx( id, "STATUS_PWD_HISTORY_CONFLICT", 0xC000025C, -1);
    AddConstEx( id, "STATUS_PLUGPLAY_NO_DEVICE", 0xC000025E, -1);
    AddConstEx( id, "STATUS_UNSUPPORTED_COMPRESSION", 0xC000025F, -1);
    AddConstEx( id, "STATUS_INVALID_HW_PROFILE", 0xC0000260, -1);
    AddConstEx( id, "STATUS_INVALID_PLUGPLAY_DEVICE_PATH", 0xC0000261, -1);
    AddConstEx( id, "STATUS_DRIVER_ORDINAL_NOT_FOUND", 0xC0000262, -1);
    AddConstEx( id, "STATUS_DRIVER_ENTRYPOINT_NOT_FOUND", 0xC0000263, -1);
    AddConstEx( id, "STATUS_RESOURCE_NOT_OWNED", 0xC0000264, -1);
    AddConstEx( id, "STATUS_TOO_MANY_LINKS", 0xC0000265, -1);
    AddConstEx( id, "STATUS_QUOTA_LIST_INCONSISTENT", 0xC0000266, -1);
    AddConstEx( id, "STATUS_FILE_IS_OFFLINE", 0xC0000267, -1);
    AddConstEx( id, "STATUS_EVALUATION_EXPIRATION", 0xC0000268, -1);
    AddConstEx( id, "STATUS_ILLEGAL_DLL_RELOCATION", 0xC0000269, -1);
    AddConstEx( id, "STATUS_LICENSE_VIOLATION", 0xC000026A, -1);
    AddConstEx( id, "STATUS_DLL_INIT_FAILED_LOGOFF", 0xC000026B, -1);
    AddConstEx( id, "STATUS_DRIVER_UNABLE_TO_LOAD", 0xC000026C, -1);
    AddConstEx( id, "STATUS_DFS_UNAVAILABLE", 0xC000026D, -1);
    AddConstEx( id, "STATUS_VOLUME_DISMOUNTED", 0xC000026E, -1);
    AddConstEx( id, "STATUS_WX86_INTERNAL_ERROR", 0xC000026F, -1);
    AddConstEx( id, "STATUS_WX86_FLOAT_STACK_CHECK", 0xC0000270, -1);
    AddConstEx( id, "STATUS_VALIDATE_CONTINUE", 0xC0000271, -1);
    AddConstEx( id, "STATUS_NO_MATCH", 0xC0000272, -1);
    AddConstEx( id, "STATUS_NO_MORE_MATCHES", 0xC0000273, -1);
    AddConstEx( id, "STATUS_NOT_A_REPARSE_POINT", 0xC0000275, -1);
    AddConstEx( id, "STATUS_IO_REPARSE_TAG_INVALID", 0xC0000276, -1);
    AddConstEx( id, "STATUS_IO_REPARSE_TAG_MISMATCH", 0xC0000277, -1);
    AddConstEx( id, "STATUS_IO_REPARSE_DATA_INVALID", 0xC0000278, -1);
    AddConstEx( id, "STATUS_IO_REPARSE_TAG_NOT_HANDLED", 0xC0000279, -1);
    AddConstEx( id, "STATUS_PWD_TOO_LONG", 0xC000027A, -1);
    AddConstEx( id, "STATUS_STOWED_EXCEPTION", 0xC000027B, -1);
    AddConstEx( id, "STATUS_REPARSE_POINT_NOT_RESOLVED", 0xC0000280, -1);
    AddConstEx( id, "STATUS_DIRECTORY_IS_A_REPARSE_POINT", 0xC0000281, -1);
    AddConstEx( id, "STATUS_RANGE_LIST_CONFLICT", 0xC0000282, -1);
    AddConstEx( id, "STATUS_SOURCE_ELEMENT_EMPTY", 0xC0000283, -1);
    AddConstEx( id, "STATUS_DESTINATION_ELEMENT_FULL", 0xC0000284, -1);
    AddConstEx( id, "STATUS_ILLEGAL_ELEMENT_ADDRESS", 0xC0000285, -1);
    AddConstEx( id, "STATUS_MAGAZINE_NOT_PRESENT", 0xC0000286, -1);
    AddConstEx( id, "STATUS_REINITIALIZATION_NEEDED", 0xC0000287, -1);
    AddConstEx( id, "STATUS_ENCRYPTION_FAILED", 0xC000028A, -1);
    AddConstEx( id, "STATUS_DECRYPTION_FAILED", 0xC000028B, -1);
    AddConstEx( id, "STATUS_RANGE_NOT_FOUND", 0xC000028C, -1);
    AddConstEx( id, "STATUS_NO_RECOVERY_POLICY", 0xC000028D, -1);
    AddConstEx( id, "STATUS_NO_EFS", 0xC000028E, -1);
    AddConstEx( id, "STATUS_WRONG_EFS", 0xC000028F, -1);
    AddConstEx( id, "STATUS_NO_USER_KEYS", 0xC0000290, -1);
    AddConstEx( id, "STATUS_FILE_NOT_ENCRYPTED", 0xC0000291, -1);
    AddConstEx( id, "STATUS_NOT_EXPORT_FORMAT", 0xC0000292, -1);
    AddConstEx( id, "STATUS_FILE_ENCRYPTED", 0xC0000293, -1);
    AddConstEx( id, "STATUS_WMI_GUID_NOT_FOUND", 0xC0000295, -1);
    AddConstEx( id, "STATUS_WMI_INSTANCE_NOT_FOUND", 0xC0000296, -1);
    AddConstEx( id, "STATUS_WMI_ITEMID_NOT_FOUND", 0xC0000297, -1);
    AddConstEx( id, "STATUS_WMI_TRY_AGAIN", 0xC0000298, -1);
    AddConstEx( id, "STATUS_SHARED_POLICY", 0xC0000299, -1);
    AddConstEx( id, "STATUS_POLICY_OBJECT_NOT_FOUND", 0xC000029A, -1);
    AddConstEx( id, "STATUS_POLICY_ONLY_IN_DS", 0xC000029B, -1);
    AddConstEx( id, "STATUS_VOLUME_NOT_UPGRADED", 0xC000029C, -1);
    AddConstEx( id, "STATUS_REMOTE_STORAGE_NOT_ACTIVE", 0xC000029D, -1);
    AddConstEx( id, "STATUS_REMOTE_STORAGE_MEDIA_ERROR", 0xC000029E, -1);
    AddConstEx( id, "STATUS_NO_TRACKING_SERVICE", 0xC000029F, -1);
    AddConstEx( id, "STATUS_SERVER_SID_MISMATCH", 0xC00002A0, -1);
    AddConstEx( id, "STATUS_DS_NO_ATTRIBUTE_OR_VALUE", 0xC00002A1, -1);
    AddConstEx( id, "STATUS_DS_INVALID_ATTRIBUTE_SYNTAX", 0xC00002A2, -1);
    AddConstEx( id, "STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED", 0xC00002A3, -1);
    AddConstEx( id, "STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS", 0xC00002A4, -1);
    AddConstEx( id, "STATUS_DS_BUSY", 0xC00002A5, -1);
    AddConstEx( id, "STATUS_DS_UNAVAILABLE", 0xC00002A6, -1);
    AddConstEx( id, "STATUS_DS_NO_RIDS_ALLOCATED", 0xC00002A7, -1);
    AddConstEx( id, "STATUS_DS_NO_MORE_RIDS", 0xC00002A8, -1);
    AddConstEx( id, "STATUS_DS_INCORRECT_ROLE_OWNER", 0xC00002A9, -1);
    AddConstEx( id, "STATUS_DS_RIDMGR_INIT_ERROR", 0xC00002AA, -1);
    AddConstEx( id, "STATUS_DS_OBJ_CLASS_VIOLATION", 0xC00002AB, -1);
    AddConstEx( id, "STATUS_DS_CANT_ON_NON_LEAF", 0xC00002AC, -1);
    AddConstEx( id, "STATUS_DS_CANT_ON_RDN", 0xC00002AD, -1);
    AddConstEx( id, "STATUS_DS_CANT_MOD_OBJ_CLASS", 0xC00002AE, -1);
    AddConstEx( id, "STATUS_DS_CROSS_DOM_MOVE_FAILED", 0xC00002AF, -1);
    AddConstEx( id, "STATUS_DS_GC_NOT_AVAILABLE", 0xC00002B0, -1);
    AddConstEx( id, "STATUS_DIRECTORY_SERVICE_REQUIRED", 0xC00002B1, -1);
    AddConstEx( id, "STATUS_REPARSE_ATTRIBUTE_CONFLICT", 0xC00002B2, -1);
    AddConstEx( id, "STATUS_CANT_ENABLE_DENY_ONLY", 0xC00002B3, -1);
    AddConstEx( id, "STATUS_FLOAT_MULTIPLE_FAULTS", 0xC00002B4, -1);
    AddConstEx( id, "STATUS_FLOAT_MULTIPLE_TRAPS", 0xC00002B5, -1);
    AddConstEx( id, "STATUS_DEVICE_REMOVED", 0xC00002B6, -1);
    AddConstEx( id, "STATUS_JOURNAL_DELETE_IN_PROGRESS", 0xC00002B7, -1);
    AddConstEx( id, "STATUS_JOURNAL_NOT_ACTIVE", 0xC00002B8, -1);
    AddConstEx( id, "STATUS_NOINTERFACE", 0xC00002B9, -1);
    AddConstEx( id, "STATUS_DS_RIDMGR_DISABLED", 0xC00002BA, -1);
    AddConstEx( id, "STATUS_DS_ADMIN_LIMIT_EXCEEDED", 0xC00002C1, -1);
    AddConstEx( id, "STATUS_DRIVER_FAILED_SLEEP", 0xC00002C2, -1);
    AddConstEx( id, "STATUS_MUTUAL_AUTHENTICATION_FAILED", 0xC00002C3, -1);
    AddConstEx( id, "STATUS_CORRUPT_SYSTEM_FILE", 0xC00002C4, -1);
    AddConstEx( id, "STATUS_DATATYPE_MISALIGNMENT_ERROR", 0xC00002C5, -1);
    AddConstEx( id, "STATUS_WMI_READ_ONLY", 0xC00002C6, -1);
    AddConstEx( id, "STATUS_WMI_SET_FAILURE", 0xC00002C7, -1);
    AddConstEx( id, "STATUS_COMMITMENT_MINIMUM", 0xC00002C8, -1);
    AddConstEx( id, "STATUS_REG_NAT_CONSUMPTION", 0xC00002C9, -1);
    AddConstEx( id, "STATUS_TRANSPORT_FULL", 0xC00002CA, -1);
    AddConstEx( id, "STATUS_DS_SAM_INIT_FAILURE", 0xC00002CB, -1);
    AddConstEx( id, "STATUS_ONLY_IF_CONNECTED", 0xC00002CC, -1);
    AddConstEx( id, "STATUS_DS_SENSITIVE_GROUP_VIOLATION", 0xC00002CD, -1);
    AddConstEx( id, "STATUS_PNP_RESTART_ENUMERATION", 0xC00002CE, -1);
    AddConstEx( id, "STATUS_JOURNAL_ENTRY_DELETED", 0xC00002CF, -1);
    AddConstEx( id, "STATUS_DS_CANT_MOD_PRIMARYGROUPID", 0xC00002D0, -1);
    AddConstEx( id, "STATUS_SYSTEM_IMAGE_BAD_SIGNATURE", 0xC00002D1, -1);
    AddConstEx( id, "STATUS_PNP_REBOOT_REQUIRED", 0xC00002D2, -1);
    AddConstEx( id, "STATUS_POWER_STATE_INVALID", 0xC00002D3, -1);
    AddConstEx( id, "STATUS_DS_INVALID_GROUP_TYPE", 0xC00002D4, -1);
    AddConstEx( id, "STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN", 0xC00002D5, -1);
    AddConstEx( id, "STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN", 0xC00002D6, -1);
    AddConstEx( id, "STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER", 0xC00002D7, -1);
    AddConstEx( id, "STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER", 0xC00002D8, -1);
    AddConstEx( id, "STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER", 0xC00002D9, -1);
    AddConstEx( id, "STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER", 0xC00002DA, -1);
    AddConstEx( id, "STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER", 0xC00002DB, -1);
    AddConstEx( id, "STATUS_DS_HAVE_PRIMARY_MEMBERS", 0xC00002DC, -1);
    AddConstEx( id, "STATUS_WMI_NOT_SUPPORTED", 0xC00002DD, -1);
    AddConstEx( id, "STATUS_INSUFFICIENT_POWER", 0xC00002DE, -1);
    AddConstEx( id, "STATUS_SAM_NEED_BOOTKEY_PASSWORD", 0xC00002DF, -1);
    AddConstEx( id, "STATUS_SAM_NEED_BOOTKEY_FLOPPY", 0xC00002E0, -1);
    AddConstEx( id, "STATUS_DS_CANT_START", 0xC00002E1, -1);
    AddConstEx( id, "STATUS_DS_INIT_FAILURE", 0xC00002E2, -1);
    AddConstEx( id, "STATUS_SAM_INIT_FAILURE", 0xC00002E3, -1);
    AddConstEx( id, "STATUS_DS_GC_REQUIRED", 0xC00002E4, -1);
    AddConstEx( id, "STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY", 0xC00002E5, -1);
    AddConstEx( id, "STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS", 0xC00002E6, -1);
    AddConstEx( id, "STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED", 0xC00002E7, -1);
    AddConstEx( id, "STATUS_MULTIPLE_FAULT_VIOLATION", 0xC00002E8, -1);
    AddConstEx( id, "STATUS_CURRENT_DOMAIN_NOT_ALLOWED", 0xC00002E9, -1);
    AddConstEx( id, "STATUS_CANNOT_MAKE", 0xC00002EA, -1);
    AddConstEx( id, "STATUS_SYSTEM_SHUTDOWN", 0xC00002EB, -1);
    AddConstEx( id, "STATUS_DS_INIT_FAILURE_CONSOLE", 0xC00002EC, -1);
    AddConstEx( id, "STATUS_DS_SAM_INIT_FAILURE_CONSOLE", 0xC00002ED, -1);
    AddConstEx( id, "STATUS_UNFINISHED_CONTEXT_DELETED", 0xC00002EE, -1);
    AddConstEx( id, "STATUS_NO_TGT_REPLY", 0xC00002EF, -1);
    AddConstEx( id, "STATUS_OBJECTID_NOT_FOUND", 0xC00002F0, -1);
    AddConstEx( id, "STATUS_NO_IP_ADDRESSES", 0xC00002F1, -1);
    AddConstEx( id, "STATUS_WRONG_CREDENTIAL_HANDLE", 0xC00002F2, -1);
    AddConstEx( id, "STATUS_CRYPTO_SYSTEM_INVALID", 0xC00002F3, -1);
    AddConstEx( id, "STATUS_MAX_REFERRALS_EXCEEDED", 0xC00002F4, -1);
    AddConstEx( id, "STATUS_MUST_BE_KDC", 0xC00002F5, -1);
    AddConstEx( id, "STATUS_STRONG_CRYPTO_NOT_SUPPORTED", 0xC00002F6, -1);
    AddConstEx( id, "STATUS_TOO_MANY_PRINCIPALS", 0xC00002F7, -1);
    AddConstEx( id, "STATUS_NO_PA_DATA", 0xC00002F8, -1);
    AddConstEx( id, "STATUS_PKINIT_NAME_MISMATCH", 0xC00002F9, -1);
    AddConstEx( id, "STATUS_SMARTCARD_LOGON_REQUIRED", 0xC00002FA, -1);
    AddConstEx( id, "STATUS_KDC_INVALID_REQUEST", 0xC00002FB, -1);
    AddConstEx( id, "STATUS_KDC_UNABLE_TO_REFER", 0xC00002FC, -1);
    AddConstEx( id, "STATUS_KDC_UNKNOWN_ETYPE", 0xC00002FD, -1);
    AddConstEx( id, "STATUS_SHUTDOWN_IN_PROGRESS", 0xC00002FE, -1);
    AddConstEx( id, "STATUS_SERVER_SHUTDOWN_IN_PROGRESS", 0xC00002FF, -1);
    AddConstEx( id, "STATUS_NOT_SUPPORTED_ON_SBS", 0xC0000300, -1);
    AddConstEx( id, "STATUS_WMI_GUID_DISCONNECTED", 0xC0000301, -1);
    AddConstEx( id, "STATUS_WMI_ALREADY_DISABLED", 0xC0000302, -1);
    AddConstEx( id, "STATUS_WMI_ALREADY_ENABLED", 0xC0000303, -1);
    AddConstEx( id, "STATUS_MFT_TOO_FRAGMENTED", 0xC0000304, -1);
    AddConstEx( id, "STATUS_COPY_PROTECTION_FAILURE", 0xC0000305, -1);
    AddConstEx( id, "STATUS_CSS_AUTHENTICATION_FAILURE", 0xC0000306, -1);
    AddConstEx( id, "STATUS_CSS_KEY_NOT_PRESENT", 0xC0000307, -1);
    AddConstEx( id, "STATUS_CSS_KEY_NOT_ESTABLISHED", 0xC0000308, -1);
    AddConstEx( id, "STATUS_CSS_SCRAMBLED_SECTOR", 0xC0000309, -1);
    AddConstEx( id, "STATUS_CSS_REGION_MISMATCH", 0xC000030A, -1);
    AddConstEx( id, "STATUS_CSS_RESETS_EXHAUSTED", 0xC000030B, -1);
    AddConstEx( id, "STATUS_PASSWORD_CHANGE_REQUIRED", 0xC000030C, -1);
    AddConstEx( id, "STATUS_PKINIT_FAILURE", 0xC0000320, -1);
    AddConstEx( id, "STATUS_SMARTCARD_SUBSYSTEM_FAILURE", 0xC0000321, -1);
    AddConstEx( id, "STATUS_NO_KERB_KEY", 0xC0000322, -1);
    AddConstEx( id, "STATUS_HOST_DOWN", 0xC0000350, -1);
    AddConstEx( id, "STATUS_UNSUPPORTED_PREAUTH", 0xC0000351, -1);
    AddConstEx( id, "STATUS_EFS_ALG_BLOB_TOO_BIG", 0xC0000352, -1);
    AddConstEx( id, "STATUS_PORT_NOT_SET", 0xC0000353, -1);
    AddConstEx( id, "STATUS_DEBUGGER_INACTIVE", 0xC0000354, -1);
    AddConstEx( id, "STATUS_DS_VERSION_CHECK_FAILURE", 0xC0000355, -1);
    AddConstEx( id, "STATUS_AUDITING_DISABLED", 0xC0000356, -1);
    AddConstEx( id, "STATUS_PRENT4_MACHINE_ACCOUNT", 0xC0000357, -1);
    AddConstEx( id, "STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER", 0xC0000358, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_WIN_32", 0xC0000359, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_WIN_64", 0xC000035A, -1);
    AddConstEx( id, "STATUS_BAD_BINDINGS", 0xC000035B, -1);
    AddConstEx( id, "STATUS_NETWORK_SESSION_EXPIRED", 0xC000035C, -1);
    AddConstEx( id, "STATUS_APPHELP_BLOCK", 0xC000035D, -1);
    AddConstEx( id, "STATUS_ALL_SIDS_FILTERED", 0xC000035E, -1);
    AddConstEx( id, "STATUS_NOT_SAFE_MODE_DRIVER", 0xC000035F, -1);
    AddConstEx( id, "STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT", 0xC0000361, -1);
    AddConstEx( id, "STATUS_ACCESS_DISABLED_BY_POLICY_PATH", 0xC0000362, -1);
    AddConstEx( id, "STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER", 0xC0000363, -1);
    AddConstEx( id, "STATUS_ACCESS_DISABLED_BY_POLICY_OTHER", 0xC0000364, -1);
    AddConstEx( id, "STATUS_FAILED_DRIVER_ENTRY", 0xC0000365, -1);
    AddConstEx( id, "STATUS_DEVICE_ENUMERATION_ERROR", 0xC0000366, -1);
    AddConstEx( id, "STATUS_MOUNT_POINT_NOT_RESOLVED", 0xC0000368, -1);
    AddConstEx( id, "STATUS_INVALID_DEVICE_OBJECT_PARAMETER", 0xC0000369, -1);
    AddConstEx( id, "STATUS_MCA_OCCURED", 0xC000036A, -1);
    AddConstEx( id, "STATUS_DRIVER_BLOCKED_CRITICAL", 0xC000036B, -1);
    AddConstEx( id, "STATUS_DRIVER_BLOCKED", 0xC000036C, -1);
    AddConstEx( id, "STATUS_DRIVER_DATABASE_ERROR", 0xC000036D, -1);
    AddConstEx( id, "STATUS_SYSTEM_HIVE_TOO_LARGE", 0xC000036E, -1);
    AddConstEx( id, "STATUS_INVALID_IMPORT_OF_NON_DLL", 0xC000036F, -1);
    AddConstEx( id, "STATUS_NO_SECRETS", 0xC0000371, -1);
    AddConstEx( id, "STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY", 0xC0000372, -1);
    AddConstEx( id, "STATUS_FAILED_STACK_SWITCH", 0xC0000373, -1);
    AddConstEx( id, "STATUS_HEAP_CORRUPTION", 0xC0000374, -1);
    AddConstEx( id, "STATUS_SMARTCARD_WRONG_PIN", 0xC0000380, -1);
    AddConstEx( id, "STATUS_SMARTCARD_CARD_BLOCKED", 0xC0000381, -1);
    AddConstEx( id, "STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED", 0xC0000382, -1);
    AddConstEx( id, "STATUS_SMARTCARD_NO_CARD", 0xC0000383, -1);
    AddConstEx( id, "STATUS_SMARTCARD_NO_KEY_CONTAINER", 0xC0000384, -1);
    AddConstEx( id, "STATUS_SMARTCARD_NO_CERTIFICATE", 0xC0000385, -1);
    AddConstEx( id, "STATUS_SMARTCARD_NO_KEYSET", 0xC0000386, -1);
    AddConstEx( id, "STATUS_SMARTCARD_IO_ERROR", 0xC0000387, -1);
    AddConstEx( id, "STATUS_DOWNGRADE_DETECTED", 0xC0000388, -1);
    AddConstEx( id, "STATUS_SMARTCARD_CERT_REVOKED", 0xC0000389, -1);
    AddConstEx( id, "STATUS_ISSUING_CA_UNTRUSTED", 0xC000038A, -1);
    AddConstEx( id, "STATUS_REVOCATION_OFFLINE_C", 0xC000038B, -1);
    AddConstEx( id, "STATUS_PKINIT_CLIENT_FAILURE", 0xC000038C, -1);
    AddConstEx( id, "STATUS_SMARTCARD_CERT_EXPIRED", 0xC000038D, -1);
    AddConstEx( id, "STATUS_DRIVER_FAILED_PRIOR_UNLOAD", 0xC000038E, -1);
    AddConstEx( id, "STATUS_SMARTCARD_SILENT_CONTEXT", 0xC000038F, -1);
    AddConstEx( id, "STATUS_PER_USER_TRUST_QUOTA_EXCEEDED", 0xC0000401, -1);
    AddConstEx( id, "STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED", 0xC0000402, -1);
    AddConstEx( id, "STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED", 0xC0000403, -1);
    AddConstEx( id, "STATUS_DS_NAME_NOT_UNIQUE", 0xC0000404, -1);
    AddConstEx( id, "STATUS_DS_DUPLICATE_ID_FOUND", 0xC0000405, -1);
    AddConstEx( id, "STATUS_DS_GROUP_CONVERSION_ERROR", 0xC0000406, -1);
    AddConstEx( id, "STATUS_VOLSNAP_PREPARE_HIBERNATE", 0xC0000407, -1);
    AddConstEx( id, "STATUS_USER2USER_REQUIRED", 0xC0000408, -1);
    AddConstEx( id, "STATUS_STACK_BUFFER_OVERRUN", 0xC0000409, -1);
    AddConstEx( id, "STATUS_NO_S4U_PROT_SUPPORT", 0xC000040A, -1);
    AddConstEx( id, "STATUS_CROSSREALM_DELEGATION_FAILURE", 0xC000040B, -1);
    AddConstEx( id, "STATUS_REVOCATION_OFFLINE_KDC", 0xC000040C, -1);
    AddConstEx( id, "STATUS_ISSUING_CA_UNTRUSTED_KDC", 0xC000040D, -1);
    AddConstEx( id, "STATUS_KDC_CERT_EXPIRED", 0xC000040E, -1);
    AddConstEx( id, "STATUS_KDC_CERT_REVOKED", 0xC000040F, -1);
    AddConstEx( id, "STATUS_PARAMETER_QUOTA_EXCEEDED", 0xC0000410, -1);
    AddConstEx( id, "STATUS_HIBERNATION_FAILURE", 0xC0000411, -1);
    AddConstEx( id, "STATUS_DELAY_LOAD_FAILED", 0xC0000412, -1);
    AddConstEx( id, "STATUS_AUTHENTICATION_FIREWALL_FAILED", 0xC0000413, -1);
    AddConstEx( id, "STATUS_VDM_DISALLOWED", 0xC0000414, -1);
    AddConstEx( id, "STATUS_HUNG_DISPLAY_DRIVER_THREAD", 0xC0000415, -1);
    AddConstEx( id, "STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE", 0xC0000416, -1);
    AddConstEx( id, "STATUS_INVALID_CRUNTIME_PARAMETER", 0xC0000417, -1);
    AddConstEx( id, "STATUS_NTLM_BLOCKED", 0xC0000418, -1);
    AddConstEx( id, "STATUS_DS_SRC_SID_EXISTS_IN_FOREST", 0xC0000419, -1);
    AddConstEx( id, "STATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST", 0xC000041A, -1);
    AddConstEx( id, "STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST", 0xC000041B, -1);
    AddConstEx( id, "STATUS_INVALID_USER_PRINCIPAL_NAME", 0xC000041C, -1);
    AddConstEx( id, "STATUS_FATAL_USER_CALLBACK_EXCEPTION", 0xC000041D, -1);
    AddConstEx( id, "STATUS_ASSERTION_FAILURE", 0xC0000420, -1);
    AddConstEx( id, "STATUS_VERIFIER_STOP", 0xC0000421, -1);
    AddConstEx( id, "STATUS_CALLBACK_POP_STACK", 0xC0000423, -1);
    AddConstEx( id, "STATUS_INCOMPATIBLE_DRIVER_BLOCKED", 0xC0000424, -1);
    AddConstEx( id, "STATUS_HIVE_UNLOADED", 0xC0000425, -1);
    AddConstEx( id, "STATUS_COMPRESSION_DISABLED", 0xC0000426, -1);
    AddConstEx( id, "STATUS_FILE_SYSTEM_LIMITATION", 0xC0000427, -1);
    AddConstEx( id, "STATUS_INVALID_IMAGE_HASH", 0xC0000428, -1);
    AddConstEx( id, "STATUS_NOT_CAPABLE", 0xC0000429, -1);
    AddConstEx( id, "STATUS_REQUEST_OUT_OF_SEQUENCE", 0xC000042A, -1);
    AddConstEx( id, "STATUS_IMPLEMENTATION_LIMIT", 0xC000042B, -1);
    AddConstEx( id, "STATUS_ELEVATION_REQUIRED", 0xC000042C, -1);
    AddConstEx( id, "STATUS_NO_SECURITY_CONTEXT", 0xC000042D, -1);
    AddConstEx( id, "STATUS_PKU2U_CERT_FAILURE", 0xC000042F, -1);
    AddConstEx( id, "STATUS_BEYOND_VDL", 0xC0000432, -1);
    AddConstEx( id, "STATUS_ENCOUNTERED_WRITE_IN_PROGRESS", 0xC0000433, -1);
    AddConstEx( id, "STATUS_PTE_CHANGED", 0xC0000434, -1);
    AddConstEx( id, "STATUS_PURGE_FAILED", 0xC0000435, -1);
    AddConstEx( id, "STATUS_CRED_REQUIRES_CONFIRMATION", 0xC0000440, -1);
    AddConstEx( id, "STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE", 0xC0000441, -1);
    AddConstEx( id, "STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER", 0xC0000442, -1);
    AddConstEx( id, "STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE", 0xC0000443, -1);
    AddConstEx( id, "STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE", 0xC0000444, -1);
    AddConstEx( id, "STATUS_CS_ENCRYPTION_FILE_NOT_CSE", 0xC0000445, -1);
    AddConstEx( id, "STATUS_INVALID_LABEL", 0xC0000446, -1);
    AddConstEx( id, "STATUS_DRIVER_PROCESS_TERMINATED", 0xC0000450, -1);
    AddConstEx( id, "STATUS_AMBIGUOUS_SYSTEM_DEVICE", 0xC0000451, -1);
    AddConstEx( id, "STATUS_SYSTEM_DEVICE_NOT_FOUND", 0xC0000452, -1);
    AddConstEx( id, "STATUS_RESTART_BOOT_APPLICATION", 0xC0000453, -1);
    AddConstEx( id, "STATUS_INSUFFICIENT_NVRAM_RESOURCES", 0xC0000454, -1);
    AddConstEx( id, "STATUS_INVALID_SESSION", 0xC0000455, -1);
    AddConstEx( id, "STATUS_THREAD_ALREADY_IN_SESSION", 0xC0000456, -1);
    AddConstEx( id, "STATUS_THREAD_NOT_IN_SESSION", 0xC0000457, -1);
    AddConstEx( id, "STATUS_INVALID_WEIGHT", 0xC0000458, -1);
    AddConstEx( id, "STATUS_REQUEST_PAUSED", 0xC0000459, -1);
    AddConstEx( id, "STATUS_NO_RANGES_PROCESSED", 0xC0000460, -1);
    AddConstEx( id, "STATUS_DISK_RESOURCES_EXHAUSTED", 0xC0000461, -1);
    AddConstEx( id, "STATUS_NEEDS_REMEDIATION", 0xC0000462, -1);
    AddConstEx( id, "STATUS_DEVICE_FEATURE_NOT_SUPPORTED", 0xC0000463, -1);
    AddConstEx( id, "STATUS_DEVICE_UNREACHABLE", 0xC0000464, -1);
    AddConstEx( id, "STATUS_INVALID_TOKEN", 0xC0000465, -1);
    AddConstEx( id, "STATUS_SERVER_UNAVAILABLE", 0xC0000466, -1);
    AddConstEx( id, "STATUS_FILE_NOT_AVAILABLE", 0xC0000467, -1);
    AddConstEx( id, "STATUS_DEVICE_INSUFFICIENT_RESOURCES", 0xC0000468, -1);
    AddConstEx( id, "STATUS_PACKAGE_UPDATING", 0xC0000469, -1);
    AddConstEx( id, "STATUS_NOT_READ_FROM_COPY", 0xC000046A, -1);
    AddConstEx( id, "STATUS_FT_WRITE_FAILURE", 0xC000046B, -1);
    AddConstEx( id, "STATUS_FT_DI_SCAN_REQUIRED", 0xC000046C, -1);
    AddConstEx( id, "STATUS_OBJECT_NOT_EXTERNALLY_BACKED", 0xC000046D, -1);
    AddConstEx( id, "STATUS_EXTERNAL_BACKING_PROVIDER_UNKNOWN", 0xC000046E, -1);
    AddConstEx( id, "STATUS_COMPRESSION_NOT_BENEFICIAL", 0xC000046F, -1);
    AddConstEx( id, "STATUS_DATA_CHECKSUM_ERROR", 0xC0000470, -1);
    AddConstEx( id, "STATUS_INTERMIXED_KERNEL_EA_OPERATION", 0xC0000471, -1);
    AddConstEx( id, "STATUS_TRIM_READ_ZERO_NOT_SUPPORTED", 0xC0000472, -1);
    AddConstEx( id, "STATUS_TOO_MANY_SEGMENT_DESCRIPTORS", 0xC0000473, -1);
    AddConstEx( id, "STATUS_INVALID_OFFSET_ALIGNMENT", 0xC0000474, -1);
    AddConstEx( id, "STATUS_INVALID_FIELD_IN_PARAMETER_LIST", 0xC0000475, -1);
    AddConstEx( id, "STATUS_OPERATION_IN_PROGRESS", 0xC0000476, -1);
    AddConstEx( id, "STATUS_INVALID_INITIATOR_TARGET_PATH", 0xC0000477, -1);
    AddConstEx( id, "STATUS_SCRUB_DATA_DISABLED", 0xC0000478, -1);
    AddConstEx( id, "STATUS_NOT_REDUNDANT_STORAGE", 0xC0000479, -1);
    AddConstEx( id, "STATUS_RESIDENT_FILE_NOT_SUPPORTED", 0xC000047A, -1);
    AddConstEx( id, "STATUS_COMPRESSED_FILE_NOT_SUPPORTED", 0xC000047B, -1);
    AddConstEx( id, "STATUS_DIRECTORY_NOT_SUPPORTED", 0xC000047C, -1);
    AddConstEx( id, "STATUS_IO_OPERATION_TIMEOUT", 0xC000047D, -1);
    AddConstEx( id, "STATUS_SYSTEM_NEEDS_REMEDIATION", 0xC000047E, -1);
    AddConstEx( id, "STATUS_APPX_INTEGRITY_FAILURE_CLR_NGEN", 0xC000047F, -1);
    AddConstEx( id, "STATUS_SHARE_UNAVAILABLE", 0xC0000480, -1);
    AddConstEx( id, "STATUS_APISET_NOT_HOSTED", 0xC0000481, -1);
    AddConstEx( id, "STATUS_APISET_NOT_PRESENT", 0xC0000482, -1);
    AddConstEx( id, "STATUS_DEVICE_HARDWARE_ERROR", 0xC0000483, -1);
    AddConstEx( id, "STATUS_FIRMWARE_SLOT_INVALID", 0xC0000484, -1);
    AddConstEx( id, "STATUS_FIRMWARE_IMAGE_INVALID", 0xC0000485, -1);
    AddConstEx( id, "STATUS_STORAGE_TOPOLOGY_ID_MISMATCH", 0xC0000486, -1);
    AddConstEx( id, "STATUS_WIM_NOT_BOOTABLE", 0xC0000487, -1);
    AddConstEx( id, "STATUS_BLOCKED_BY_PARENTAL_CONTROLS", 0xC0000488, -1);
    AddConstEx( id, "STATUS_NEEDS_REGISTRATION", 0xC0000489, -1);
    AddConstEx( id, "STATUS_QUOTA_ACTIVITY", 0xC000048A, -1);
    AddConstEx( id, "STATUS_CALLBACK_INVOKE_INLINE", 0xC000048B, -1);
    AddConstEx( id, "STATUS_BLOCK_TOO_MANY_REFERENCES", 0xC000048C, -1);
    AddConstEx( id, "STATUS_MARKED_TO_DISALLOW_WRITES", 0xC000048D, -1);
    AddConstEx( id, "STATUS_NETWORK_ACCESS_DENIED_EDP", 0xC000048E, -1);
    AddConstEx( id, "STATUS_ENCLAVE_FAILURE", 0xC000048F, -1);
    AddConstEx( id, "STATUS_PNP_NO_COMPAT_DRIVERS", 0xC0000490, -1);
    AddConstEx( id, "STATUS_PNP_DRIVER_PACKAGE_NOT_FOUND", 0xC0000491, -1);
    AddConstEx( id, "STATUS_PNP_DRIVER_CONFIGURATION_NOT_FOUND", 0xC0000492, -1);
    AddConstEx( id, "STATUS_PNP_DRIVER_CONFIGURATION_INCOMPLETE", 0xC0000493, -1);
    AddConstEx( id, "STATUS_PNP_FUNCTION_DRIVER_REQUIRED", 0xC0000494, -1);
    AddConstEx( id, "STATUS_PNP_DEVICE_CONFIGURATION_PENDING", 0xC0000495, -1);
    AddConstEx( id, "STATUS_DEVICE_HINT_NAME_BUFFER_TOO_SMALL", 0xC0000496, -1);
    AddConstEx( id, "STATUS_PACKAGE_NOT_AVAILABLE", 0xC0000497, -1);
    AddConstEx( id, "STATUS_DEVICE_IN_MAINTENANCE", 0xC0000499, -1);
    AddConstEx( id, "STATUS_NOT_SUPPORTED_ON_DAX", 0xC000049A, -1);
    AddConstEx( id, "STATUS_FREE_SPACE_TOO_FRAGMENTED", 0xC000049B, -1);
    AddConstEx( id, "STATUS_DAX_MAPPING_EXISTS", 0xC000049C, -1);
    AddConstEx( id, "STATUS_CHILD_PROCESS_BLOCKED", 0xC000049D, -1);
    AddConstEx( id, "STATUS_STORAGE_LOST_DATA_PERSISTENCE", 0xC000049E, -1);
    AddConstEx( id, "STATUS_INVALID_TASK_NAME", 0xC0000500, -1);
    AddConstEx( id, "STATUS_INVALID_TASK_INDEX", 0xC0000501, -1);
    AddConstEx( id, "STATUS_THREAD_ALREADY_IN_TASK", 0xC0000502, -1);
    AddConstEx( id, "STATUS_CALLBACK_BYPASS", 0xC0000503, -1);
    AddConstEx( id, "STATUS_UNDEFINED_SCOPE", 0xC0000504, -1);
    AddConstEx( id, "STATUS_INVALID_CAP", 0xC0000505, -1);
    AddConstEx( id, "STATUS_NOT_GUI_PROCESS", 0xC0000506, -1);
    AddConstEx( id, "STATUS_DEVICE_HUNG", 0xC0000507, -1);
    AddConstEx( id, "STATUS_CONTAINER_ASSIGNED", 0xC0000508, -1);
    AddConstEx( id, "STATUS_JOB_NO_CONTAINER", 0xC0000509, -1);
    AddConstEx( id, "STATUS_DEVICE_UNRESPONSIVE", 0xC000050A, -1);
    AddConstEx( id, "STATUS_REPARSE_POINT_ENCOUNTERED", 0xC000050B, -1);
    AddConstEx( id, "STATUS_FAIL_FAST_EXCEPTION", 0xC0000602, -1);
    AddConstEx( id, "STATUS_IMAGE_CERT_REVOKED", 0xC0000603, -1);
    AddConstEx( id, "STATUS_DYNAMIC_CODE_BLOCKED", 0xC0000604, -1);
    AddConstEx( id, "STATUS_IMAGE_CERT_EXPIRED", 0xC0000605, -1);
    AddConstEx( id, "STATUS_PORT_CLOSED", 0xC0000700, -1);
    AddConstEx( id, "STATUS_MESSAGE_LOST", 0xC0000701, -1);
    AddConstEx( id, "STATUS_INVALID_MESSAGE", 0xC0000702, -1);
    AddConstEx( id, "STATUS_REQUEST_CANCELED", 0xC0000703, -1);
    AddConstEx( id, "STATUS_RECURSIVE_DISPATCH", 0xC0000704, -1);
    AddConstEx( id, "STATUS_LPC_RECEIVE_BUFFER_EXPECTED", 0xC0000705, -1);
    AddConstEx( id, "STATUS_LPC_INVALID_CONNECTION_USAGE", 0xC0000706, -1);
    AddConstEx( id, "STATUS_LPC_REQUESTS_NOT_ALLOWED", 0xC0000707, -1);
    AddConstEx( id, "STATUS_RESOURCE_IN_USE", 0xC0000708, -1);
    AddConstEx( id, "STATUS_HARDWARE_MEMORY_ERROR", 0xC0000709, -1);
    AddConstEx( id, "STATUS_THREADPOOL_HANDLE_EXCEPTION", 0xC000070A, -1);
    AddConstEx( id, "STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED", 0xC000070B, -1);
    AddConstEx( id, "STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED", 0xC000070C, -1);
    AddConstEx( id, "STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED", 0xC000070D, -1);
    AddConstEx( id, "STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED", 0xC000070E, -1);
    AddConstEx( id, "STATUS_THREADPOOL_RELEASED_DURING_OPERATION", 0xC000070F, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING", 0xC0000710, -1);
    AddConstEx( id, "STATUS_APC_RETURNED_WHILE_IMPERSONATING", 0xC0000711, -1);
    AddConstEx( id, "STATUS_PROCESS_IS_PROTECTED", 0xC0000712, -1);
    AddConstEx( id, "STATUS_MCA_EXCEPTION", 0xC0000713, -1);
    AddConstEx( id, "STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE", 0xC0000714, -1);
    AddConstEx( id, "STATUS_SYMLINK_CLASS_DISABLED", 0xC0000715, -1);
    AddConstEx( id, "STATUS_INVALID_IDN_NORMALIZATION", 0xC0000716, -1);
    AddConstEx( id, "STATUS_NO_UNICODE_TRANSLATION", 0xC0000717, -1);
    AddConstEx( id, "STATUS_ALREADY_REGISTERED", 0xC0000718, -1);
    AddConstEx( id, "STATUS_CONTEXT_MISMATCH", 0xC0000719, -1);
    AddConstEx( id, "STATUS_PORT_ALREADY_HAS_COMPLETION_LIST", 0xC000071A, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_THREAD_PRIORITY", 0xC000071B, -1);
    AddConstEx( id, "STATUS_INVALID_THREAD", 0xC000071C, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_TRANSACTION", 0xC000071D, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_LDR_LOCK", 0xC000071E, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_LANG", 0xC000071F, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_PRI_BACK", 0xC0000720, -1);
    AddConstEx( id, "STATUS_CALLBACK_RETURNED_THREAD_AFFINITY", 0xC0000721, -1);
    AddConstEx( id, "STATUS_LPC_HANDLE_COUNT_EXCEEDED", 0xC0000722, -1);
    AddConstEx( id, "STATUS_DISK_REPAIR_DISABLED", 0xC0000800, -1);
    AddConstEx( id, "STATUS_DS_DOMAIN_RENAME_IN_PROGRESS", 0xC0000801, -1);
    AddConstEx( id, "STATUS_DISK_QUOTA_EXCEEDED", 0xC0000802, -1);
    AddConstEx( id, "STATUS_CONTENT_BLOCKED", 0xC0000804, -1);
    AddConstEx( id, "STATUS_BAD_CLUSTERS", 0xC0000805, -1);
    AddConstEx( id, "STATUS_VOLUME_DIRTY", 0xC0000806, -1);
    AddConstEx( id, "STATUS_DISK_REPAIR_UNSUCCESSFUL", 0xC0000808, -1);
    AddConstEx( id, "STATUS_CORRUPT_LOG_OVERFULL", 0xC0000809, -1);
    AddConstEx( id, "STATUS_CORRUPT_LOG_CORRUPTED", 0xC000080A, -1);
    AddConstEx( id, "STATUS_CORRUPT_LOG_UNAVAILABLE", 0xC000080B, -1);
    AddConstEx( id, "STATUS_CORRUPT_LOG_DELETED_FULL", 0xC000080C, -1);
    AddConstEx( id, "STATUS_CORRUPT_LOG_CLEARED", 0xC000080D, -1);
    AddConstEx( id, "STATUS_ORPHAN_NAME_EXHAUSTED", 0xC000080E, -1);
    AddConstEx( id, "STATUS_PROACTIVE_SCAN_IN_PROGRESS", 0xC000080F, -1);
    AddConstEx( id, "STATUS_ENCRYPTED_IO_NOT_POSSIBLE", 0xC0000810, -1);
    AddConstEx( id, "STATUS_CORRUPT_LOG_UPLEVEL_RECORDS", 0xC0000811, -1);
    AddConstEx( id, "STATUS_FILE_CHECKED_OUT", 0xC0000901, -1);
    AddConstEx( id, "STATUS_CHECKOUT_REQUIRED", 0xC0000902, -1);
    AddConstEx( id, "STATUS_BAD_FILE_TYPE", 0xC0000903, -1);
    AddConstEx( id, "STATUS_FILE_TOO_LARGE", 0xC0000904, -1);
    AddConstEx( id, "STATUS_FORMS_AUTH_REQUIRED", 0xC0000905, -1);
    AddConstEx( id, "STATUS_VIRUS_INFECTED", 0xC0000906, -1);
    AddConstEx( id, "STATUS_VIRUS_DELETED", 0xC0000907, -1);
    AddConstEx( id, "STATUS_BAD_MCFG_TABLE", 0xC0000908, -1);
    AddConstEx( id, "STATUS_CANNOT_BREAK_OPLOCK", 0xC0000909, -1);
    AddConstEx( id, "STATUS_BAD_KEY", 0xC000090A, -1);
    AddConstEx( id, "STATUS_BAD_DATA", 0xC000090B, -1);
    AddConstEx( id, "STATUS_NO_KEY", 0xC000090C, -1);
    AddConstEx( id, "STATUS_FILE_HANDLE_REVOKED", 0xC0000910, -1);
    AddConstEx( id, "STATUS_WOW_ASSERTION", 0xC0009898, -1);
    AddConstEx( id, "STATUS_INVALID_SIGNATURE", 0xC000A000, -1);
    AddConstEx( id, "STATUS_HMAC_NOT_SUPPORTED", 0xC000A001, -1);
    AddConstEx( id, "STATUS_AUTH_TAG_MISMATCH", 0xC000A002, -1);
    AddConstEx( id, "STATUS_INVALID_STATE_TRANSITION", 0xC000A003, -1);
    AddConstEx( id, "STATUS_INVALID_KERNEL_INFO_VERSION", 0xC000A004, -1);
    AddConstEx( id, "STATUS_INVALID_PEP_INFO_VERSION", 0xC000A005, -1);
    AddConstEx( id, "STATUS_HANDLE_REVOKED", 0xC000A006, -1);
    AddConstEx( id, "STATUS_EOF_ON_GHOSTED_RANGE", 0xC000A007, -1);
    AddConstEx( id, "STATUS_IPSEC_QUEUE_OVERFLOW", 0xC000A010, -1);
    AddConstEx( id, "STATUS_ND_QUEUE_OVERFLOW", 0xC000A011, -1);
    AddConstEx( id, "STATUS_HOPLIMIT_EXCEEDED", 0xC000A012, -1);
    AddConstEx( id, "STATUS_PROTOCOL_NOT_SUPPORTED", 0xC000A013, -1);
    AddConstEx( id, "STATUS_FASTPATH_REJECTED", 0xC000A014, -1);
    AddConstEx( id, "STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED", 0xC000A080, -1);
    AddConstEx( id, "STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR", 0xC000A081, -1);
    AddConstEx( id, "STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR", 0xC000A082, -1);
    AddConstEx( id, "STATUS_XML_PARSE_ERROR", 0xC000A083, -1);
    AddConstEx( id, "STATUS_XMLDSIG_ERROR", 0xC000A084, -1);
    AddConstEx( id, "STATUS_WRONG_COMPARTMENT", 0xC000A085, -1);
    AddConstEx( id, "STATUS_AUTHIP_FAILURE", 0xC000A086, -1);
    AddConstEx( id, "STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS", 0xC000A087, -1);
    AddConstEx( id, "STATUS_DS_OID_NOT_FOUND", 0xC000A088, -1);
    AddConstEx( id, "STATUS_INCORRECT_ACCOUNT_TYPE", 0xC000A089, -1);
    AddConstEx( id, "STATUS_HASH_NOT_SUPPORTED", 0xC000A100, -1);
    AddConstEx( id, "STATUS_HASH_NOT_PRESENT", 0xC000A101, -1);
    AddConstEx( id, "STATUS_SECONDARY_IC_PROVIDER_NOT_REGISTERED", 0xC000A121, -1);
    AddConstEx( id, "STATUS_GPIO_CLIENT_INFORMATION_INVALID", 0xC000A122, -1);
    AddConstEx( id, "STATUS_GPIO_VERSION_NOT_SUPPORTED", 0xC000A123, -1);
    AddConstEx( id, "STATUS_GPIO_INVALID_REGISTRATION_PACKET", 0xC000A124, -1);
    AddConstEx( id, "STATUS_GPIO_OPERATION_DENIED", 0xC000A125, -1);
    AddConstEx( id, "STATUS_GPIO_INCOMPATIBLE_CONNECT_MODE", 0xC000A126, -1);
    AddConstEx( id, "STATUS_CANNOT_SWITCH_RUNLEVEL", 0xC000A141, -1);
    AddConstEx( id, "STATUS_INVALID_RUNLEVEL_SETTING", 0xC000A142, -1);
    AddConstEx( id, "STATUS_RUNLEVEL_SWITCH_TIMEOUT", 0xC000A143, -1);
    AddConstEx( id, "STATUS_RUNLEVEL_SWITCH_AGENT_TIMEOUT", 0xC000A145, -1);
    AddConstEx( id, "STATUS_RUNLEVEL_SWITCH_IN_PROGRESS", 0xC000A146, -1);
    AddConstEx( id, "STATUS_NOT_APPCONTAINER", 0xC000A200, -1);
    AddConstEx( id, "STATUS_NOT_SUPPORTED_IN_APPCONTAINER", 0xC000A201, -1);
    AddConstEx( id, "STATUS_INVALID_PACKAGE_SID_LENGTH", 0xC000A202, -1);
    AddConstEx( id, "STATUS_APP_DATA_NOT_FOUND", 0xC000A281, -1);
    AddConstEx( id, "STATUS_APP_DATA_EXPIRED", 0xC000A282, -1);
    AddConstEx( id, "STATUS_APP_DATA_CORRUPT", 0xC000A283, -1);
    AddConstEx( id, "STATUS_APP_DATA_LIMIT_EXCEEDED", 0xC000A284, -1);
    AddConstEx( id, "STATUS_APP_DATA_REBOOT_REQUIRED", 0xC000A285, -1);
    AddConstEx( id, "STATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED", 0xC000A2A1, -1);
    AddConstEx( id, "STATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED", 0xC000A2A2, -1);
    AddConstEx( id, "STATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED", 0xC000A2A3, -1);
    AddConstEx( id, "STATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED", 0xC000A2A4, -1);
    AddConstEx( id, "STATUS_FILE_SYSTEM_VIRTUALIZATION_UNAVAILABLE", 0xC000CE01, -1);
    AddConstEx( id, "STATUS_FILE_SYSTEM_VIRTUALIZATION_METADATA_CORRUPT", 0xC000CE02, -1);
    AddConstEx( id, "STATUS_FILE_SYSTEM_VIRTUALIZATION_BUSY", 0xC000CE03, -1);
    AddConstEx( id, "STATUS_FILE_SYSTEM_VIRTUALIZATION_PROVIDER_UNKNOWN", 0xC000CE04, -1);
    AddConstEx( id, "STATUS_CLOUD_FILE_PROVIDER_UNKNOWN", 0xC000CF00, -1);
    AddConstEx( id, "STATUS_CLOUD_FILE_PROVIDER_NOT_RUNNING", 0xC000CF01, -1);
    AddConstEx( id, "STATUS_CLOUD_FILE_METADATA_CORRUPT", 0xC000CF02, -1);
    AddConstEx( id, "STATUS_CLOUD_FILE_METADATA_TOO_LARGE", 0xC000CF03, -1);
    AddConstEx( id, "STATUS_PNP_BAD_MPS_TABLE", 0xC0040035, -1);
    AddConstEx( id, "STATUS_PNP_TRANSLATION_FAILED", 0xC0040036, -1);
    AddConstEx( id, "STATUS_PNP_IRQ_TRANSLATION_FAILED", 0xC0040037, -1);
    AddConstEx( id, "STATUS_PNP_INVALID_ID", 0xC0040038, -1);
    AddConstEx( id, "STATUS_IO_REISSUE_AS_CACHED", 0xC0040039, -1);
    AddConstEx( id, "STATUS_CTX_WINSTATION_NAME_INVALID", 0xC00A0001, -1);
    AddConstEx( id, "STATUS_CTX_INVALID_PD", 0xC00A0002, -1);
    AddConstEx( id, "STATUS_CTX_PD_NOT_FOUND", 0xC00A0003, -1);
    AddConstEx( id, "STATUS_CTX_CLOSE_PENDING", 0xC00A0006, -1);
    AddConstEx( id, "STATUS_CTX_NO_OUTBUF", 0xC00A0007, -1);
    AddConstEx( id, "STATUS_CTX_MODEM_INF_NOT_FOUND", 0xC00A0008, -1);
    AddConstEx( id, "STATUS_CTX_INVALID_MODEMNAME", 0xC00A0009, -1);
    AddConstEx( id, "STATUS_CTX_RESPONSE_ERROR", 0xC00A000A, -1);
    AddConstEx( id, "STATUS_CTX_MODEM_RESPONSE_TIMEOUT", 0xC00A000B, -1);
    AddConstEx( id, "STATUS_CTX_MODEM_RESPONSE_NO_CARRIER", 0xC00A000C, -1);
    AddConstEx( id, "STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE", 0xC00A000D, -1);
    AddConstEx( id, "STATUS_CTX_MODEM_RESPONSE_BUSY", 0xC00A000E, -1);
    AddConstEx( id, "STATUS_CTX_MODEM_RESPONSE_VOICE", 0xC00A000F, -1);
    AddConstEx( id, "STATUS_CTX_TD_ERROR", 0xC00A0010, -1);
    AddConstEx( id, "STATUS_CTX_LICENSE_CLIENT_INVALID", 0xC00A0012, -1);
    AddConstEx( id, "STATUS_CTX_LICENSE_NOT_AVAILABLE", 0xC00A0013, -1);
    AddConstEx( id, "STATUS_CTX_LICENSE_EXPIRED", 0xC00A0014, -1);
    AddConstEx( id, "STATUS_CTX_WINSTATION_NOT_FOUND", 0xC00A0015, -1);
    AddConstEx( id, "STATUS_CTX_WINSTATION_NAME_COLLISION", 0xC00A0016, -1);
    AddConstEx( id, "STATUS_CTX_WINSTATION_BUSY", 0xC00A0017, -1);
    AddConstEx( id, "STATUS_CTX_BAD_VIDEO_MODE", 0xC00A0018, -1);
    AddConstEx( id, "STATUS_CTX_GRAPHICS_INVALID", 0xC00A0022, -1);
    AddConstEx( id, "STATUS_CTX_NOT_CONSOLE", 0xC00A0024, -1);
    AddConstEx( id, "STATUS_CTX_CLIENT_QUERY_TIMEOUT", 0xC00A0026, -1);
    AddConstEx( id, "STATUS_CTX_CONSOLE_DISCONNECT", 0xC00A0027, -1);
    AddConstEx( id, "STATUS_CTX_CONSOLE_CONNECT", 0xC00A0028, -1);
    AddConstEx( id, "STATUS_CTX_SHADOW_DENIED", 0xC00A002A, -1);
    AddConstEx( id, "STATUS_CTX_WINSTATION_ACCESS_DENIED", 0xC00A002B, -1);
    AddConstEx( id, "STATUS_CTX_INVALID_WD", 0xC00A002E, -1);
    AddConstEx( id, "STATUS_CTX_WD_NOT_FOUND", 0xC00A002F, -1);
    AddConstEx( id, "STATUS_CTX_SHADOW_INVALID", 0xC00A0030, -1);
    AddConstEx( id, "STATUS_CTX_SHADOW_DISABLED", 0xC00A0031, -1);
    AddConstEx( id, "STATUS_RDP_PROTOCOL_ERROR", 0xC00A0032, -1);
    AddConstEx( id, "STATUS_CTX_CLIENT_LICENSE_NOT_SET", 0xC00A0033, -1);
    AddConstEx( id, "STATUS_CTX_CLIENT_LICENSE_IN_USE", 0xC00A0034, -1);
    AddConstEx( id, "STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE", 0xC00A0035, -1);
    AddConstEx( id, "STATUS_CTX_SHADOW_NOT_RUNNING", 0xC00A0036, -1);
    AddConstEx( id, "STATUS_CTX_LOGON_DISABLED", 0xC00A0037, -1);
    AddConstEx( id, "STATUS_CTX_SECURITY_LAYER_ERROR", 0xC00A0038, -1);
    AddConstEx( id, "STATUS_TS_INCOMPATIBLE_SESSIONS", 0xC00A0039, -1);
    AddConstEx( id, "STATUS_TS_VIDEO_SUBSYSTEM_ERROR", 0xC00A003A, -1);
    AddConstEx( id, "STATUS_MUI_FILE_NOT_FOUND", 0xC00B0001, -1);
    AddConstEx( id, "STATUS_MUI_INVALID_FILE", 0xC00B0002, -1);
    AddConstEx( id, "STATUS_MUI_INVALID_RC_CONFIG", 0xC00B0003, -1);
    AddConstEx( id, "STATUS_MUI_INVALID_LOCALE_NAME", 0xC00B0004, -1);
    AddConstEx( id, "STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME", 0xC00B0005, -1);
    AddConstEx( id, "STATUS_MUI_FILE_NOT_LOADED", 0xC00B0006, -1);
    AddConstEx( id, "STATUS_RESOURCE_ENUM_USER_STOP", 0xC00B0007, -1);
    AddConstEx( id, "STATUS_CLUSTER_INVALID_NODE", 0xC0130001, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_EXISTS", 0xC0130002, -1);
    AddConstEx( id, "STATUS_CLUSTER_JOIN_IN_PROGRESS", 0xC0130003, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_NOT_FOUND", 0xC0130004, -1);
    AddConstEx( id, "STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND", 0xC0130005, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETWORK_EXISTS", 0xC0130006, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETWORK_NOT_FOUND", 0xC0130007, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETINTERFACE_EXISTS", 0xC0130008, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETINTERFACE_NOT_FOUND", 0xC0130009, -1);
    AddConstEx( id, "STATUS_CLUSTER_INVALID_REQUEST", 0xC013000A, -1);
    AddConstEx( id, "STATUS_CLUSTER_INVALID_NETWORK_PROVIDER", 0xC013000B, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_DOWN", 0xC013000C, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_UNREACHABLE", 0xC013000D, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_NOT_MEMBER", 0xC013000E, -1);
    AddConstEx( id, "STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS", 0xC013000F, -1);
    AddConstEx( id, "STATUS_CLUSTER_INVALID_NETWORK", 0xC0130010, -1);
    AddConstEx( id, "STATUS_CLUSTER_NO_NET_ADAPTERS", 0xC0130011, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_UP", 0xC0130012, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_PAUSED", 0xC0130013, -1);
    AddConstEx( id, "STATUS_CLUSTER_NODE_NOT_PAUSED", 0xC0130014, -1);
    AddConstEx( id, "STATUS_CLUSTER_NO_SECURITY_CONTEXT", 0xC0130015, -1);
    AddConstEx( id, "STATUS_CLUSTER_NETWORK_NOT_INTERNAL", 0xC0130016, -1);
    AddConstEx( id, "STATUS_CLUSTER_POISONED", 0xC0130017, -1);
    AddConstEx( id, "STATUS_CLUSTER_NON_CSV_PATH", 0xC0130018, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_VOLUME_NOT_LOCAL", 0xC0130019, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_READ_OPLOCK_BREAK_IN_PROGRESS", 0xC0130020, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_AUTO_PAUSE_ERROR", 0xC0130021, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_REDIRECTED", 0xC0130022, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_NOT_REDIRECTED", 0xC0130023, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_VOLUME_DRAINING", 0xC0130024, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_SNAPSHOT_CREATION_IN_PROGRESS", 0xC0130025, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_VOLUME_DRAINING_SUCCEEDED_DOWNLEVEL", 0xC0130026, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_NO_SNAPSHOTS", 0xC0130027, -1);
    AddConstEx( id, "STATUS_CSV_IO_PAUSE_TIMEOUT", 0xC0130028, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_INVALID_HANDLE", 0xC0130029, -1);
    AddConstEx( id, "STATUS_CLUSTER_CSV_SUPPORTED_ONLY_ON_COORDINATOR", 0xC0130030, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_OPCODE", 0xC0140001, -1);
    AddConstEx( id, "STATUS_ACPI_STACK_OVERFLOW", 0xC0140002, -1);
    AddConstEx( id, "STATUS_ACPI_ASSERT_FAILED", 0xC0140003, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_INDEX", 0xC0140004, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_ARGUMENT", 0xC0140005, -1);
    AddConstEx( id, "STATUS_ACPI_FATAL", 0xC0140006, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_SUPERNAME", 0xC0140007, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_ARGTYPE", 0xC0140008, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_OBJTYPE", 0xC0140009, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_TARGETTYPE", 0xC014000A, -1);
    AddConstEx( id, "STATUS_ACPI_INCORRECT_ARGUMENT_COUNT", 0xC014000B, -1);
    AddConstEx( id, "STATUS_ACPI_ADDRESS_NOT_MAPPED", 0xC014000C, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_EVENTTYPE", 0xC014000D, -1);
    AddConstEx( id, "STATUS_ACPI_HANDLER_COLLISION", 0xC014000E, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_DATA", 0xC014000F, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_REGION", 0xC0140010, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_ACCESS_SIZE", 0xC0140011, -1);
    AddConstEx( id, "STATUS_ACPI_ACQUIRE_GLOBAL_LOCK", 0xC0140012, -1);
    AddConstEx( id, "STATUS_ACPI_ALREADY_INITIALIZED", 0xC0140013, -1);
    AddConstEx( id, "STATUS_ACPI_NOT_INITIALIZED", 0xC0140014, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_MUTEX_LEVEL", 0xC0140015, -1);
    AddConstEx( id, "STATUS_ACPI_MUTEX_NOT_OWNED", 0xC0140016, -1);
    AddConstEx( id, "STATUS_ACPI_MUTEX_NOT_OWNER", 0xC0140017, -1);
    AddConstEx( id, "STATUS_ACPI_RS_ACCESS", 0xC0140018, -1);
    AddConstEx( id, "STATUS_ACPI_INVALID_TABLE", 0xC0140019, -1);
    AddConstEx( id, "STATUS_ACPI_REG_HANDLER_FAILED", 0xC0140020, -1);
    AddConstEx( id, "STATUS_ACPI_POWER_REQUEST_FAILED", 0xC0140021, -1);
    AddConstEx( id, "STATUS_SXS_SECTION_NOT_FOUND", 0xC0150001, -1);
    AddConstEx( id, "STATUS_SXS_CANT_GEN_ACTCTX", 0xC0150002, -1);
    AddConstEx( id, "STATUS_SXS_INVALID_ACTCTXDATA_FORMAT", 0xC0150003, -1);
    AddConstEx( id, "STATUS_SXS_ASSEMBLY_NOT_FOUND", 0xC0150004, -1);
    AddConstEx( id, "STATUS_SXS_MANIFEST_FORMAT_ERROR", 0xC0150005, -1);
    AddConstEx( id, "STATUS_SXS_MANIFEST_PARSE_ERROR", 0xC0150006, -1);
    AddConstEx( id, "STATUS_SXS_ACTIVATION_CONTEXT_DISABLED", 0xC0150007, -1);
    AddConstEx( id, "STATUS_SXS_KEY_NOT_FOUND", 0xC0150008, -1);
    AddConstEx( id, "STATUS_SXS_VERSION_CONFLICT", 0xC0150009, -1);
    AddConstEx( id, "STATUS_SXS_WRONG_SECTION_TYPE", 0xC015000A, -1);
    AddConstEx( id, "STATUS_SXS_THREAD_QUERIES_DISABLED", 0xC015000B, -1);
    AddConstEx( id, "STATUS_SXS_ASSEMBLY_MISSING", 0xC015000C, -1);
    AddConstEx( id, "STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET", 0xC015000E, -1);
    AddConstEx( id, "STATUS_SXS_EARLY_DEACTIVATION", 0xC015000F, -1);
    AddConstEx( id, "STATUS_SXS_INVALID_DEACTIVATION", 0xC0150010, -1);
    AddConstEx( id, "STATUS_SXS_MULTIPLE_DEACTIVATION", 0xC0150011, -1);
    AddConstEx( id, "STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY", 0xC0150012, -1);
    AddConstEx( id, "STATUS_SXS_PROCESS_TERMINATION_REQUESTED", 0xC0150013, -1);
    AddConstEx( id, "STATUS_SXS_CORRUPT_ACTIVATION_STACK", 0xC0150014, -1);
    AddConstEx( id, "STATUS_SXS_CORRUPTION", 0xC0150015, -1);
    AddConstEx( id, "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE", 0xC0150016, -1);
    AddConstEx( id, "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME", 0xC0150017, -1);
    AddConstEx( id, "STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE", 0xC0150018, -1);
    AddConstEx( id, "STATUS_SXS_IDENTITY_PARSE_ERROR", 0xC0150019, -1);
    AddConstEx( id, "STATUS_SXS_COMPONENT_STORE_CORRUPT", 0xC015001A, -1);
    AddConstEx( id, "STATUS_SXS_FILE_HASH_MISMATCH", 0xC015001B, -1);
    AddConstEx( id, "STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT", 0xC015001C, -1);
    AddConstEx( id, "STATUS_SXS_IDENTITIES_DIFFERENT", 0xC015001D, -1);
    AddConstEx( id, "STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT", 0xC015001E, -1);
    AddConstEx( id, "STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY", 0xC015001F, -1);
    AddConstEx( id, "STATUS_ADVANCED_INSTALLER_FAILED", 0xC0150020, -1);
    AddConstEx( id, "STATUS_XML_ENCODING_MISMATCH", 0xC0150021, -1);
    AddConstEx( id, "STATUS_SXS_MANIFEST_TOO_BIG", 0xC0150022, -1);
    AddConstEx( id, "STATUS_SXS_SETTING_NOT_REGISTERED", 0xC0150023, -1);
    AddConstEx( id, "STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE", 0xC0150024, -1);
    AddConstEx( id, "STATUS_SMI_PRIMITIVE_INSTALLER_FAILED", 0xC0150025, -1);
    AddConstEx( id, "STATUS_GENERIC_COMMAND_FAILED", 0xC0150026, -1);
    AddConstEx( id, "STATUS_SXS_FILE_HASH_MISSING", 0xC0150027, -1);
    AddConstEx( id, "STATUS_TRANSACTIONAL_CONFLICT", 0xC0190001, -1);
    AddConstEx( id, "STATUS_INVALID_TRANSACTION", 0xC0190002, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NOT_ACTIVE", 0xC0190003, -1);
    AddConstEx( id, "STATUS_TM_INITIALIZATION_FAILED", 0xC0190004, -1);
    AddConstEx( id, "STATUS_RM_NOT_ACTIVE", 0xC0190005, -1);
    AddConstEx( id, "STATUS_RM_METADATA_CORRUPT", 0xC0190006, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NOT_JOINED", 0xC0190007, -1);
    AddConstEx( id, "STATUS_DIRECTORY_NOT_RM", 0xC0190008, -1);
    AddConstEx( id, "STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE", 0xC019000A, -1);
    AddConstEx( id, "STATUS_LOG_RESIZE_INVALID_SIZE", 0xC019000B, -1);
    AddConstEx( id, "STATUS_REMOTE_FILE_VERSION_MISMATCH", 0xC019000C, -1);
    AddConstEx( id, "STATUS_CRM_PROTOCOL_ALREADY_EXISTS", 0xC019000F, -1);
    AddConstEx( id, "STATUS_TRANSACTION_PROPAGATION_FAILED", 0xC0190010, -1);
    AddConstEx( id, "STATUS_CRM_PROTOCOL_NOT_FOUND", 0xC0190011, -1);
    AddConstEx( id, "STATUS_TRANSACTION_SUPERIOR_EXISTS", 0xC0190012, -1);
    AddConstEx( id, "STATUS_TRANSACTION_REQUEST_NOT_VALID", 0xC0190013, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NOT_REQUESTED", 0xC0190014, -1);
    AddConstEx( id, "STATUS_TRANSACTION_ALREADY_ABORTED", 0xC0190015, -1);
    AddConstEx( id, "STATUS_TRANSACTION_ALREADY_COMMITTED", 0xC0190016, -1);
    AddConstEx( id, "STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER", 0xC0190017, -1);
    AddConstEx( id, "STATUS_CURRENT_TRANSACTION_NOT_VALID", 0xC0190018, -1);
    AddConstEx( id, "STATUS_LOG_GROWTH_FAILED", 0xC0190019, -1);
    AddConstEx( id, "STATUS_OBJECT_NO_LONGER_EXISTS", 0xC0190021, -1);
    AddConstEx( id, "STATUS_STREAM_MINIVERSION_NOT_FOUND", 0xC0190022, -1);
    AddConstEx( id, "STATUS_STREAM_MINIVERSION_NOT_VALID", 0xC0190023, -1);
    AddConstEx( id, "STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION", 0xC0190024, -1);
    AddConstEx( id, "STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT", 0xC0190025, -1);
    AddConstEx( id, "STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS", 0xC0190026, -1);
    AddConstEx( id, "STATUS_HANDLE_NO_LONGER_VALID", 0xC0190028, -1);
    AddConstEx( id, "STATUS_LOG_CORRUPTION_DETECTED", 0xC0190030, -1);
    AddConstEx( id, "STATUS_RM_DISCONNECTED", 0xC0190032, -1);
    AddConstEx( id, "STATUS_ENLISTMENT_NOT_SUPERIOR", 0xC0190033, -1);
    AddConstEx( id, "STATUS_FILE_IDENTITY_NOT_PERSISTENT", 0xC0190036, -1);
    AddConstEx( id, "STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY", 0xC0190037, -1);
    AddConstEx( id, "STATUS_CANT_CROSS_RM_BOUNDARY", 0xC0190038, -1);
    AddConstEx( id, "STATUS_TXF_DIR_NOT_EMPTY", 0xC0190039, -1);
    AddConstEx( id, "STATUS_INDOUBT_TRANSACTIONS_EXIST", 0xC019003A, -1);
    AddConstEx( id, "STATUS_TM_VOLATILE", 0xC019003B, -1);
    AddConstEx( id, "STATUS_ROLLBACK_TIMER_EXPIRED", 0xC019003C, -1);
    AddConstEx( id, "STATUS_TXF_ATTRIBUTE_CORRUPT", 0xC019003D, -1);
    AddConstEx( id, "STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION", 0xC019003E, -1);
    AddConstEx( id, "STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED", 0xC019003F, -1);
    AddConstEx( id, "STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE", 0xC0190040, -1);
    AddConstEx( id, "STATUS_TRANSACTION_REQUIRED_PROMOTION", 0xC0190043, -1);
    AddConstEx( id, "STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION", 0xC0190044, -1);
    AddConstEx( id, "STATUS_TRANSACTIONS_NOT_FROZEN", 0xC0190045, -1);
    AddConstEx( id, "STATUS_TRANSACTION_FREEZE_IN_PROGRESS", 0xC0190046, -1);
    AddConstEx( id, "STATUS_NOT_SNAPSHOT_VOLUME", 0xC0190047, -1);
    AddConstEx( id, "STATUS_NO_SAVEPOINT_WITH_OPEN_FILES", 0xC0190048, -1);
    AddConstEx( id, "STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION", 0xC0190049, -1);
    AddConstEx( id, "STATUS_TM_IDENTITY_MISMATCH", 0xC019004A, -1);
    AddConstEx( id, "STATUS_FLOATED_SECTION", 0xC019004B, -1);
    AddConstEx( id, "STATUS_CANNOT_ACCEPT_TRANSACTED_WORK", 0xC019004C, -1);
    AddConstEx( id, "STATUS_CANNOT_ABORT_TRANSACTIONS", 0xC019004D, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NOT_FOUND", 0xC019004E, -1);
    AddConstEx( id, "STATUS_RESOURCEMANAGER_NOT_FOUND", 0xC019004F, -1);
    AddConstEx( id, "STATUS_ENLISTMENT_NOT_FOUND", 0xC0190050, -1);
    AddConstEx( id, "STATUS_TRANSACTIONMANAGER_NOT_FOUND", 0xC0190051, -1);
    AddConstEx( id, "STATUS_TRANSACTIONMANAGER_NOT_ONLINE", 0xC0190052, -1);
    AddConstEx( id, "STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION", 0xC0190053, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NOT_ROOT", 0xC0190054, -1);
    AddConstEx( id, "STATUS_TRANSACTION_OBJECT_EXPIRED", 0xC0190055, -1);
    AddConstEx( id, "STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION", 0xC0190056, -1);
    AddConstEx( id, "STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED", 0xC0190057, -1);
    AddConstEx( id, "STATUS_TRANSACTION_RECORD_TOO_LONG", 0xC0190058, -1);
    AddConstEx( id, "STATUS_NO_LINK_TRACKING_IN_TRANSACTION", 0xC0190059, -1);
    AddConstEx( id, "STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION", 0xC019005A, -1);
    AddConstEx( id, "STATUS_TRANSACTION_INTEGRITY_VIOLATED", 0xC019005B, -1);
    AddConstEx( id, "STATUS_TRANSACTIONMANAGER_IDENTITY_MISMATCH", 0xC019005C, -1);
    AddConstEx( id, "STATUS_RM_CANNOT_BE_FROZEN_FOR_SNAPSHOT", 0xC019005D, -1);
    AddConstEx( id, "STATUS_TRANSACTION_MUST_WRITETHROUGH", 0xC019005E, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NO_SUPERIOR", 0xC019005F, -1);
    AddConstEx( id, "STATUS_EXPIRED_HANDLE", 0xC0190060, -1);
    AddConstEx( id, "STATUS_TRANSACTION_NOT_ENLISTED", 0xC0190061, -1);
    AddConstEx( id, "STATUS_LOG_SECTOR_INVALID", 0xC01A0001, -1);
    AddConstEx( id, "STATUS_LOG_SECTOR_PARITY_INVALID", 0xC01A0002, -1);
    AddConstEx( id, "STATUS_LOG_SECTOR_REMAPPED", 0xC01A0003, -1);
    AddConstEx( id, "STATUS_LOG_BLOCK_INCOMPLETE", 0xC01A0004, -1);
    AddConstEx( id, "STATUS_LOG_INVALID_RANGE", 0xC01A0005, -1);
    AddConstEx( id, "STATUS_LOG_BLOCKS_EXHAUSTED", 0xC01A0006, -1);
    AddConstEx( id, "STATUS_LOG_READ_CONTEXT_INVALID", 0xC01A0007, -1);
    AddConstEx( id, "STATUS_LOG_RESTART_INVALID", 0xC01A0008, -1);
    AddConstEx( id, "STATUS_LOG_BLOCK_VERSION", 0xC01A0009, -1);
    AddConstEx( id, "STATUS_LOG_BLOCK_INVALID", 0xC01A000A, -1);
    AddConstEx( id, "STATUS_LOG_READ_MODE_INVALID", 0xC01A000B, -1);
    AddConstEx( id, "STATUS_LOG_METADATA_CORRUPT", 0xC01A000D, -1);
    AddConstEx( id, "STATUS_LOG_METADATA_INVALID", 0xC01A000E, -1);
    AddConstEx( id, "STATUS_LOG_METADATA_INCONSISTENT", 0xC01A000F, -1);
    AddConstEx( id, "STATUS_LOG_RESERVATION_INVALID", 0xC01A0010, -1);
    AddConstEx( id, "STATUS_LOG_CANT_DELETE", 0xC01A0011, -1);
    AddConstEx( id, "STATUS_LOG_CONTAINER_LIMIT_EXCEEDED", 0xC01A0012, -1);
    AddConstEx( id, "STATUS_LOG_START_OF_LOG", 0xC01A0013, -1);
    AddConstEx( id, "STATUS_LOG_POLICY_ALREADY_INSTALLED", 0xC01A0014, -1);
    AddConstEx( id, "STATUS_LOG_POLICY_NOT_INSTALLED", 0xC01A0015, -1);
    AddConstEx( id, "STATUS_LOG_POLICY_INVALID", 0xC01A0016, -1);
    AddConstEx( id, "STATUS_LOG_POLICY_CONFLICT", 0xC01A0017, -1);
    AddConstEx( id, "STATUS_LOG_PINNED_ARCHIVE_TAIL", 0xC01A0018, -1);
    AddConstEx( id, "STATUS_LOG_RECORD_NONEXISTENT", 0xC01A0019, -1);
    AddConstEx( id, "STATUS_LOG_RECORDS_RESERVED_INVALID", 0xC01A001A, -1);
    AddConstEx( id, "STATUS_LOG_SPACE_RESERVED_INVALID", 0xC01A001B, -1);
    AddConstEx( id, "STATUS_LOG_TAIL_INVALID", 0xC01A001C, -1);
    AddConstEx( id, "STATUS_LOG_FULL", 0xC01A001D, -1);
    AddConstEx( id, "STATUS_LOG_MULTIPLEXED", 0xC01A001E, -1);
    AddConstEx( id, "STATUS_LOG_DEDICATED", 0xC01A001F, -1);
    AddConstEx( id, "STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS", 0xC01A0020, -1);
    AddConstEx( id, "STATUS_LOG_ARCHIVE_IN_PROGRESS", 0xC01A0021, -1);
    AddConstEx( id, "STATUS_LOG_EPHEMERAL", 0xC01A0022, -1);
    AddConstEx( id, "STATUS_LOG_NOT_ENOUGH_CONTAINERS", 0xC01A0023, -1);
    AddConstEx( id, "STATUS_LOG_CLIENT_ALREADY_REGISTERED", 0xC01A0024, -1);
    AddConstEx( id, "STATUS_LOG_CLIENT_NOT_REGISTERED", 0xC01A0025, -1);
    AddConstEx( id, "STATUS_LOG_FULL_HANDLER_IN_PROGRESS", 0xC01A0026, -1);
    AddConstEx( id, "STATUS_LOG_CONTAINER_READ_FAILED", 0xC01A0027, -1);
    AddConstEx( id, "STATUS_LOG_CONTAINER_WRITE_FAILED", 0xC01A0028, -1);
    AddConstEx( id, "STATUS_LOG_CONTAINER_OPEN_FAILED", 0xC01A0029, -1);
    AddConstEx( id, "STATUS_LOG_CONTAINER_STATE_INVALID", 0xC01A002A, -1);
    AddConstEx( id, "STATUS_LOG_STATE_INVALID", 0xC01A002B, -1);
    AddConstEx( id, "STATUS_LOG_PINNED", 0xC01A002C, -1);
    AddConstEx( id, "STATUS_LOG_METADATA_FLUSH_FAILED", 0xC01A002D, -1);
    AddConstEx( id, "STATUS_LOG_INCONSISTENT_SECURITY", 0xC01A002E, -1);
    AddConstEx( id, "STATUS_LOG_APPENDED_FLUSH_FAILED", 0xC01A002F, -1);
    AddConstEx( id, "STATUS_LOG_PINNED_RESERVATION", 0xC01A0030, -1);
    AddConstEx( id, "STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD", 0xC01B00EA, -1);
    AddConstEx( id, "STATUS_FLT_NO_HANDLER_DEFINED", 0xC01C0001, -1);
    AddConstEx( id, "STATUS_FLT_CONTEXT_ALREADY_DEFINED", 0xC01C0002, -1);
    AddConstEx( id, "STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST", 0xC01C0003, -1);
    AddConstEx( id, "STATUS_FLT_DISALLOW_FAST_IO", 0xC01C0004, -1);
    AddConstEx( id, "STATUS_FLT_INVALID_NAME_REQUEST", 0xC01C0005, -1);
    AddConstEx( id, "STATUS_FLT_NOT_SAFE_TO_POST_OPERATION", 0xC01C0006, -1);
    AddConstEx( id, "STATUS_FLT_NOT_INITIALIZED", 0xC01C0007, -1);
    AddConstEx( id, "STATUS_FLT_FILTER_NOT_READY", 0xC01C0008, -1);
    AddConstEx( id, "STATUS_FLT_POST_OPERATION_CLEANUP", 0xC01C0009, -1);
    AddConstEx( id, "STATUS_FLT_INTERNAL_ERROR", 0xC01C000A, -1);
    AddConstEx( id, "STATUS_FLT_DELETING_OBJECT", 0xC01C000B, -1);
    AddConstEx( id, "STATUS_FLT_MUST_BE_NONPAGED_POOL", 0xC01C000C, -1);
    AddConstEx( id, "STATUS_FLT_DUPLICATE_ENTRY", 0xC01C000D, -1);
    AddConstEx( id, "STATUS_FLT_CBDQ_DISABLED", 0xC01C000E, -1);
    AddConstEx( id, "STATUS_FLT_DO_NOT_ATTACH", 0xC01C000F, -1);
    AddConstEx( id, "STATUS_FLT_DO_NOT_DETACH", 0xC01C0010, -1);
    AddConstEx( id, "STATUS_FLT_INSTANCE_ALTITUDE_COLLISION", 0xC01C0011, -1);
    AddConstEx( id, "STATUS_FLT_INSTANCE_NAME_COLLISION", 0xC01C0012, -1);
    AddConstEx( id, "STATUS_FLT_FILTER_NOT_FOUND", 0xC01C0013, -1);
    AddConstEx( id, "STATUS_FLT_VOLUME_NOT_FOUND", 0xC01C0014, -1);
    AddConstEx( id, "STATUS_FLT_INSTANCE_NOT_FOUND", 0xC01C0015, -1);
    AddConstEx( id, "STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND", 0xC01C0016, -1);
    AddConstEx( id, "STATUS_FLT_INVALID_CONTEXT_REGISTRATION", 0xC01C0017, -1);
    AddConstEx( id, "STATUS_FLT_NAME_CACHE_MISS", 0xC01C0018, -1);
    AddConstEx( id, "STATUS_FLT_NO_DEVICE_OBJECT", 0xC01C0019, -1);
    AddConstEx( id, "STATUS_FLT_VOLUME_ALREADY_MOUNTED", 0xC01C001A, -1);
    AddConstEx( id, "STATUS_FLT_ALREADY_ENLISTED", 0xC01C001B, -1);
    AddConstEx( id, "STATUS_FLT_CONTEXT_ALREADY_LINKED", 0xC01C001C, -1);
    AddConstEx( id, "STATUS_FLT_NO_WAITER_FOR_REPLY", 0xC01C0020, -1);
    AddConstEx( id, "STATUS_FLT_REGISTRATION_BUSY", 0xC01C0023, -1);
    AddConstEx( id, "STATUS_MONITOR_NO_DESCRIPTOR", 0xC01D0001, -1);
    AddConstEx( id, "STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT", 0xC01D0002, -1);
    AddConstEx( id, "STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM", 0xC01D0003, -1);
    AddConstEx( id, "STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK", 0xC01D0004, -1);
    AddConstEx( id, "STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED", 0xC01D0005, -1);
    AddConstEx( id, "STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK", 0xC01D0006, -1);
    AddConstEx( id, "STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK", 0xC01D0007, -1);
    AddConstEx( id, "STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA", 0xC01D0008, -1);
    AddConstEx( id, "STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK", 0xC01D0009, -1);
    AddConstEx( id, "STATUS_MONITOR_INVALID_MANUFACTURE_DATE", 0xC01D000A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER", 0xC01E0000, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER", 0xC01E0001, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER", 0xC01E0002, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ADAPTER_WAS_RESET", 0xC01E0003, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_DRIVER_MODEL", 0xC01E0004, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PRESENT_MODE_CHANGED", 0xC01E0005, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PRESENT_OCCLUDED", 0xC01E0006, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PRESENT_DENIED", 0xC01E0007, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CANNOTCOLORCONVERT", 0xC01E0008, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DRIVER_MISMATCH", 0xC01E0009, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED", 0xC01E000B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PRESENT_UNOCCLUDED", 0xC01E000C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_WINDOWDC_NOT_AVAILABLE", 0xC01E000D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_WINDOWLESS_PRESENT_DISABLED", 0xC01E000E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_VIDEO_MEMORY", 0xC01E0100, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CANT_LOCK_MEMORY", 0xC01E0101, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ALLOCATION_BUSY", 0xC01E0102, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TOO_MANY_REFERENCES", 0xC01E0103, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TRY_AGAIN_LATER", 0xC01E0104, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TRY_AGAIN_NOW", 0xC01E0105, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ALLOCATION_INVALID", 0xC01E0106, -1);
    AddConstEx( id, "STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE", 0xC01E0107, -1);
    AddConstEx( id, "STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED", 0xC01E0108, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION", 0xC01E0109, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE", 0xC01E0110, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION", 0xC01E0111, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ALLOCATION_CLOSED", 0xC01E0112, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE", 0xC01E0113, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE", 0xC01E0114, -1);
    AddConstEx( id, "STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE", 0xC01E0115, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST", 0xC01E0116, -1);
    AddConstEx( id, "STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE", 0xC01E0200, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY", 0xC01E0300, -1);
    AddConstEx( id, "STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED", 0xC01E0301, -1);
    AddConstEx( id, "STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED", 0xC01E0302, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN", 0xC01E0303, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE", 0xC01E0304, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET", 0xC01E0305, -1);
    AddConstEx( id, "STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED", 0xC01E0306, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET", 0xC01E0308, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET", 0xC01E0309, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_FREQUENCY", 0xC01E030A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_ACTIVE_REGION", 0xC01E030B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_TOTAL_REGION", 0xC01E030C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE", 0xC01E0310, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE", 0xC01E0311, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET", 0xC01E0312, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY", 0xC01E0313, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET", 0xC01E0314, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET", 0xC01E0315, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET", 0xC01E0316, -1);
    AddConstEx( id, "STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET", 0xC01E0317, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TARGET_ALREADY_IN_SET", 0xC01E0318, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH", 0xC01E0319, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY", 0xC01E031A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET", 0xC01E031B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE", 0xC01E031C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET", 0xC01E031D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET", 0xC01E031F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_STALE_MODESET", 0xC01E0320, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET", 0xC01E0321, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE", 0xC01E0322, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN", 0xC01E0323, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE", 0xC01E0324, -1);
    AddConstEx( id, "STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION", 0xC01E0325, -1);
    AddConstEx( id, "STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES", 0xC01E0326, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY", 0xC01E0327, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE", 0xC01E0328, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET", 0xC01E0329, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET", 0xC01E032A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR", 0xC01E032B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET", 0xC01E032C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET", 0xC01E032D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE", 0xC01E032E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE", 0xC01E032F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_RESOURCES_NOT_RELATED", 0xC01E0330, -1);
    AddConstEx( id, "STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE", 0xC01E0331, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE", 0xC01E0332, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET", 0xC01E0333, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER", 0xC01E0334, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_VIDPNMGR", 0xC01E0335, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_ACTIVE_VIDPN", 0xC01E0336, -1);
    AddConstEx( id, "STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY", 0xC01E0337, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MONITOR_NOT_CONNECTED", 0xC01E0338, -1);
    AddConstEx( id, "STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY", 0xC01E0339, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE", 0xC01E033A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE", 0xC01E033B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_STRIDE", 0xC01E033C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PIXELFORMAT", 0xC01E033D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_COLORBASIS", 0xC01E033E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE", 0xC01E033F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY", 0xC01E0340, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT", 0xC01E0341, -1);
    AddConstEx( id, "STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE", 0xC01E0342, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN", 0xC01E0343, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL", 0xC01E0344, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION", 0xC01E0345, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED", 0xC01E0346, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_GAMMA_RAMP", 0xC01E0347, -1);
    AddConstEx( id, "STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED", 0xC01E0348, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED", 0xC01E0349, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MODE_NOT_IN_MODESET", 0xC01E034A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON", 0xC01E034D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE", 0xC01E034E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE", 0xC01E034F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS", 0xC01E0350, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING", 0xC01E0352, -1);
    AddConstEx( id, "STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED", 0xC01E0353, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS", 0xC01E0354, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT", 0xC01E0355, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM", 0xC01E0356, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN", 0xC01E0357, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT", 0xC01E0358, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED", 0xC01E0359, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION", 0xC01E035A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_CLIENT_TYPE", 0xC01E035B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET", 0xC01E035C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED", 0xC01E0400, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED", 0xC01E0401, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER", 0xC01E0430, -1);
    AddConstEx( id, "STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED", 0xC01E0431, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED", 0xC01E0432, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY", 0xC01E0433, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED", 0xC01E0434, -1);
    AddConstEx( id, "STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON", 0xC01E0435, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE", 0xC01E0436, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER", 0xC01E0438, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED", 0xC01E043B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_NOT_SUPPORTED", 0xC01E0500, -1);
    AddConstEx( id, "STATUS_GRAPHICS_COPP_NOT_SUPPORTED", 0xC01E0501, -1);
    AddConstEx( id, "STATUS_GRAPHICS_UAB_NOT_SUPPORTED", 0xC01E0502, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS", 0xC01E0503, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST", 0xC01E0505, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_INTERNAL_ERROR", 0xC01E050B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_INVALID_HANDLE", 0xC01E050C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH", 0xC01E050E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED", 0xC01E050F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED", 0xC01E0510, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PVP_HFS_FAILED", 0xC01E0511, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_INVALID_SRM", 0xC01E0512, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP", 0xC01E0513, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP", 0xC01E0514, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA", 0xC01E0515, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET", 0xC01E0516, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH", 0xC01E0517, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE", 0xC01E0518, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS", 0xC01E051A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS", 0xC01E051C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST", 0xC01E051D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR", 0xC01E051E, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS", 0xC01E051F, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED", 0xC01E0520, -1);
    AddConstEx( id, "STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST", 0xC01E0521, -1);
    AddConstEx( id, "STATUS_GRAPHICS_I2C_NOT_SUPPORTED", 0xC01E0580, -1);
    AddConstEx( id, "STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST", 0xC01E0581, -1);
    AddConstEx( id, "STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA", 0xC01E0582, -1);
    AddConstEx( id, "STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA", 0xC01E0583, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED", 0xC01E0584, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_INVALID_DATA", 0xC01E0585, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE", 0xC01E0586, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING", 0xC01E0587, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MCA_INTERNAL_ERROR", 0xC01E0588, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND", 0xC01E0589, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH", 0xC01E058A, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM", 0xC01E058B, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE", 0xC01E058C, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS", 0xC01E058D, -1);
    AddConstEx( id, "STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED", 0xC01E05E0, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME", 0xC01E05E1, -1);
    AddConstEx( id, "STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP", 0xC01E05E2, -1);
    AddConstEx( id, "STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED", 0xC01E05E3, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INVALID_POINTER", 0xC01E05E4, -1);
    AddConstEx( id, "STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE", 0xC01E05E5, -1);
    AddConstEx( id, "STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL", 0xC01E05E6, -1);
    AddConstEx( id, "STATUS_GRAPHICS_INTERNAL_ERROR", 0xC01E05E7, -1);
    AddConstEx( id, "STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS", 0xC01E05E8, -1);
    AddConstEx( id, "STATUS_FVE_LOCKED_VOLUME", 0xC0210000, -1);
    AddConstEx( id, "STATUS_FVE_NOT_ENCRYPTED", 0xC0210001, -1);
    AddConstEx( id, "STATUS_FVE_BAD_INFORMATION", 0xC0210002, -1);
    AddConstEx( id, "STATUS_FVE_TOO_SMALL", 0xC0210003, -1);
    AddConstEx( id, "STATUS_FVE_FAILED_WRONG_FS", 0xC0210004, -1);
    AddConstEx( id, "STATUS_FVE_BAD_PARTITION_SIZE", 0xC0210005, -1);
    AddConstEx( id, "STATUS_FVE_FS_NOT_EXTENDED", 0xC0210006, -1);
    AddConstEx( id, "STATUS_FVE_FS_MOUNTED", 0xC0210007, -1);
    AddConstEx( id, "STATUS_FVE_NO_LICENSE", 0xC0210008, -1);
    AddConstEx( id, "STATUS_FVE_ACTION_NOT_ALLOWED", 0xC0210009, -1);
    AddConstEx( id, "STATUS_FVE_BAD_DATA", 0xC021000A, -1);
    AddConstEx( id, "STATUS_FVE_VOLUME_NOT_BOUND", 0xC021000B, -1);
    AddConstEx( id, "STATUS_FVE_NOT_DATA_VOLUME", 0xC021000C, -1);
    AddConstEx( id, "STATUS_FVE_CONV_READ_ERROR", 0xC021000D, -1);
    AddConstEx( id, "STATUS_FVE_CONV_WRITE_ERROR", 0xC021000E, -1);
    AddConstEx( id, "STATUS_FVE_OVERLAPPED_UPDATE", 0xC021000F, -1);
    AddConstEx( id, "STATUS_FVE_FAILED_SECTOR_SIZE", 0xC0210010, -1);
    AddConstEx( id, "STATUS_FVE_FAILED_AUTHENTICATION", 0xC0210011, -1);
    AddConstEx( id, "STATUS_FVE_NOT_OS_VOLUME", 0xC0210012, -1);
    AddConstEx( id, "STATUS_FVE_KEYFILE_NOT_FOUND", 0xC0210013, -1);
    AddConstEx( id, "STATUS_FVE_KEYFILE_INVALID", 0xC0210014, -1);
    AddConstEx( id, "STATUS_FVE_KEYFILE_NO_VMK", 0xC0210015, -1);
    AddConstEx( id, "STATUS_FVE_TPM_DISABLED", 0xC0210016, -1);
    AddConstEx( id, "STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO", 0xC0210017, -1);
    AddConstEx( id, "STATUS_FVE_TPM_INVALID_PCR", 0xC0210018, -1);
    AddConstEx( id, "STATUS_FVE_TPM_NO_VMK", 0xC0210019, -1);
    AddConstEx( id, "STATUS_FVE_PIN_INVALID", 0xC021001A, -1);
    AddConstEx( id, "STATUS_FVE_AUTH_INVALID_APPLICATION", 0xC021001B, -1);
    AddConstEx( id, "STATUS_FVE_AUTH_INVALID_CONFIG", 0xC021001C, -1);
    AddConstEx( id, "STATUS_FVE_DEBUGGER_ENABLED", 0xC021001D, -1);
    AddConstEx( id, "STATUS_FVE_DRY_RUN_FAILED", 0xC021001E, -1);
    AddConstEx( id, "STATUS_FVE_BAD_METADATA_POINTER", 0xC021001F, -1);
    AddConstEx( id, "STATUS_FVE_OLD_METADATA_COPY", 0xC0210020, -1);
    AddConstEx( id, "STATUS_FVE_REBOOT_REQUIRED", 0xC0210021, -1);
    AddConstEx( id, "STATUS_FVE_RAW_ACCESS", 0xC0210022, -1);
    AddConstEx( id, "STATUS_FVE_RAW_BLOCKED", 0xC0210023, -1);
    AddConstEx( id, "STATUS_FVE_NO_AUTOUNLOCK_MASTER_KEY", 0xC0210024, -1);
    AddConstEx( id, "STATUS_FVE_MOR_FAILED", 0xC0210025, -1);
    AddConstEx( id, "STATUS_FVE_NO_FEATURE_LICENSE", 0xC0210026, -1);
    AddConstEx( id, "STATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED", 0xC0210027, -1);
    AddConstEx( id, "STATUS_FVE_CONV_RECOVERY_FAILED", 0xC0210028, -1);
    AddConstEx( id, "STATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG", 0xC0210029, -1);
    AddConstEx( id, "STATUS_FVE_INVALID_DATUM_TYPE", 0xC021002A, -1);
    AddConstEx( id, "STATUS_FVE_VOLUME_TOO_SMALL", 0xC0210030, -1);
    AddConstEx( id, "STATUS_FVE_ENH_PIN_INVALID", 0xC0210031, -1);
    AddConstEx( id, "STATUS_FVE_FULL_ENCRYPTION_NOT_ALLOWED_ON_TP_STORAGE", 0xC0210032, -1);
    AddConstEx( id, "STATUS_FVE_WIPE_NOT_ALLOWED_ON_TP_STORAGE", 0xC0210033, -1);
    AddConstEx( id, "STATUS_FVE_NOT_ALLOWED_ON_CSV_STACK", 0xC0210034, -1);
    AddConstEx( id, "STATUS_FVE_NOT_ALLOWED_ON_CLUSTER", 0xC0210035, -1);
    AddConstEx( id, "STATUS_FVE_NOT_ALLOWED_TO_UPGRADE_WHILE_CONVERTING", 0xC0210036, -1);
    AddConstEx( id, "STATUS_FVE_WIPE_CANCEL_NOT_APPLICABLE", 0xC0210037, -1);
    AddConstEx( id, "STATUS_FVE_EDRIVE_DRY_RUN_FAILED", 0xC0210038, -1);
    AddConstEx( id, "STATUS_FVE_SECUREBOOT_DISABLED", 0xC0210039, -1);
    AddConstEx( id, "STATUS_FVE_SECUREBOOT_CONFIG_CHANGE", 0xC021003A, -1);
    AddConstEx( id, "STATUS_FVE_DEVICE_LOCKEDOUT", 0xC021003B, -1);
    AddConstEx( id, "STATUS_FVE_VOLUME_EXTEND_PREVENTS_EOW_DECRYPT", 0xC021003C, -1);
    AddConstEx( id, "STATUS_FVE_NOT_DE_VOLUME", 0xC021003D, -1);
    AddConstEx( id, "STATUS_FVE_PROTECTION_DISABLED", 0xC021003E, -1);
    AddConstEx( id, "STATUS_FVE_PROTECTION_CANNOT_BE_DISABLED", 0xC021003F, -1);
    AddConstEx( id, "STATUS_FVE_OSV_KSR_NOT_ALLOWED", 0xC0210040, -1);
    AddConstEx( id, "STATUS_FWP_CALLOUT_NOT_FOUND", 0xC0220001, -1);
    AddConstEx( id, "STATUS_FWP_CONDITION_NOT_FOUND", 0xC0220002, -1);
    AddConstEx( id, "STATUS_FWP_FILTER_NOT_FOUND", 0xC0220003, -1);
    AddConstEx( id, "STATUS_FWP_LAYER_NOT_FOUND", 0xC0220004, -1);
    AddConstEx( id, "STATUS_FWP_PROVIDER_NOT_FOUND", 0xC0220005, -1);
    AddConstEx( id, "STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND", 0xC0220006, -1);
    AddConstEx( id, "STATUS_FWP_SUBLAYER_NOT_FOUND", 0xC0220007, -1);
    AddConstEx( id, "STATUS_FWP_NOT_FOUND", 0xC0220008, -1);
    AddConstEx( id, "STATUS_FWP_ALREADY_EXISTS", 0xC0220009, -1);
    AddConstEx( id, "STATUS_FWP_IN_USE", 0xC022000A, -1);
    AddConstEx( id, "STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS", 0xC022000B, -1);
    AddConstEx( id, "STATUS_FWP_WRONG_SESSION", 0xC022000C, -1);
    AddConstEx( id, "STATUS_FWP_NO_TXN_IN_PROGRESS", 0xC022000D, -1);
    AddConstEx( id, "STATUS_FWP_TXN_IN_PROGRESS", 0xC022000E, -1);
    AddConstEx( id, "STATUS_FWP_TXN_ABORTED", 0xC022000F, -1);
    AddConstEx( id, "STATUS_FWP_SESSION_ABORTED", 0xC0220010, -1);
    AddConstEx( id, "STATUS_FWP_INCOMPATIBLE_TXN", 0xC0220011, -1);
    AddConstEx( id, "STATUS_FWP_TIMEOUT", 0xC0220012, -1);
    AddConstEx( id, "STATUS_FWP_NET_EVENTS_DISABLED", 0xC0220013, -1);
    AddConstEx( id, "STATUS_FWP_INCOMPATIBLE_LAYER", 0xC0220014, -1);
    AddConstEx( id, "STATUS_FWP_KM_CLIENTS_ONLY", 0xC0220015, -1);
    AddConstEx( id, "STATUS_FWP_LIFETIME_MISMATCH", 0xC0220016, -1);
    AddConstEx( id, "STATUS_FWP_BUILTIN_OBJECT", 0xC0220017, -1);
    AddConstEx( id, "STATUS_FWP_TOO_MANY_CALLOUTS", 0xC0220018, -1);
    AddConstEx( id, "STATUS_FWP_NOTIFICATION_DROPPED", 0xC0220019, -1);
    AddConstEx( id, "STATUS_FWP_TRAFFIC_MISMATCH", 0xC022001A, -1);
    AddConstEx( id, "STATUS_FWP_INCOMPATIBLE_SA_STATE", 0xC022001B, -1);
    AddConstEx( id, "STATUS_FWP_NULL_POINTER", 0xC022001C, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_ENUMERATOR", 0xC022001D, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_FLAGS", 0xC022001E, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_NET_MASK", 0xC022001F, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_RANGE", 0xC0220020, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_INTERVAL", 0xC0220021, -1);
    AddConstEx( id, "STATUS_FWP_ZERO_LENGTH_ARRAY", 0xC0220022, -1);
    AddConstEx( id, "STATUS_FWP_NULL_DISPLAY_NAME", 0xC0220023, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_ACTION_TYPE", 0xC0220024, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_WEIGHT", 0xC0220025, -1);
    AddConstEx( id, "STATUS_FWP_MATCH_TYPE_MISMATCH", 0xC0220026, -1);
    AddConstEx( id, "STATUS_FWP_TYPE_MISMATCH", 0xC0220027, -1);
    AddConstEx( id, "STATUS_FWP_OUT_OF_BOUNDS", 0xC0220028, -1);
    AddConstEx( id, "STATUS_FWP_RESERVED", 0xC0220029, -1);
    AddConstEx( id, "STATUS_FWP_DUPLICATE_CONDITION", 0xC022002A, -1);
    AddConstEx( id, "STATUS_FWP_DUPLICATE_KEYMOD", 0xC022002B, -1);
    AddConstEx( id, "STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER", 0xC022002C, -1);
    AddConstEx( id, "STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER", 0xC022002D, -1);
    AddConstEx( id, "STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER", 0xC022002E, -1);
    AddConstEx( id, "STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT", 0xC022002F, -1);
    AddConstEx( id, "STATUS_FWP_INCOMPATIBLE_AUTH_METHOD", 0xC0220030, -1);
    AddConstEx( id, "STATUS_FWP_INCOMPATIBLE_DH_GROUP", 0xC0220031, -1);
    AddConstEx( id, "STATUS_FWP_EM_NOT_SUPPORTED", 0xC0220032, -1);
    AddConstEx( id, "STATUS_FWP_NEVER_MATCH", 0xC0220033, -1);
    AddConstEx( id, "STATUS_FWP_PROVIDER_CONTEXT_MISMATCH", 0xC0220034, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_PARAMETER", 0xC0220035, -1);
    AddConstEx( id, "STATUS_FWP_TOO_MANY_SUBLAYERS", 0xC0220036, -1);
    AddConstEx( id, "STATUS_FWP_CALLOUT_NOTIFICATION_FAILED", 0xC0220037, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_AUTH_TRANSFORM", 0xC0220038, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_CIPHER_TRANSFORM", 0xC0220039, -1);
    AddConstEx( id, "STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM", 0xC022003A, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_TRANSFORM_COMBINATION", 0xC022003B, -1);
    AddConstEx( id, "STATUS_FWP_DUPLICATE_AUTH_METHOD", 0xC022003C, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_TUNNEL_ENDPOINT", 0xC022003D, -1);
    AddConstEx( id, "STATUS_FWP_L2_DRIVER_NOT_READY", 0xC022003E, -1);
    AddConstEx( id, "STATUS_FWP_KEY_DICTATOR_ALREADY_REGISTERED", 0xC022003F, -1);
    AddConstEx( id, "STATUS_FWP_KEY_DICTATION_INVALID_KEYING_MATERIAL", 0xC0220040, -1);
    AddConstEx( id, "STATUS_FWP_CONNECTIONS_DISABLED", 0xC0220041, -1);
    AddConstEx( id, "STATUS_FWP_INVALID_DNS_NAME", 0xC0220042, -1);
    AddConstEx( id, "STATUS_FWP_STILL_ON", 0xC0220043, -1);
    AddConstEx( id, "STATUS_FWP_IKEEXT_NOT_RUNNING", 0xC0220044, -1);
    AddConstEx( id, "STATUS_FWP_TCPIP_NOT_READY", 0xC0220100, -1);
    AddConstEx( id, "STATUS_FWP_INJECT_HANDLE_CLOSING", 0xC0220101, -1);
    AddConstEx( id, "STATUS_FWP_INJECT_HANDLE_STALE", 0xC0220102, -1);
    AddConstEx( id, "STATUS_FWP_CANNOT_PEND", 0xC0220103, -1);
    AddConstEx( id, "STATUS_FWP_DROP_NOICMP", 0xC0220104, -1);
    AddConstEx( id, "STATUS_NDIS_CLOSING", 0xC0230002, -1);
    AddConstEx( id, "STATUS_NDIS_BAD_VERSION", 0xC0230004, -1);
    AddConstEx( id, "STATUS_NDIS_BAD_CHARACTERISTICS", 0xC0230005, -1);
    AddConstEx( id, "STATUS_NDIS_ADAPTER_NOT_FOUND", 0xC0230006, -1);
    AddConstEx( id, "STATUS_NDIS_OPEN_FAILED", 0xC0230007, -1);
    AddConstEx( id, "STATUS_NDIS_DEVICE_FAILED", 0xC0230008, -1);
    AddConstEx( id, "STATUS_NDIS_MULTICAST_FULL", 0xC0230009, -1);
    AddConstEx( id, "STATUS_NDIS_MULTICAST_EXISTS", 0xC023000A, -1);
    AddConstEx( id, "STATUS_NDIS_MULTICAST_NOT_FOUND", 0xC023000B, -1);
    AddConstEx( id, "STATUS_NDIS_REQUEST_ABORTED", 0xC023000C, -1);
    AddConstEx( id, "STATUS_NDIS_RESET_IN_PROGRESS", 0xC023000D, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_PACKET", 0xC023000F, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_DEVICE_REQUEST", 0xC0230010, -1);
    AddConstEx( id, "STATUS_NDIS_ADAPTER_NOT_READY", 0xC0230011, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_LENGTH", 0xC0230014, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_DATA", 0xC0230015, -1);
    AddConstEx( id, "STATUS_NDIS_BUFFER_TOO_SHORT", 0xC0230016, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_OID", 0xC0230017, -1);
    AddConstEx( id, "STATUS_NDIS_ADAPTER_REMOVED", 0xC0230018, -1);
    AddConstEx( id, "STATUS_NDIS_UNSUPPORTED_MEDIA", 0xC0230019, -1);
    AddConstEx( id, "STATUS_NDIS_GROUP_ADDRESS_IN_USE", 0xC023001A, -1);
    AddConstEx( id, "STATUS_NDIS_FILE_NOT_FOUND", 0xC023001B, -1);
    AddConstEx( id, "STATUS_NDIS_ERROR_READING_FILE", 0xC023001C, -1);
    AddConstEx( id, "STATUS_NDIS_ALREADY_MAPPED", 0xC023001D, -1);
    AddConstEx( id, "STATUS_NDIS_RESOURCE_CONFLICT", 0xC023001E, -1);
    AddConstEx( id, "STATUS_NDIS_MEDIA_DISCONNECTED", 0xC023001F, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_ADDRESS", 0xC0230022, -1);
    AddConstEx( id, "STATUS_NDIS_PAUSED", 0xC023002A, -1);
    AddConstEx( id, "STATUS_NDIS_INTERFACE_NOT_FOUND", 0xC023002B, -1);
    AddConstEx( id, "STATUS_NDIS_UNSUPPORTED_REVISION", 0xC023002C, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_PORT", 0xC023002D, -1);
    AddConstEx( id, "STATUS_NDIS_INVALID_PORT_STATE", 0xC023002E, -1);
    AddConstEx( id, "STATUS_NDIS_LOW_POWER_STATE", 0xC023002F, -1);
    AddConstEx( id, "STATUS_NDIS_REINIT_REQUIRED", 0xC0230030, -1);
    AddConstEx( id, "STATUS_NDIS_NOT_SUPPORTED", 0xC02300BB, -1);
    AddConstEx( id, "STATUS_NDIS_OFFLOAD_POLICY", 0xC023100F, -1);
    AddConstEx( id, "STATUS_NDIS_OFFLOAD_CONNECTION_REJECTED", 0xC0231012, -1);
    AddConstEx( id, "STATUS_NDIS_OFFLOAD_PATH_REJECTED", 0xC0231013, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED", 0xC0232000, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_MEDIA_IN_USE", 0xC0232001, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_POWER_STATE_INVALID", 0xC0232002, -1);
    AddConstEx( id, "STATUS_NDIS_PM_WOL_PATTERN_LIST_FULL", 0xC0232003, -1);
    AddConstEx( id, "STATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL", 0xC0232004, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_AP_CHANNEL_CURRENTLY_NOT_AVAILABLE", 0xC0232005, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_AP_BAND_CURRENTLY_NOT_AVAILABLE", 0xC0232006, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_AP_CHANNEL_NOT_ALLOWED", 0xC0232007, -1);
    AddConstEx( id, "STATUS_NDIS_DOT11_AP_BAND_NOT_ALLOWED", 0xC0232008, -1);
    AddConstEx( id, "STATUS_TPM_ERROR_MASK", 0xC0290000, -1);
    AddConstEx( id, "STATUS_TPM_AUTHFAIL", 0xC0290001, -1);
    AddConstEx( id, "STATUS_TPM_BADINDEX", 0xC0290002, -1);
    AddConstEx( id, "STATUS_TPM_BAD_PARAMETER", 0xC0290003, -1);
    AddConstEx( id, "STATUS_TPM_AUDITFAILURE", 0xC0290004, -1);
    AddConstEx( id, "STATUS_TPM_CLEAR_DISABLED", 0xC0290005, -1);
    AddConstEx( id, "STATUS_TPM_DEACTIVATED", 0xC0290006, -1);
    AddConstEx( id, "STATUS_TPM_DISABLED", 0xC0290007, -1);
    AddConstEx( id, "STATUS_TPM_DISABLED_CMD", 0xC0290008, -1);
    AddConstEx( id, "STATUS_TPM_FAIL", 0xC0290009, -1);
    AddConstEx( id, "STATUS_TPM_BAD_ORDINAL", 0xC029000A, -1);
    AddConstEx( id, "STATUS_TPM_INSTALL_DISABLED", 0xC029000B, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_KEYHANDLE", 0xC029000C, -1);
    AddConstEx( id, "STATUS_TPM_KEYNOTFOUND", 0xC029000D, -1);
    AddConstEx( id, "STATUS_TPM_INAPPROPRIATE_ENC", 0xC029000E, -1);
    AddConstEx( id, "STATUS_TPM_MIGRATEFAIL", 0xC029000F, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_PCR_INFO", 0xC0290010, -1);
    AddConstEx( id, "STATUS_TPM_NOSPACE", 0xC0290011, -1);
    AddConstEx( id, "STATUS_TPM_NOSRK", 0xC0290012, -1);
    AddConstEx( id, "STATUS_TPM_NOTSEALED_BLOB", 0xC0290013, -1);
    AddConstEx( id, "STATUS_TPM_OWNER_SET", 0xC0290014, -1);
    AddConstEx( id, "STATUS_TPM_RESOURCES", 0xC0290015, -1);
    AddConstEx( id, "STATUS_TPM_SHORTRANDOM", 0xC0290016, -1);
    AddConstEx( id, "STATUS_TPM_SIZE", 0xC0290017, -1);
    AddConstEx( id, "STATUS_TPM_WRONGPCRVAL", 0xC0290018, -1);
    AddConstEx( id, "STATUS_TPM_BAD_PARAM_SIZE", 0xC0290019, -1);
    AddConstEx( id, "STATUS_TPM_SHA_THREAD", 0xC029001A, -1);
    AddConstEx( id, "STATUS_TPM_SHA_ERROR", 0xC029001B, -1);
    AddConstEx( id, "STATUS_TPM_FAILEDSELFTEST", 0xC029001C, -1);
    AddConstEx( id, "STATUS_TPM_AUTH2FAIL", 0xC029001D, -1);
    AddConstEx( id, "STATUS_TPM_BADTAG", 0xC029001E, -1);
    AddConstEx( id, "STATUS_TPM_IOERROR", 0xC029001F, -1);
    AddConstEx( id, "STATUS_TPM_ENCRYPT_ERROR", 0xC0290020, -1);
    AddConstEx( id, "STATUS_TPM_DECRYPT_ERROR", 0xC0290021, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_AUTHHANDLE", 0xC0290022, -1);
    AddConstEx( id, "STATUS_TPM_NO_ENDORSEMENT", 0xC0290023, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_KEYUSAGE", 0xC0290024, -1);
    AddConstEx( id, "STATUS_TPM_WRONG_ENTITYTYPE", 0xC0290025, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_POSTINIT", 0xC0290026, -1);
    AddConstEx( id, "STATUS_TPM_INAPPROPRIATE_SIG", 0xC0290027, -1);
    AddConstEx( id, "STATUS_TPM_BAD_KEY_PROPERTY", 0xC0290028, -1);
    AddConstEx( id, "STATUS_TPM_BAD_MIGRATION", 0xC0290029, -1);
    AddConstEx( id, "STATUS_TPM_BAD_SCHEME", 0xC029002A, -1);
    AddConstEx( id, "STATUS_TPM_BAD_DATASIZE", 0xC029002B, -1);
    AddConstEx( id, "STATUS_TPM_BAD_MODE", 0xC029002C, -1);
    AddConstEx( id, "STATUS_TPM_BAD_PRESENCE", 0xC029002D, -1);
    AddConstEx( id, "STATUS_TPM_BAD_VERSION", 0xC029002E, -1);
    AddConstEx( id, "STATUS_TPM_NO_WRAP_TRANSPORT", 0xC029002F, -1);
    AddConstEx( id, "STATUS_TPM_AUDITFAIL_UNSUCCESSFUL", 0xC0290030, -1);
    AddConstEx( id, "STATUS_TPM_AUDITFAIL_SUCCESSFUL", 0xC0290031, -1);
    AddConstEx( id, "STATUS_TPM_NOTRESETABLE", 0xC0290032, -1);
    AddConstEx( id, "STATUS_TPM_NOTLOCAL", 0xC0290033, -1);
    AddConstEx( id, "STATUS_TPM_BAD_TYPE", 0xC0290034, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_RESOURCE", 0xC0290035, -1);
    AddConstEx( id, "STATUS_TPM_NOTFIPS", 0xC0290036, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_FAMILY", 0xC0290037, -1);
    AddConstEx( id, "STATUS_TPM_NO_NV_PERMISSION", 0xC0290038, -1);
    AddConstEx( id, "STATUS_TPM_REQUIRES_SIGN", 0xC0290039, -1);
    AddConstEx( id, "STATUS_TPM_KEY_NOTSUPPORTED", 0xC029003A, -1);
    AddConstEx( id, "STATUS_TPM_AUTH_CONFLICT", 0xC029003B, -1);
    AddConstEx( id, "STATUS_TPM_AREA_LOCKED", 0xC029003C, -1);
    AddConstEx( id, "STATUS_TPM_BAD_LOCALITY", 0xC029003D, -1);
    AddConstEx( id, "STATUS_TPM_READ_ONLY", 0xC029003E, -1);
    AddConstEx( id, "STATUS_TPM_PER_NOWRITE", 0xC029003F, -1);
    AddConstEx( id, "STATUS_TPM_FAMILYCOUNT", 0xC0290040, -1);
    AddConstEx( id, "STATUS_TPM_WRITE_LOCKED", 0xC0290041, -1);
    AddConstEx( id, "STATUS_TPM_BAD_ATTRIBUTES", 0xC0290042, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_STRUCTURE", 0xC0290043, -1);
    AddConstEx( id, "STATUS_TPM_KEY_OWNER_CONTROL", 0xC0290044, -1);
    AddConstEx( id, "STATUS_TPM_BAD_COUNTER", 0xC0290045, -1);
    AddConstEx( id, "STATUS_TPM_NOT_FULLWRITE", 0xC0290046, -1);
    AddConstEx( id, "STATUS_TPM_CONTEXT_GAP", 0xC0290047, -1);
    AddConstEx( id, "STATUS_TPM_MAXNVWRITES", 0xC0290048, -1);
    AddConstEx( id, "STATUS_TPM_NOOPERATOR", 0xC0290049, -1);
    AddConstEx( id, "STATUS_TPM_RESOURCEMISSING", 0xC029004A, -1);
    AddConstEx( id, "STATUS_TPM_DELEGATE_LOCK", 0xC029004B, -1);
    AddConstEx( id, "STATUS_TPM_DELEGATE_FAMILY", 0xC029004C, -1);
    AddConstEx( id, "STATUS_TPM_DELEGATE_ADMIN", 0xC029004D, -1);
    AddConstEx( id, "STATUS_TPM_TRANSPORT_NOTEXCLUSIVE", 0xC029004E, -1);
    AddConstEx( id, "STATUS_TPM_OWNER_CONTROL", 0xC029004F, -1);
    AddConstEx( id, "STATUS_TPM_DAA_RESOURCES", 0xC0290050, -1);
    AddConstEx( id, "STATUS_TPM_DAA_INPUT_DATA0", 0xC0290051, -1);
    AddConstEx( id, "STATUS_TPM_DAA_INPUT_DATA1", 0xC0290052, -1);
    AddConstEx( id, "STATUS_TPM_DAA_ISSUER_SETTINGS", 0xC0290053, -1);
    AddConstEx( id, "STATUS_TPM_DAA_TPM_SETTINGS", 0xC0290054, -1);
    AddConstEx( id, "STATUS_TPM_DAA_STAGE", 0xC0290055, -1);
    AddConstEx( id, "STATUS_TPM_DAA_ISSUER_VALIDITY", 0xC0290056, -1);
    AddConstEx( id, "STATUS_TPM_DAA_WRONG_W", 0xC0290057, -1);
    AddConstEx( id, "STATUS_TPM_BAD_HANDLE", 0xC0290058, -1);
    AddConstEx( id, "STATUS_TPM_BAD_DELEGATE", 0xC0290059, -1);
    AddConstEx( id, "STATUS_TPM_BADCONTEXT", 0xC029005A, -1);
    AddConstEx( id, "STATUS_TPM_TOOMANYCONTEXTS", 0xC029005B, -1);
    AddConstEx( id, "STATUS_TPM_MA_TICKET_SIGNATURE", 0xC029005C, -1);
    AddConstEx( id, "STATUS_TPM_MA_DESTINATION", 0xC029005D, -1);
    AddConstEx( id, "STATUS_TPM_MA_SOURCE", 0xC029005E, -1);
    AddConstEx( id, "STATUS_TPM_MA_AUTHORITY", 0xC029005F, -1);
    AddConstEx( id, "STATUS_TPM_PERMANENTEK", 0xC0290061, -1);
    AddConstEx( id, "STATUS_TPM_BAD_SIGNATURE", 0xC0290062, -1);
    AddConstEx( id, "STATUS_TPM_NOCONTEXTSPACE", 0xC0290063, -1);
    AddConstEx( id, "STATUS_TPM_COMMAND_BLOCKED", 0xC0290400, -1);
    AddConstEx( id, "STATUS_TPM_INVALID_HANDLE", 0xC0290401, -1);
    AddConstEx( id, "STATUS_TPM_DUPLICATE_VHANDLE", 0xC0290402, -1);
    AddConstEx( id, "STATUS_TPM_EMBEDDED_COMMAND_BLOCKED", 0xC0290403, -1);
    AddConstEx( id, "STATUS_TPM_EMBEDDED_COMMAND_UNSUPPORTED", 0xC0290404, -1);
    AddConstEx( id, "STATUS_TPM_RETRY", 0xC0290800, -1);
    AddConstEx( id, "STATUS_TPM_NEEDS_SELFTEST", 0xC0290801, -1);
    AddConstEx( id, "STATUS_TPM_DOING_SELFTEST", 0xC0290802, -1);
    AddConstEx( id, "STATUS_TPM_DEFEND_LOCK_RUNNING", 0xC0290803, -1);
    AddConstEx( id, "STATUS_TPM_COMMAND_CANCELED", 0xC0291001, -1);
    AddConstEx( id, "STATUS_TPM_TOO_MANY_CONTEXTS", 0xC0291002, -1);
    AddConstEx( id, "STATUS_TPM_NOT_FOUND", 0xC0291003, -1);
    AddConstEx( id, "STATUS_TPM_ACCESS_DENIED", 0xC0291004, -1);
    AddConstEx( id, "STATUS_TPM_INSUFFICIENT_BUFFER", 0xC0291005, -1);
    AddConstEx( id, "STATUS_TPM_PPI_FUNCTION_UNSUPPORTED", 0xC0291006, -1);
    AddConstEx( id, "STATUS_PCP_ERROR_MASK", 0xC0292000, -1);
    AddConstEx( id, "STATUS_PCP_DEVICE_NOT_READY", 0xC0292001, -1);
    AddConstEx( id, "STATUS_PCP_INVALID_HANDLE", 0xC0292002, -1);
    AddConstEx( id, "STATUS_PCP_INVALID_PARAMETER", 0xC0292003, -1);
    AddConstEx( id, "STATUS_PCP_FLAG_NOT_SUPPORTED", 0xC0292004, -1);
    AddConstEx( id, "STATUS_PCP_NOT_SUPPORTED", 0xC0292005, -1);
    AddConstEx( id, "STATUS_PCP_BUFFER_TOO_SMALL", 0xC0292006, -1);
    AddConstEx( id, "STATUS_PCP_INTERNAL_ERROR", 0xC0292007, -1);
    AddConstEx( id, "STATUS_PCP_AUTHENTICATION_FAILED", 0xC0292008, -1);
    AddConstEx( id, "STATUS_PCP_AUTHENTICATION_IGNORED", 0xC0292009, -1);
    AddConstEx( id, "STATUS_PCP_POLICY_NOT_FOUND", 0xC029200A, -1);
    AddConstEx( id, "STATUS_PCP_PROFILE_NOT_FOUND", 0xC029200B, -1);
    AddConstEx( id, "STATUS_PCP_VALIDATION_FAILED", 0xC029200C, -1);
    AddConstEx( id, "STATUS_PCP_DEVICE_NOT_FOUND", 0xC029200D, -1);
    AddConstEx( id, "STATUS_PCP_WRONG_PARENT", 0xC029200E, -1);
    AddConstEx( id, "STATUS_RTPM_NO_RESULT", 0xC0293002, -1);
    AddConstEx( id, "STATUS_RTPM_PCR_READ_INCOMPLETE", 0xC0293003, -1);
    AddConstEx( id, "STATUS_RTPM_INVALID_CONTEXT", 0xC0293004, -1);
    AddConstEx( id, "STATUS_RTPM_UNSUPPORTED_CMD", 0xC0293005, -1);
    AddConstEx( id, "STATUS_HV_INVALID_HYPERCALL_CODE", 0xC0350002, -1);
    AddConstEx( id, "STATUS_HV_INVALID_HYPERCALL_INPUT", 0xC0350003, -1);
    AddConstEx( id, "STATUS_HV_INVALID_ALIGNMENT", 0xC0350004, -1);
    AddConstEx( id, "STATUS_HV_INVALID_PARAMETER", 0xC0350005, -1);
    AddConstEx( id, "STATUS_HV_ACCESS_DENIED", 0xC0350006, -1);
    AddConstEx( id, "STATUS_HV_INVALID_PARTITION_STATE", 0xC0350007, -1);
    AddConstEx( id, "STATUS_HV_OPERATION_DENIED", 0xC0350008, -1);
    AddConstEx( id, "STATUS_HV_UNKNOWN_PROPERTY", 0xC0350009, -1);
    AddConstEx( id, "STATUS_HV_PROPERTY_VALUE_OUT_OF_RANGE", 0xC035000A, -1);
    AddConstEx( id, "STATUS_HV_INSUFFICIENT_MEMORY", 0xC035000B, -1);
    AddConstEx( id, "STATUS_HV_PARTITION_TOO_DEEP", 0xC035000C, -1);
    AddConstEx( id, "STATUS_HV_INVALID_PARTITION_ID", 0xC035000D, -1);
    AddConstEx( id, "STATUS_HV_INVALID_VP_INDEX", 0xC035000E, -1);
    AddConstEx( id, "STATUS_HV_INVALID_PORT_ID", 0xC0350011, -1);
    AddConstEx( id, "STATUS_HV_INVALID_CONNECTION_ID", 0xC0350012, -1);
    AddConstEx( id, "STATUS_HV_INSUFFICIENT_BUFFERS", 0xC0350013, -1);
    AddConstEx( id, "STATUS_HV_NOT_ACKNOWLEDGED", 0xC0350014, -1);
    AddConstEx( id, "STATUS_HV_INVALID_VP_STATE", 0xC0350015, -1);
    AddConstEx( id, "STATUS_HV_ACKNOWLEDGED", 0xC0350016, -1);
    AddConstEx( id, "STATUS_HV_INVALID_SAVE_RESTORE_STATE", 0xC0350017, -1);
    AddConstEx( id, "STATUS_HV_INVALID_SYNIC_STATE", 0xC0350018, -1);
    AddConstEx( id, "STATUS_HV_OBJECT_IN_USE", 0xC0350019, -1);
    AddConstEx( id, "STATUS_HV_INVALID_PROXIMITY_DOMAIN_INFO", 0xC035001A, -1);
    AddConstEx( id, "STATUS_HV_NO_DATA", 0xC035001B, -1);
    AddConstEx( id, "STATUS_HV_INACTIVE", 0xC035001C, -1);
    AddConstEx( id, "STATUS_HV_NO_RESOURCES", 0xC035001D, -1);
    AddConstEx( id, "STATUS_HV_FEATURE_UNAVAILABLE", 0xC035001E, -1);
    AddConstEx( id, "STATUS_HV_INSUFFICIENT_BUFFER", 0xC0350033, -1);
    AddConstEx( id, "STATUS_HV_INSUFFICIENT_DEVICE_DOMAINS", 0xC0350038, -1);
    AddConstEx( id, "STATUS_HV_CPUID_FEATURE_VALIDATION_ERROR", 0xC035003C, -1);
    AddConstEx( id, "STATUS_HV_CPUID_XSAVE_FEATURE_VALIDATION_ERROR", 0xC035003D, -1);
    AddConstEx( id, "STATUS_HV_PROCESSOR_STARTUP_TIMEOUT", 0xC035003E, -1);
    AddConstEx( id, "STATUS_HV_SMX_ENABLED", 0xC035003F, -1);
    AddConstEx( id, "STATUS_HV_INVALID_LP_INDEX", 0xC0350041, -1);
    AddConstEx( id, "STATUS_HV_INVALID_REGISTER_VALUE", 0xC0350050, -1);
    AddConstEx( id, "STATUS_HV_INVALID_VTL_STATE", 0xC0350051, -1);
    AddConstEx( id, "STATUS_HV_NX_NOT_DETECTED", 0xC0350055, -1);
    AddConstEx( id, "STATUS_HV_INVALID_DEVICE_ID", 0xC0350057, -1);
    AddConstEx( id, "STATUS_HV_INVALID_DEVICE_STATE", 0xC0350058, -1);
    AddConstEx( id, "STATUS_HV_PAGE_REQUEST_INVALID", 0xC0350060, -1);
    AddConstEx( id, "STATUS_HV_INVALID_CPU_GROUP_ID", 0xC035006F, -1);
    AddConstEx( id, "STATUS_HV_INVALID_CPU_GROUP_STATE", 0xC0350070, -1);
    AddConstEx( id, "STATUS_HV_OPERATION_FAILED", 0xC0350071, -1);
    AddConstEx( id, "STATUS_HV_NOT_ALLOWED_WITH_NESTED_VIRT_ACTIVE", 0xC0350072, -1);
    AddConstEx( id, "STATUS_HV_NOT_PRESENT", 0xC0351000, -1);
    AddConstEx( id, "STATUS_IPSEC_BAD_SPI", 0xC0360001, -1);
    AddConstEx( id, "STATUS_IPSEC_SA_LIFETIME_EXPIRED", 0xC0360002, -1);
    AddConstEx( id, "STATUS_IPSEC_WRONG_SA", 0xC0360003, -1);
    AddConstEx( id, "STATUS_IPSEC_REPLAY_CHECK_FAILED", 0xC0360004, -1);
    AddConstEx( id, "STATUS_IPSEC_INVALID_PACKET", 0xC0360005, -1);
    AddConstEx( id, "STATUS_IPSEC_INTEGRITY_CHECK_FAILED", 0xC0360006, -1);
    AddConstEx( id, "STATUS_IPSEC_CLEAR_TEXT_DROP", 0xC0360007, -1);
    AddConstEx( id, "STATUS_IPSEC_AUTH_FIREWALL_DROP", 0xC0360008, -1);
    AddConstEx( id, "STATUS_IPSEC_THROTTLE_DROP", 0xC0360009, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_BLOCK", 0xC0368000, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_RECEIVED_MULTICAST", 0xC0368001, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_INVALID_PACKET", 0xC0368002, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED", 0xC0368003, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_MAX_ENTRIES", 0xC0368004, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED", 0xC0368005, -1);
    AddConstEx( id, "STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES", 0xC0368006, -1);
    AddConstEx( id, "STATUS_VID_DUPLICATE_HANDLER", 0xC0370001, -1);
    AddConstEx( id, "STATUS_VID_TOO_MANY_HANDLERS", 0xC0370002, -1);
    AddConstEx( id, "STATUS_VID_QUEUE_FULL", 0xC0370003, -1);
    AddConstEx( id, "STATUS_VID_HANDLER_NOT_PRESENT", 0xC0370004, -1);
    AddConstEx( id, "STATUS_VID_INVALID_OBJECT_NAME", 0xC0370005, -1);
    AddConstEx( id, "STATUS_VID_PARTITION_NAME_TOO_LONG", 0xC0370006, -1);
    AddConstEx( id, "STATUS_VID_MESSAGE_QUEUE_NAME_TOO_LONG", 0xC0370007, -1);
    AddConstEx( id, "STATUS_VID_PARTITION_ALREADY_EXISTS", 0xC0370008, -1);
    AddConstEx( id, "STATUS_VID_PARTITION_DOES_NOT_EXIST", 0xC0370009, -1);
    AddConstEx( id, "STATUS_VID_PARTITION_NAME_NOT_FOUND", 0xC037000A, -1);
    AddConstEx( id, "STATUS_VID_MESSAGE_QUEUE_ALREADY_EXISTS", 0xC037000B, -1);
    AddConstEx( id, "STATUS_VID_EXCEEDED_MBP_ENTRY_MAP_LIMIT", 0xC037000C, -1);
    AddConstEx( id, "STATUS_VID_MB_STILL_REFERENCED", 0xC037000D, -1);
    AddConstEx( id, "STATUS_VID_CHILD_GPA_PAGE_SET_CORRUPTED", 0xC037000E, -1);
    AddConstEx( id, "STATUS_VID_INVALID_NUMA_SETTINGS", 0xC037000F, -1);
    AddConstEx( id, "STATUS_VID_INVALID_NUMA_NODE_INDEX", 0xC0370010, -1);
    AddConstEx( id, "STATUS_VID_NOTIFICATION_QUEUE_ALREADY_ASSOCIATED", 0xC0370011, -1);
    AddConstEx( id, "STATUS_VID_INVALID_MEMORY_BLOCK_HANDLE", 0xC0370012, -1);
    AddConstEx( id, "STATUS_VID_PAGE_RANGE_OVERFLOW", 0xC0370013, -1);
    AddConstEx( id, "STATUS_VID_INVALID_MESSAGE_QUEUE_HANDLE", 0xC0370014, -1);
    AddConstEx( id, "STATUS_VID_INVALID_GPA_RANGE_HANDLE", 0xC0370015, -1);
    AddConstEx( id, "STATUS_VID_NO_MEMORY_BLOCK_NOTIFICATION_QUEUE", 0xC0370016, -1);
    AddConstEx( id, "STATUS_VID_MEMORY_BLOCK_LOCK_COUNT_EXCEEDED", 0xC0370017, -1);
    AddConstEx( id, "STATUS_VID_INVALID_PPM_HANDLE", 0xC0370018, -1);
    AddConstEx( id, "STATUS_VID_MBPS_ARE_LOCKED", 0xC0370019, -1);
    AddConstEx( id, "STATUS_VID_MESSAGE_QUEUE_CLOSED", 0xC037001A, -1);
    AddConstEx( id, "STATUS_VID_VIRTUAL_PROCESSOR_LIMIT_EXCEEDED", 0xC037001B, -1);
    AddConstEx( id, "STATUS_VID_STOP_PENDING", 0xC037001C, -1);
    AddConstEx( id, "STATUS_VID_INVALID_PROCESSOR_STATE", 0xC037001D, -1);
    AddConstEx( id, "STATUS_VID_EXCEEDED_KM_CONTEXT_COUNT_LIMIT", 0xC037001E, -1);
    AddConstEx( id, "STATUS_VID_KM_INTERFACE_ALREADY_INITIALIZED", 0xC037001F, -1);
    AddConstEx( id, "STATUS_VID_MB_PROPERTY_ALREADY_SET_RESET", 0xC0370020, -1);
    AddConstEx( id, "STATUS_VID_MMIO_RANGE_DESTROYED", 0xC0370021, -1);
    AddConstEx( id, "STATUS_VID_INVALID_CHILD_GPA_PAGE_SET", 0xC0370022, -1);
    AddConstEx( id, "STATUS_VID_RESERVE_PAGE_SET_IS_BEING_USED", 0xC0370023, -1);
    AddConstEx( id, "STATUS_VID_RESERVE_PAGE_SET_TOO_SMALL", 0xC0370024, -1);
    AddConstEx( id, "STATUS_VID_MBP_ALREADY_LOCKED_USING_RESERVED_PAGE", 0xC0370025, -1);
    AddConstEx( id, "STATUS_VID_MBP_COUNT_EXCEEDED_LIMIT", 0xC0370026, -1);
    AddConstEx( id, "STATUS_VID_SAVED_STATE_CORRUPT", 0xC0370027, -1);
    AddConstEx( id, "STATUS_VID_SAVED_STATE_UNRECOGNIZED_ITEM", 0xC0370028, -1);
    AddConstEx( id, "STATUS_VID_SAVED_STATE_INCOMPATIBLE", 0xC0370029, -1);
    AddConstEx( id, "STATUS_VID_VTL_ACCESS_DENIED", 0xC037002A, -1);
    AddConstEx( id, "STATUS_VOLMGR_DATABASE_FULL", 0xC0380001, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_CONFIGURATION_CORRUPTED", 0xC0380002, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_CONFIGURATION_NOT_IN_SYNC", 0xC0380003, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_CONFIG_UPDATE_FAILED", 0xC0380004, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_CONTAINS_NON_SIMPLE_VOLUME", 0xC0380005, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_DUPLICATE", 0xC0380006, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_DYNAMIC", 0xC0380007, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_ID_INVALID", 0xC0380008, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_INVALID", 0xC0380009, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAST_VOTER", 0xC038000A, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAYOUT_INVALID", 0xC038000B, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAYOUT_NON_BASIC_BETWEEN_BASIC_PARTITIONS", 0xC038000C, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAYOUT_NOT_CYLINDER_ALIGNED", 0xC038000D, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAYOUT_PARTITIONS_TOO_SMALL", 0xC038000E, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAYOUT_PRIMARY_BETWEEN_LOGICAL_PARTITIONS", 0xC038000F, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_LAYOUT_TOO_MANY_PARTITIONS", 0xC0380010, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_MISSING", 0xC0380011, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_NOT_EMPTY", 0xC0380012, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_NOT_ENOUGH_SPACE", 0xC0380013, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_REVECTORING_FAILED", 0xC0380014, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_SECTOR_SIZE_INVALID", 0xC0380015, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_SET_NOT_CONTAINED", 0xC0380016, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_USED_BY_MULTIPLE_MEMBERS", 0xC0380017, -1);
    AddConstEx( id, "STATUS_VOLMGR_DISK_USED_BY_MULTIPLE_PLEXES", 0xC0380018, -1);
    AddConstEx( id, "STATUS_VOLMGR_DYNAMIC_DISK_NOT_SUPPORTED", 0xC0380019, -1);
    AddConstEx( id, "STATUS_VOLMGR_EXTENT_ALREADY_USED", 0xC038001A, -1);
    AddConstEx( id, "STATUS_VOLMGR_EXTENT_NOT_CONTIGUOUS", 0xC038001B, -1);
    AddConstEx( id, "STATUS_VOLMGR_EXTENT_NOT_IN_PUBLIC_REGION", 0xC038001C, -1);
    AddConstEx( id, "STATUS_VOLMGR_EXTENT_NOT_SECTOR_ALIGNED", 0xC038001D, -1);
    AddConstEx( id, "STATUS_VOLMGR_EXTENT_OVERLAPS_EBR_PARTITION", 0xC038001E, -1);
    AddConstEx( id, "STATUS_VOLMGR_EXTENT_VOLUME_LENGTHS_DO_NOT_MATCH", 0xC038001F, -1);
    AddConstEx( id, "STATUS_VOLMGR_FAULT_TOLERANT_NOT_SUPPORTED", 0xC0380020, -1);
    AddConstEx( id, "STATUS_VOLMGR_INTERLEAVE_LENGTH_INVALID", 0xC0380021, -1);
    AddConstEx( id, "STATUS_VOLMGR_MAXIMUM_REGISTERED_USERS", 0xC0380022, -1);
    AddConstEx( id, "STATUS_VOLMGR_MEMBER_IN_SYNC", 0xC0380023, -1);
    AddConstEx( id, "STATUS_VOLMGR_MEMBER_INDEX_DUPLICATE", 0xC0380024, -1);
    AddConstEx( id, "STATUS_VOLMGR_MEMBER_INDEX_INVALID", 0xC0380025, -1);
    AddConstEx( id, "STATUS_VOLMGR_MEMBER_MISSING", 0xC0380026, -1);
    AddConstEx( id, "STATUS_VOLMGR_MEMBER_NOT_DETACHED", 0xC0380027, -1);
    AddConstEx( id, "STATUS_VOLMGR_MEMBER_REGENERATING", 0xC0380028, -1);
    AddConstEx( id, "STATUS_VOLMGR_ALL_DISKS_FAILED", 0xC0380029, -1);
    AddConstEx( id, "STATUS_VOLMGR_NO_REGISTERED_USERS", 0xC038002A, -1);
    AddConstEx( id, "STATUS_VOLMGR_NO_SUCH_USER", 0xC038002B, -1);
    AddConstEx( id, "STATUS_VOLMGR_NOTIFICATION_RESET", 0xC038002C, -1);
    AddConstEx( id, "STATUS_VOLMGR_NUMBER_OF_MEMBERS_INVALID", 0xC038002D, -1);
    AddConstEx( id, "STATUS_VOLMGR_NUMBER_OF_PLEXES_INVALID", 0xC038002E, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_DUPLICATE", 0xC038002F, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_ID_INVALID", 0xC0380030, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_INVALID", 0xC0380031, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_NAME_INVALID", 0xC0380032, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_OFFLINE", 0xC0380033, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_HAS_QUORUM", 0xC0380034, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_WITHOUT_QUORUM", 0xC0380035, -1);
    AddConstEx( id, "STATUS_VOLMGR_PARTITION_STYLE_INVALID", 0xC0380036, -1);
    AddConstEx( id, "STATUS_VOLMGR_PARTITION_UPDATE_FAILED", 0xC0380037, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_IN_SYNC", 0xC0380038, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_INDEX_DUPLICATE", 0xC0380039, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_INDEX_INVALID", 0xC038003A, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_LAST_ACTIVE", 0xC038003B, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_MISSING", 0xC038003C, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_REGENERATING", 0xC038003D, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_TYPE_INVALID", 0xC038003E, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_NOT_RAID5", 0xC038003F, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_NOT_SIMPLE", 0xC0380040, -1);
    AddConstEx( id, "STATUS_VOLMGR_STRUCTURE_SIZE_INVALID", 0xC0380041, -1);
    AddConstEx( id, "STATUS_VOLMGR_TOO_MANY_NOTIFICATION_REQUESTS", 0xC0380042, -1);
    AddConstEx( id, "STATUS_VOLMGR_TRANSACTION_IN_PROGRESS", 0xC0380043, -1);
    AddConstEx( id, "STATUS_VOLMGR_UNEXPECTED_DISK_LAYOUT_CHANGE", 0xC0380044, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_CONTAINS_MISSING_DISK", 0xC0380045, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_ID_INVALID", 0xC0380046, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_LENGTH_INVALID", 0xC0380047, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_LENGTH_NOT_SECTOR_SIZE_MULTIPLE", 0xC0380048, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_NOT_MIRRORED", 0xC0380049, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_NOT_RETAINED", 0xC038004A, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_OFFLINE", 0xC038004B, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_RETAINED", 0xC038004C, -1);
    AddConstEx( id, "STATUS_VOLMGR_NUMBER_OF_EXTENTS_INVALID", 0xC038004D, -1);
    AddConstEx( id, "STATUS_VOLMGR_DIFFERENT_SECTOR_SIZE", 0xC038004E, -1);
    AddConstEx( id, "STATUS_VOLMGR_BAD_BOOT_DISK", 0xC038004F, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_CONFIG_OFFLINE", 0xC0380050, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_CONFIG_ONLINE", 0xC0380051, -1);
    AddConstEx( id, "STATUS_VOLMGR_NOT_PRIMARY_PACK", 0xC0380052, -1);
    AddConstEx( id, "STATUS_VOLMGR_PACK_LOG_UPDATE_FAILED", 0xC0380053, -1);
    AddConstEx( id, "STATUS_VOLMGR_NUMBER_OF_DISKS_IN_PLEX_INVALID", 0xC0380054, -1);
    AddConstEx( id, "STATUS_VOLMGR_NUMBER_OF_DISKS_IN_MEMBER_INVALID", 0xC0380055, -1);
    AddConstEx( id, "STATUS_VOLMGR_VOLUME_MIRRORED", 0xC0380056, -1);
    AddConstEx( id, "STATUS_VOLMGR_PLEX_NOT_SIMPLE_SPANNED", 0xC0380057, -1);
    AddConstEx( id, "STATUS_VOLMGR_NO_VALID_LOG_COPIES", 0xC0380058, -1);
    AddConstEx( id, "STATUS_VOLMGR_PRIMARY_PACK_PRESENT", 0xC0380059, -1);
    AddConstEx( id, "STATUS_VOLMGR_NUMBER_OF_DISKS_INVALID", 0xC038005A, -1);
    AddConstEx( id, "STATUS_VOLMGR_MIRROR_NOT_SUPPORTED", 0xC038005B, -1);
    AddConstEx( id, "STATUS_VOLMGR_RAID5_NOT_SUPPORTED", 0xC038005C, -1);
    AddConstEx( id, "STATUS_BCD_TOO_MANY_ELEMENTS", 0xC0390002, -1);
    AddConstEx( id, "STATUS_VHD_DRIVE_FOOTER_MISSING", 0xC03A0001, -1);
    AddConstEx( id, "STATUS_VHD_DRIVE_FOOTER_CHECKSUM_MISMATCH", 0xC03A0002, -1);
    AddConstEx( id, "STATUS_VHD_DRIVE_FOOTER_CORRUPT", 0xC03A0003, -1);
    AddConstEx( id, "STATUS_VHD_FORMAT_UNKNOWN", 0xC03A0004, -1);
    AddConstEx( id, "STATUS_VHD_FORMAT_UNSUPPORTED_VERSION", 0xC03A0005, -1);
    AddConstEx( id, "STATUS_VHD_SPARSE_HEADER_CHECKSUM_MISMATCH", 0xC03A0006, -1);
    AddConstEx( id, "STATUS_VHD_SPARSE_HEADER_UNSUPPORTED_VERSION", 0xC03A0007, -1);
    AddConstEx( id, "STATUS_VHD_SPARSE_HEADER_CORRUPT", 0xC03A0008, -1);
    AddConstEx( id, "STATUS_VHD_BLOCK_ALLOCATION_FAILURE", 0xC03A0009, -1);
    AddConstEx( id, "STATUS_VHD_BLOCK_ALLOCATION_TABLE_CORRUPT", 0xC03A000A, -1);
    AddConstEx( id, "STATUS_VHD_INVALID_BLOCK_SIZE", 0xC03A000B, -1);
    AddConstEx( id, "STATUS_VHD_BITMAP_MISMATCH", 0xC03A000C, -1);
    AddConstEx( id, "STATUS_VHD_PARENT_VHD_NOT_FOUND", 0xC03A000D, -1);
    AddConstEx( id, "STATUS_VHD_CHILD_PARENT_ID_MISMATCH", 0xC03A000E, -1);
    AddConstEx( id, "STATUS_VHD_CHILD_PARENT_TIMESTAMP_MISMATCH", 0xC03A000F, -1);
    AddConstEx( id, "STATUS_VHD_METADATA_READ_FAILURE", 0xC03A0010, -1);
    AddConstEx( id, "STATUS_VHD_METADATA_WRITE_FAILURE", 0xC03A0011, -1);
    AddConstEx( id, "STATUS_VHD_INVALID_SIZE", 0xC03A0012, -1);
    AddConstEx( id, "STATUS_VHD_INVALID_FILE_SIZE", 0xC03A0013, -1);
    AddConstEx( id, "STATUS_VIRTDISK_PROVIDER_NOT_FOUND", 0xC03A0014, -1);
    AddConstEx( id, "STATUS_VIRTDISK_NOT_VIRTUAL_DISK", 0xC03A0015, -1);
    AddConstEx( id, "STATUS_VHD_PARENT_VHD_ACCESS_DENIED", 0xC03A0016, -1);
    AddConstEx( id, "STATUS_VHD_CHILD_PARENT_SIZE_MISMATCH", 0xC03A0017, -1);
    AddConstEx( id, "STATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED", 0xC03A0018, -1);
    AddConstEx( id, "STATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT", 0xC03A0019, -1);
    AddConstEx( id, "STATUS_VIRTUAL_DISK_LIMITATION", 0xC03A001A, -1);
    AddConstEx( id, "STATUS_VHD_INVALID_TYPE", 0xC03A001B, -1);
    AddConstEx( id, "STATUS_VHD_INVALID_STATE", 0xC03A001C, -1);
    AddConstEx( id, "STATUS_VIRTDISK_UNSUPPORTED_DISK_SECTOR_SIZE", 0xC03A001D, -1);
    AddConstEx( id, "STATUS_VIRTDISK_DISK_ALREADY_OWNED", 0xC03A001E, -1);
    AddConstEx( id, "STATUS_VIRTDISK_DISK_ONLINE_AND_WRITABLE", 0xC03A001F, -1);
    AddConstEx( id, "STATUS_CTLOG_TRACKING_NOT_INITIALIZED", 0xC03A0020, -1);
    AddConstEx( id, "STATUS_CTLOG_LOGFILE_SIZE_EXCEEDED_MAXSIZE", 0xC03A0021, -1);
    AddConstEx( id, "STATUS_CTLOG_VHD_CHANGED_OFFLINE", 0xC03A0022, -1);
    AddConstEx( id, "STATUS_CTLOG_INVALID_TRACKING_STATE", 0xC03A0023, -1);
    AddConstEx( id, "STATUS_CTLOG_INCONSISTENT_TRACKING_FILE", 0xC03A0024, -1);
    AddConstEx( id, "STATUS_VHD_METADATA_FULL", 0xC03A0028, -1);
    AddConstEx( id, "STATUS_VHD_INVALID_CHANGE_TRACKING_ID", 0xC03A0029, -1);
    AddConstEx( id, "STATUS_VHD_CHANGE_TRACKING_DISABLED", 0xC03A002A, -1);
    AddConstEx( id, "STATUS_VHD_MISSING_CHANGE_TRACKING_INFORMATION", 0xC03A0030, -1);
    AddConstEx( id, "STATUS_VHD_RESIZE_WOULD_TRUNCATE_DATA", 0xC03A0031, -1);
    AddConstEx( id, "STATUS_VHD_COULD_NOT_COMPUTE_MINIMUM_VIRTUAL_SIZE", 0xC03A0032, -1);
    AddConstEx( id, "STATUS_VHD_ALREADY_AT_OR_BELOW_MINIMUM_VIRTUAL_SIZE", 0xC03A0033, -1);
    AddConstEx( id, "STATUS_RKF_KEY_NOT_FOUND", 0xC0400001, -1);
    AddConstEx( id, "STATUS_RKF_DUPLICATE_KEY", 0xC0400002, -1);
    AddConstEx( id, "STATUS_RKF_BLOB_FULL", 0xC0400003, -1);
    AddConstEx( id, "STATUS_RKF_STORE_FULL", 0xC0400004, -1);
    AddConstEx( id, "STATUS_RKF_FILE_BLOCKED", 0xC0400005, -1);
    AddConstEx( id, "STATUS_RKF_ACTIVE_KEY", 0xC0400006, -1);
    AddConstEx( id, "STATUS_RDBSS_RESTART_OPERATION", 0xC0410001, -1);
    AddConstEx( id, "STATUS_RDBSS_CONTINUE_OPERATION", 0xC0410002, -1);
    AddConstEx( id, "STATUS_RDBSS_POST_OPERATION", 0xC0410003, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INVALID_HANDLE", 0xC0420001, -1);
    AddConstEx( id, "STATUS_BTH_ATT_READ_NOT_PERMITTED", 0xC0420002, -1);
    AddConstEx( id, "STATUS_BTH_ATT_WRITE_NOT_PERMITTED", 0xC0420003, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INVALID_PDU", 0xC0420004, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INSUFFICIENT_AUTHENTICATION", 0xC0420005, -1);
    AddConstEx( id, "STATUS_BTH_ATT_REQUEST_NOT_SUPPORTED", 0xC0420006, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INVALID_OFFSET", 0xC0420007, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INSUFFICIENT_AUTHORIZATION", 0xC0420008, -1);
    AddConstEx( id, "STATUS_BTH_ATT_PREPARE_QUEUE_FULL", 0xC0420009, -1);
    AddConstEx( id, "STATUS_BTH_ATT_ATTRIBUTE_NOT_FOUND", 0xC042000A, -1);
    AddConstEx( id, "STATUS_BTH_ATT_ATTRIBUTE_NOT_LONG", 0xC042000B, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INSUFFICIENT_ENCRYPTION_KEY_SIZE", 0xC042000C, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INVALID_ATTRIBUTE_VALUE_LENGTH", 0xC042000D, -1);
    AddConstEx( id, "STATUS_BTH_ATT_UNLIKELY", 0xC042000E, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INSUFFICIENT_ENCRYPTION", 0xC042000F, -1);
    AddConstEx( id, "STATUS_BTH_ATT_UNSUPPORTED_GROUP_TYPE", 0xC0420010, -1);
    AddConstEx( id, "STATUS_BTH_ATT_INSUFFICIENT_RESOURCES", 0xC0420011, -1);
    AddConstEx( id, "STATUS_BTH_ATT_UNKNOWN_ERROR", 0xC0421000, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_ROLLBACK_DETECTED", 0xC0430001, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_VIOLATION", 0xC0430002, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_INVALID_POLICY", 0xC0430003, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_PUBLISHER_NOT_FOUND", 0xC0430004, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_NOT_SIGNED", 0xC0430005, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_FILE_REPLACED", 0xC0430007, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_NOT_AUTHORIZED", 0xC0430008, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_UNKNOWN", 0xC0430009, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_MISSING_ANTIROLLBACKVERSION", 0xC043000A, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_PLATFORM_ID_MISMATCH", 0xC043000B, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_ROLLBACK_DETECTED", 0xC043000C, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_POLICY_UPGRADE_MISMATCH", 0xC043000D, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_REQUIRED_POLICY_FILE_MISSING", 0xC043000E, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_NOT_BASE_POLICY", 0xC043000F, -1);
    AddConstEx( id, "STATUS_SECUREBOOT_NOT_SUPPLEMENTAL_POLICY", 0xC0430010, -1);
    AddConstEx( id, "STATUS_AUDIO_ENGINE_NODE_NOT_FOUND", 0xC0440001, -1);
    AddConstEx( id, "STATUS_HDAUDIO_EMPTY_CONNECTION_LIST", 0xC0440002, -1);
    AddConstEx( id, "STATUS_HDAUDIO_CONNECTION_LIST_NOT_SUPPORTED", 0xC0440003, -1);
    AddConstEx( id, "STATUS_HDAUDIO_NO_LOGICAL_DEVICES_CREATED", 0xC0440004, -1);
    AddConstEx( id, "STATUS_HDAUDIO_NULL_LINKED_LIST_ENTRY", 0xC0440005, -1);
    AddConstEx( id, "STATUS_VSM_NOT_INITIALIZED", 0xC0450000, -1);
    AddConstEx( id, "STATUS_VSM_DMA_PROTECTION_NOT_IN_USE", 0xC0450001, -1);
    AddConstEx( id, "STATUS_VOLSNAP_BOOTFILE_NOT_VALID", 0xC0500003, -1);
    AddConstEx( id, "STATUS_VOLSNAP_ACTIVATION_TIMEOUT", 0xC0500004, -1);
    AddConstEx( id, "STATUS_IO_PREEMPTED", 0xC0510001, -1);
    AddConstEx( id, "STATUS_SVHDX_ERROR_STORED", 0xC05C0000, -1);
    AddConstEx( id, "STATUS_SVHDX_ERROR_NOT_AVAILABLE", 0xC05CFF00, -1);
    AddConstEx( id, "STATUS_SVHDX_UNIT_ATTENTION_AVAILABLE", 0xC05CFF01, -1);
    AddConstEx( id, "STATUS_SVHDX_UNIT_ATTENTION_CAPACITY_DATA_CHANGED", 0xC05CFF02, -1);
    AddConstEx( id, "STATUS_SVHDX_UNIT_ATTENTION_RESERVATIONS_PREEMPTED", 0xC05CFF03, -1);
    AddConstEx( id, "STATUS_SVHDX_UNIT_ATTENTION_RESERVATIONS_RELEASED", 0xC05CFF04, -1);
    AddConstEx( id, "STATUS_SVHDX_UNIT_ATTENTION_REGISTRATIONS_PREEMPTED", 0xC05CFF05, -1);
    AddConstEx( id, "STATUS_SVHDX_UNIT_ATTENTION_OPERATING_DEFINITION_CHANGED", 0xC05CFF06, -1);
    AddConstEx( id, "STATUS_SVHDX_RESERVATION_CONFLICT", 0xC05CFF07, -1);
    AddConstEx( id, "STATUS_SVHDX_WRONG_FILE_TYPE", 0xC05CFF08, -1);
    AddConstEx( id, "STATUS_SVHDX_VERSION_MISMATCH", 0xC05CFF09, -1);
    AddConstEx( id, "STATUS_VHD_SHARED", 0xC05CFF0A, -1);
    AddConstEx( id, "STATUS_SVHDX_NO_INITIATOR", 0xC05CFF0B, -1);
    AddConstEx( id, "STATUS_VHDSET_BACKING_STORAGE_NOT_FOUND", 0xC05CFF0C, -1);
    AddConstEx( id, "STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP", 0xC05D0000, -1);
    AddConstEx( id, "STATUS_SMB_BAD_CLUSTER_DIALECT", 0xC05D0001, -1);
    AddConstEx( id, "STATUS_SMB_GUEST_LOGON_BLOCKED", 0xC05D0002, -1);
    AddConstEx( id, "STATUS_SPACES_FAULT_DOMAIN_TYPE_INVALID", 0xC0E70001, -1);
    AddConstEx( id, "STATUS_SPACES_RESILIENCY_TYPE_INVALID", 0xC0E70003, -1);
    AddConstEx( id, "STATUS_SPACES_DRIVE_SECTOR_SIZE_INVALID", 0xC0E70004, -1);
    AddConstEx( id, "STATUS_SPACES_DRIVE_REDUNDANCY_INVALID", 0xC0E70006, -1);
    AddConstEx( id, "STATUS_SPACES_NUMBER_OF_DATA_COPIES_INVALID", 0xC0E70007, -1);
    AddConstEx( id, "STATUS_SPACES_INTERLEAVE_LENGTH_INVALID", 0xC0E70009, -1);
    AddConstEx( id, "STATUS_SPACES_NUMBER_OF_COLUMNS_INVALID", 0xC0E7000A, -1);
    AddConstEx( id, "STATUS_SPACES_NOT_ENOUGH_DRIVES", 0xC0E7000B, -1);
    AddConstEx( id, "STATUS_SPACES_EXTENDED_ERROR", 0xC0E7000C, -1);
    AddConstEx( id, "STATUS_SPACES_PROVISIONING_TYPE_INVALID", 0xC0E7000D, -1);
    AddConstEx( id, "STATUS_SPACES_ALLOCATION_SIZE_INVALID", 0xC0E7000E, -1);
    AddConstEx( id, "STATUS_SPACES_ENCLOSURE_AWARE_INVALID", 0xC0E7000F, -1);
    AddConstEx( id, "STATUS_SPACES_WRITE_CACHE_SIZE_INVALID", 0xC0E70010, -1);
    AddConstEx( id, "STATUS_SPACES_NUMBER_OF_GROUPS_INVALID", 0xC0E70011, -1);
    AddConstEx( id, "STATUS_SPACES_DRIVE_OPERATIONAL_STATE_INVALID", 0xC0E70012, -1);
    AddConstEx( id, "STATUS_SPACES_UPDATE_COLUMN_STATE", 0xC0E70013, -1);
    AddConstEx( id, "STATUS_SPACES_MAP_REQUIRED", 0xC0E70014, -1);
    AddConstEx( id, "STATUS_SPACES_UNSUPPORTED_VERSION", 0xC0E70015, -1);
    AddConstEx( id, "STATUS_SPACES_CORRUPT_METADATA", 0xC0E70016, -1);
    AddConstEx( id, "STATUS_SPACES_DRT_FULL", 0xC0E70017, -1);
    AddConstEx( id, "STATUS_SPACES_INCONSISTENCY", 0xC0E70018, -1);
    AddConstEx( id, "STATUS_SPACES_LOG_NOT_READY", 0xC0E70019, -1);
    AddConstEx( id, "STATUS_SPACES_NO_REDUNDANCY", 0xC0E7001A, -1);
    AddConstEx( id, "STATUS_SPACES_DRIVE_NOT_READY", 0xC0E7001B, -1);
    AddConstEx( id, "STATUS_SPACES_DRIVE_SPLIT", 0xC0E7001C, -1);
    AddConstEx( id, "STATUS_SPACES_DRIVE_LOST_DATA", 0xC0E7001D, -1);
    AddConstEx( id, "STATUS_SECCORE_INVALID_COMMAND", 0xC0E80000, -1);
    AddConstEx( id, "STATUS_SYSTEM_INTEGRITY_ROLLBACK_DETECTED", 0xC0E90001, -1);
    AddConstEx( id, "STATUS_SYSTEM_INTEGRITY_POLICY_VIOLATION", 0xC0E90002, -1);
    AddConstEx( id, "STATUS_SYSTEM_INTEGRITY_INVALID_POLICY", 0xC0E90003, -1);
    AddConstEx( id, "STATUS_SYSTEM_INTEGRITY_POLICY_NOT_SIGNED", 0xC0E90004, -1);
    AddConstEx( id, "STATUS_NO_APPLICABLE_APP_LICENSES_FOUND", 0xC0EA0001, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_NOT_FOUND", 0xC0EA0002, -1);
    AddConstEx( id, "STATUS_CLIP_DEVICE_LICENSE_MISSING", 0xC0EA0003, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_INVALID_SIGNATURE", 0xC0EA0004, -1);
    AddConstEx( id, "STATUS_CLIP_KEYHOLDER_LICENSE_MISSING_OR_INVALID", 0xC0EA0005, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_EXPIRED", 0xC0EA0006, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_SIGNED_BY_UNKNOWN_SOURCE", 0xC0EA0007, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_NOT_SIGNED", 0xC0EA0008, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_HARDWARE_ID_OUT_OF_TOLERANCE", 0xC0EA0009, -1);
    AddConstEx( id, "STATUS_CLIP_LICENSE_DEVICE_ID_MISMATCH", 0xC0EA000A, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_NOT_AUTHORIZED", 0xC0EB0001, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_INVALID", 0xC0EB0002, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_FILE_NOT_AUTHORIZED", 0xC0EB0003, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_CATALOG_NOT_AUTHORIZED", 0xC0EB0004, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_BINARY_ID_NOT_FOUND", 0xC0EB0005, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_NOT_ACTIVE", 0xC0EB0006, -1);
    AddConstEx( id, "STATUS_PLATFORM_MANIFEST_NOT_SIGNED", 0xC0EB0007, -1);
  }
}

static main(void) {
        Enums();                // enumerations
}

↧

rfg longjumps

November 9, 2016, 8:38 am

≫ Next: W32pServiceTableFilter from windows 10 build 14951 x64

≪ Previous: ntstatus.idc for WDK 10.0.14931.0

In IMAGE_LOAD_CONFIG_DIRECTORY64 there are two fields for setjmp/longjmp support - GuardLongJumpTargetTable & GuardLongJumpTargetCount. Lets see some module where this fields are not zero - for example hal.dll
load_config:

.rdata:00000001C003D510  dq offset __guard_longjmp_table ; load_config 0ffset b0
.rdata:00000001C003D518  dq 1

Check __guard_longjmp_table:
GFIDS:00000001C0073DC4 __guard_longjmp_table dd 8282h

Image base is 1C0000000. Look at address 1C0000000 + 8282 = 1c0008282:

.text:00000001C000827D   call    _setjmp
.text:00000001C0008282   mov     rbx, [rsp+38h+var_18]

It seems that this longjump return addresses checked in ntdll!RtlGuardCheckLongJumpTarget function:

.text:0000000180007E0E   mov   r8d, 0Ah     ; IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
.text:0000000180007E14   mov   dl, 1
.text:0000000180007E16   call  RtlImageDirectoryEntryToData
.text:0000000180007E1B   mov   rdx, rax
.text:0000000180007E1E   test  rax, rax
.text:0000000180007E21   jz    short loc_180007E93
.text:0000000180007E23   mov   eax, [rax]  ; IMAGE_LOAD_CONFIG_DIRECTORY64.Size
.text:0000000180007E25   cmp   eax, 0C0h
.text:0000000180007E2A   jb    short loc_180007E93
.text:0000000180007E2C   cmp   dword ptr [rsp+48h+arg_18], eax
.text:0000000180007E30   jnz   short loc_180007E93
.text:0000000180007E32   test  dword ptr [rdx+90h], 10000h
.text:0000000180007E3C   jz    short loc_180007E93
.text:0000000180007E3E   mov   eax, esi
.text:0000000180007E40   sub   eax, dword ptr [rsp+48h+var_10]
.text:0000000180007E44   mov   [rsp+48h+var_18], eax
.text:0000000180007E48   mov   eax, [rdx+90h]
.text:0000000180007E4E   mov   r8, [rdx+0B8h] ; IMAGE_LOAD_CONFIG_DIRECTORY64.GuardLongJumpTargetCount
.text:0000000180007E55   shr   eax, 1Ch
.text:0000000180007E58   add   eax, 4
.text:0000000180007E5B   test  r8, r8
.text:0000000180007E5E   jz    loc_1800AD2B7
.text:0000000180007E64   and   [rsp+48h+var_20], 0
.text:0000000180007E6A   lea   rcx, [rsp+48h+var_18]      ; void *
.text:0000000180007E6F   mov   rdx, [rdx+0B0h]            ; IMAGE_LOAD_CONFIG_DIRECTORY64.GuardLongJumpTargetTable
.text:0000000180007E76   mov   r9d, eax                   ; size_t
.text:0000000180007E79   lea   rax, RtlpTargetCompare
.text:0000000180007E80   mov   [rsp+48h+var_28], rax
.text:0000000180007E85   call  bsearch_s
...

.text:0000000180089970 RtlpTargetCompare proc near
.text:0000000180089970 mov eax, [rdx] ; load rva from
__guard_longjmp_table

.text:0000000180089972   sub   eax, [r8]
.text:0000000180089975   retn
.text:0000000180089975 RtlpTargetCompare endp

↧

W32pServiceTableFilter from windows 10 build 14951 x64

November 15, 2016, 7:25 am

≫ Next: KiServiceTable from windows 10 build 14986

≪ Previous: rfg longjumps

kd> ? nt!KeServiceDescriptorTableFilter
Evaluate expression: -8795428636992 = fffff800`2799b6c0

kd> dps fffff800`2799b6c0
fffff800`2799b6c0  fffff800`278f4450 nt!KiServiceTable
fffff800`2799b6c8  00000000`00000000
fffff800`2799b6d0  00000000`000001c4
fffff800`2799b6d8  fffff800`278f4b64 nt!KiArgumentTable
fffff800`2799b6e0  ffffa344`ba544bc0 win32k!W32pServiceTableFilter

fffff800`2799b6e8  00000000`00000000
fffff800`2799b6f0  00000000`0000049c
fffff800`2799b6f8  ffffa344`ba5462d4 win32k!W32pArgumentTableFilter

W32pServiceLimitFilter .eq. 49C (and W32pServiceLimit too)

stub_UserGetOwnerTransformedMonitorRect
stub_UserYieldTask
stub_UserSetSensorPresence
NtUserGetThreadState
NtUserPeekMessage
NtUserCallOneParam
NtUserGetKeyState
NtUserInvalidateRect
NtUserCallNoParam
NtUserGetMessage
NtUserMessageCall
NtGdiBitBlt
NtGdiGetCharSet
NtUserGetDC
NtGdiSelectBitmap
NtUserWaitMessage
NtUserTranslateMessage
NtUserGetProp
NtUserPostMessage
NtUserQueryWindow
stub_UserTranslateAccelerator
NtGdiFlush
NtUserRedrawWindow
NtUserWindowFromPoint
NtUserCallMsgFilter
NtUserValidateTimerCallback
NtUserBeginPaint
NtUserSetTimer
NtUserEndPaint
NtUserSetCursor
NtUserKillTimer
NtUserBuildHwndList
NtUserSelectPalette
NtUserCallNextHookEx
stub_UserHideCaret
NtGdiIntersectClipRect
NtUserCallHwndLock
NtUserGetProcessWindowStation
NtGdiDeleteObjectApp
NtUserSetWindowPos
NtUserShowCaret
stub_UserEndDeferWindowPosEx
NtUserCallHwndParamLock
NtUserVkKeyScanEx
NtGdiSetDIBitsToDeviceInternal
NtUserCallTwoParam
NtGdiGetRandomRgn
stub_UserCopyAcceleratorTable
NtUserNotifyWinEvent
NtGdiExtSelectClipRgn
NtUserIsClipboardFormatAvailable
NtUserSetScrollInfo
NtGdiStretchBlt
NtUserCreateCaret
NtGdiRectVisible
NtGdiCombineRgn
NtGdiGetDCObject
NtUserDispatchMessage
NtUserRegisterWindowMessage
NtGdiExtTextOutW
NtGdiSelectFont
NtGdiRestoreDC
NtGdiSaveDC
NtUserGetForegroundWindow
stub_UserShowScrollBar
NtUserFindExistingCursorIcon
NtGdiGetDCDword
NtGdiGetRegionData
NtGdiLineTo
NtUserSystemParametersInfo
NtGdiGetAppClipBox
NtUserGetAsyncKeyState
NtUserGetCPD
NtUserRemoveProp
NtGdiDoPalette
NtGdiPolyPolyDraw
NtUserSetCapture
NtUserEnumDisplayMonitors
NtGdiCreateCompatibleBitmap
NtUserSetProp
NtGdiGetTextCharsetInfo
stub_UserSBGetParms
NtUserGetIconInfo
stub_UserExcludeUpdateRgn
NtUserSetFocus
NtGdiExtGetObjectW
NtUserGetUpdateRect
NtGdiCreateCompatibleDC
NtUserGetClipboardSequenceNumber
NtGdiCreatePen
NtUserShowWindow
NtUserGetKeyboardLayoutList
NtGdiPatBlt
NtUserMapVirtualKeyEx
NtUserSetWindowLong
NtGdiHfontCreate
NtUserMoveWindow
NtUserPostThreadMessage
NtUserDrawIconEx
NtUserGetSystemMenu
NtGdiDrawStream
NtUserInternalGetWindowText
NtUserGetWindowDC
stub_GdiD3dDrawPrimitives2
stub_GdiInvertRgn
stub_GdiGetRgnBox
NtGdiGetAndSetDCDword
stub_GdiMaskBlt
NtGdiGetWidthTable
NtUserScrollDC
NtUserGetObjectInformation
NtGdiCreateBitmap
NtUserFindWindowEx
NtGdiPolyPatBlt
NtUserUnhookWindowsHookEx
stub_GdiGetNearestColor
NtGdiTransformPoints
NtGdiGetDCPoint
stub_GdiCreateDIBBrush
NtGdiGetTextMetricsW
NtUserCreateWindowEx
NtUserSetParent
NtUserGetKeyboardState
NtUserToUnicodeEx
NtUserGetControlBrush
NtUserGetClassName
NtGdiAlphaBlend
stub_GdiDdBlt
NtGdiOffsetRgn
stub_UserDefSetText
NtGdiGetTextFaceW
NtGdiStretchDIBitsInternal
NtUserSendInput
NtUserGetThreadDesktop
NtGdiCreateRectRgn
NtGdiGetDIBitsInternal
stub_UserGetUpdateRgn
NtGdiDeleteClientObj
NtUserGetIconSize
NtUserFillWindow
NtGdiExtCreateRegion
NtGdiComputeXformCoefficients
NtUserSetWindowsHookEx
stub_UserNotifyProcessCreate
stub_GdiUnrealizeObject
NtUserGetTitleBarInfo
NtGdiRectangle
NtUserSetThreadDesktop
NtUserGetDCEx
stub_UserGetScrollBarInfo
stub_GdiGetTextExtent
NtUserSetWindowFNID
NtGdiSetLayout
NtUserCalcMenuBar
NtUserThunkedMenuItemInfo
NtGdiExcludeClipRect
NtGdiCreateDIBSection
NtGdiGetDCforBitmap
NtUserDestroyCursor
NtUserDestroyWindow
NtUserCallHwndParam
NtGdiCreateDIBitmapInternal
stub_UserOpenWindowStation
stub_GdiDdDeleteSurfaceObject
stub_GdiDdCanCreateSurface
stub_GdiDdCreateSurface
NtUserSetCursorIconData
stub_GdiDdDestroySurface
NtUserCloseDesktop
NtUserOpenDesktop
stub_UserSetProcessWindowStation
NtUserGetAtomName
stub_GdiDdResetVisrgn
NtGdiExtCreatePen
NtGdiCreatePaletteInternal
stub_GdiSetBrushOrg
NtUserBuildNameList
NtGdiSetPixel
NtUserRegisterClassExWOW
NtGdiCreatePatternBrushInternal
NtUserGetAncestor
NtGdiGetOutlineTextMetricsInternalW
NtGdiSetBitmapBits
NtUserCloseWindowStation
NtUserGetDoubleClickTime
stub_UserEnableScrollBar
NtGdiCreateSolidBrush
NtUserGetClassInfoEx
NtGdiCreateClientObj
NtUserUnregisterClass
NtUserDeleteMenu
NtGdiRectInRegion
stub_UserScrollWindowEx
NtGdiGetPixel
stub_UserSetClassLong
NtUserGetMenuBarInfo
stub_GdiDdCreateSurfaceEx
stub_GdiDdCreateSurfaceObject
stub_GdiGetNearestPaletteIndex
stub_GdiDdLockD3D
stub_GdiDdUnlockD3D
NtGdiGetCharWidthW
stub_UserInvalidateRgn
stub_UserGetClipboardOwner
NtUserSetWindowRgn
NtUserBitBltSysBmp
stub_GdiGetCharWidthInfo
NtUserValidateRect
NtUserCloseClipboard
NtUserOpenClipboard
stub_UserSetClipboardData
stub_UserEnableMenuItem
stub_UserAlterWindowStyle
NtGdiFillRgn
NtUserGetWindowPlacement
NtGdiModifyWorldTransform
NtGdiGetFontData
NtUserGetOpenClipboardWindow
stub_UserSetThreadState
NtGdiOpenDCW
NtUserTrackMouseEvent
NtGdiGetTransform
NtUserDestroyMenu
NtGdiGetBitmapBits
stub_UserConsoleControl
NtUserSetActiveWindow
stub_UserSetInformationThread
stub_UserSetWindowPlacement
NtUserGetControlColor
NtGdiSetMetaRgn
stub_GdiSetMiterLimit
stub_GdiSetVirtualResolution
stub_GdiGetRasterizerCaps
stub_UserSetWindowWord
NtUserGetClipboardFormatName
NtUserRealInternalGetMessage
stub_UserCreateLocalMemHandle
stub_UserAttachThreadInput
stub_GdiCreateHalftonePalette
stub_UserPaintMenuBar
NtUserSetKeyboardState
stub_GdiCombineTransform
NtUserCreateAcceleratorTable
NtUserGetCursorFrameInfo
stub_UserGetAltTabInfo
NtUserGetCaretBlinkTime
NtGdiQueryFontAssocInfo
stub_UserProcessConnect
NtUserEnumDisplayDevices
stub_UserEmptyClipboard
stub_UserGetClipboardData
NtUserRemoveMenu
NtGdiSetBoundsRect
stub_GdiGetBitmapDimension
stub_UserConvertMemHandle
NtUserDestroyAcceleratorTable
NtUserGetGUIThreadInfo
stub_GdiCloseFigure
stub_UserSetWindowsHookAW
stub_UserSetMenuDefaultItem
stub_UserCheckMenuItem
NtUserSetWinEventHook
NtUserUnhookWinEvent
stub_UserLockWindowUpdate
stub_UserSetSystemMenu
NtUserThunkedMenuInfo
stub_GdiBeginPath
stub_GdiEndPath
stub_GdiFillPath
NtUserCallHwnd
stub_UserDdeInitialize
NtUserModifyUserStartupInfoFlags
NtUserCountClipboardFormats
stub_GdiAddFontMemResourceEx
stub_GdiEqualRgn
stub_GdiGetSystemPaletteUse
stub_GdiRemoveFontMemResourceEx
NtUserEnumDisplaySettings
stub_UserPaintDesktop
stub_GdiExtEscape
stub_GdiSetBitmapDimension
stub_GdiSetFontEnumeration
NtUserChangeClipboardChain
NtUserSetClipboardViewer
stub_UserShowWindowAsync
stub_GdiCreateColorSpace
stub_GdiDeleteColorSpace
NtUserActivateKeyboardLayout
NtBindCompositionSurface
stub_CompositionInputThread
NtCompositionSetDropTarget
NtCreateCompositionInputSink
NtCreateCompositionSurfaceHandle
stub_CreateImplicitCompositionInputSink
NtDCompositionAddCrossDeviceVisualChild
stub_DCompositionBeginFrame
NtDCompositionCommitChannel
stub_DCompositionConfirmFrame
stub_DCompositionConnectPipe
NtDCompositionCreateAndBindSharedSection
NtDCompositionCreateChannel
stub_DCompositionCreateConnection
stub_DCompositionCreateDwmChannel
stub_DCompositionCreateSharedVisualHandle
NtDCompositionCurrentBatchId
NtDCompositionDestroyChannel
stub_DCompositionDestroyConnection
stub_DCompositionDiscardFrame
stub_DCompositionDuplicateHandleToProcess
stub_DCompositionDuplicateSwapchainHandleToDwm
stub_DCompositionEnableDDASupport
stub_DCompositionEnableMMCSS
stub_DCompositionGetChannels
stub_DCompositionGetConnectionBatch
NtDCompositionGetDeletedResources
stub_DCompositionGetFrameLegacyTokens
NtDCompositionGetFrameStatistics
stub_DCompositionGetFrameSurfaceUpdates
NtDCompositionProcessChannelBatchBuffer
stub_DCompositionReferenceSharedResourceOnDwmChannel
stub_DCompositionRegisterThumbnailVisual
stub_DCompositionRegisterVirtualDesktopVisual
NtDCompositionReleaseAllResources
NtDCompositionRemoveCrossDeviceVisualChild
stub_DCompositionRetireFrame
NtDCompositionSetChannelCallbackId
NtDCompositionSetChannelCommitCompletionEvent
stub_DCompositionSetDebugCounter
stub_DCompositionSubmitDWMBatch
NtDCompositionSynchronize
NtDCompositionTelemetryAnimationScenarioBegin
NtDCompositionTelemetryAnimationScenarioReference
NtDCompositionTelemetryAnimationScenarioUnreference
NtDCompositionTelemetrySetApplicationId
NtDCompositionTelemetryTouchInteractionBegin
NtDCompositionTelemetryTouchInteractionEnd
NtDCompositionTelemetryTouchInteractionUpdate
stub_DCompositionUpdatePointerCapture
NtDCompositionWaitForChannel
stub_DesktopCaptureBits
stub_DuplicateCompositionInputSink
stub_GdiAbortDoc
stub_GdiAbortPath
stub_GdiAddEmbFontToDC
stub_GdiAddFontResourceW
stub_GdiAddRemoteFontToDC
stub_GdiAddRemoteMMInstanceToDC
stub_GdiAngleArc
NtGdiAnyLinkedFonts
stub_GdiArcInternal
stub_GdiBRUSHOBJ_DeleteRbrush
stub_GdiBRUSHOBJ_hGetColorTransform
stub_GdiBRUSHOBJ_pvAllocRbrush
stub_GdiBRUSHOBJ_pvGetRbrush
stub_GdiBRUSHOBJ_ulGetBrushColor
NtGdiBeginGdiRendering
stub_GdiCLIPOBJ_bEnum
stub_GdiCLIPOBJ_cEnumStart
stub_GdiCLIPOBJ_ppoGetPath
stub_GdiCancelDC
stub_GdiChangeGhostFont
stub_GdiCheckBitmapBits
stub_GdiClearBitmapAttributes
stub_GdiClearBrushAttributes
stub_GdiColorCorrectPalette
NtGdiConfigureOPMProtectedOutput
stub_GdiConvertMetafileRect
stub_GdiCreateBitmapFromDxSurface
NtGdiCreateBitmapFromDxSurface2
stub_GdiCreateColorTransform
stub_GdiCreateEllipticRgn
stub_GdiCreateHatchBrushInternal
stub_GdiCreateMetafileDC
NtGdiCreateOPMProtectedOutput
NtGdiCreateOPMProtectedOutputs
NtGdiCreateRoundRectRgn
stub_GdiCreateServerMetaFile
stub_GdiCreateSessionMappedDIBSection
stub_GdiD3dContextCreate
stub_GdiD3dContextDestroy
stub_GdiD3dContextDestroyAll
stub_GdiD3dValidateTextureStageState
stub_GdiDDCCIGetCapabilitiesString
stub_GdiDDCCIGetCapabilitiesStringLength
stub_GdiDDCCIGetTimingReport
stub_GdiDDCCIGetVCPFeature
stub_GdiDDCCISaveCurrentSettings
stub_GdiDDCCISetVCPFeature
stub_GdiDdAddAttachedSurface
stub_GdiDdAlphaBlt
stub_GdiDdAttachSurface
stub_GdiDdBeginMoCompFrame
stub_GdiDdCanCreateD3DBuffer
stub_GdiDdColorControl
stub_GdiDdCreateD3DBuffer
stub_GdiDdCreateDirectDrawObject
stub_GdiDdCreateFullscreenSprite
stub_GdiDdCreateMoComp
stub_GdiDdDDIAbandonSwapChain
stub_GdiDdDDIAcquireKeyedMutex
NtGdiDdDDIAcquireKeyedMutex2
stub_GdiDdDDIAcquireSwapChain
stub_GdiDdDDIAdjustFullscreenGamma
NtGdiDdDDICacheHybridQueryValue
stub_GdiDdDDIChangeVideoMemoryReservation
stub_GdiDdDDICheckExclusiveOwnership
stub_GdiDdDDICheckMonitorPowerState
stub_GdiDdDDICheckMultiPlaneOverlaySupport
stub_GdiDdDDICheckMultiPlaneOverlaySupport2
stub_GdiDdDDICheckMultiPlaneOverlaySupport3
stub_GdiDdDDICheckOcclusion
stub_GdiDdDDICheckSharedResourceAccess
stub_GdiDdDDICheckVidPnExclusiveOwnership
NtGdiDdDDICloseAdapter
NtGdiDdDDIConfigureSharedResource
NtGdiDdDDICreateAllocation
NtGdiDdDDICreateContext
NtGdiDdDDICreateContextVirtual
NtGdiDdDDICreateDCFromMemory
NtGdiDdDDICreateDevice
stub_GdiDdDDICreateHwContext
stub_GdiDdDDICreateHwQueue
stub_GdiDdDDICreateKeyedMutex
NtGdiDdDDICreateKeyedMutex2
stub_GdiDdDDICreateOutputDupl
stub_GdiDdDDICreateOverlay
NtGdiDdDDICreatePagingQueue
stub_GdiDdDDICreateSwapChain
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIDestroyAllocation
NtGdiDdDDIDestroyAllocation2
NtGdiDdDDIDestroyContext
NtGdiDdDDIDestroyDCFromMemory
NtGdiDdDDIDestroyDevice
stub_GdiDdDDIDestroyHwContext
stub_GdiDdDDIDestroyHwQueue
NtGdiDdDDIDestroyKeyedMutex
stub_GdiDdDDIDestroyOutputDupl
stub_GdiDdDDIDestroyOverlay
NtGdiDdDDIDestroyPagingQueue
NtGdiDdDDIDestroySynchronizationObject
NtGdiDdDDIEnumAdapters
NtGdiDdDDIEnumAdapters2
NtGdiDdDDIEscape
NtGdiDdDDIEvict
stub_GdiDdDDIFlipOverlay
NtGdiDdDDIFlushHeapTransitions
NtGdiDdDDIFreeGpuVirtualAddress
NtGdiDdDDIGetCachedHybridQueryValue
stub_GdiDdDDIGetContextInProcessSchedulingPriority
NtGdiDdDDIGetContextSchedulingPriority
stub_GdiDdDDIGetDWMVerticalBlankEvent
NtGdiDdDDIGetDeviceState
NtGdiDdDDIGetDisplayModeList
stub_GdiDdDDIGetMultisampleMethodList
stub_GdiDdDDIGetOverlayState
stub_GdiDdDDIGetPresentHistory
stub_GdiDdDDIGetPresentQueueEvent
stub_GdiDdDDIGetProcessSchedulingPriorityClass
stub_GdiDdDDIGetResourcePresentPrivateDriverData
stub_GdiDdDDIGetRuntimeData
stub_GdiDdDDIGetScanLine
stub_GdiDdDDIGetSetSwapChainMetadata
NtGdiDdDDIGetSharedPrimaryHandle
stub_GdiDdDDIGetSharedResourceAdapterLuid
stub_GdiDdDDIInvalidateActiveVidPn
stub_GdiDdDDIInvalidateCache
NtGdiDdDDILock
NtGdiDdDDILock2
NtGdiDdDDIMakeResident
NtGdiDdDDIMapGpuVirtualAddress
NtGdiDdDDIMarkDeviceAsError
stub_GdiDdDDINetDispGetNextChunkInfo
stub_GdiDdDDINetDispQueryMiracastDisplayDeviceStatus
NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport
stub_GdiDdDDINetDispStartMiracastDisplayDevice
stub_GdiDdDDINetDispStopMiracastDisplayDevice
stub_GdiDdDDINetDispStopSessions
NtGdiDdDDIOfferAllocations
NtGdiDdDDIOpenAdapterFromDeviceName
NtGdiDdDDIOpenAdapterFromHdc
NtGdiDdDDIOpenAdapterFromLuid
stub_GdiDdDDIOpenKeyedMutex
NtGdiDdDDIOpenKeyedMutex2
stub_GdiDdDDIOpenNtHandleFromName
NtGdiDdDDIOpenResource
NtGdiDdDDIOpenResourceFromNtHandle
stub_GdiDdDDIOpenSwapChain
NtGdiDdDDIOpenSyncObjectFromNtHandle
stub_GdiDdDDIOpenSyncObjectFromNtHandle2
stub_GdiDdDDIOpenSyncObjectNtHandleFromName
NtGdiDdDDIOpenSynchronizationObject
stub_GdiDdDDIOutputDuplGetFrameInfo
stub_GdiDdDDIOutputDuplGetMetaData
stub_GdiDdDDIOutputDuplGetPointerShapeData
stub_GdiDdDDIOutputDuplPresent
stub_GdiDdDDIOutputDuplReleaseFrame
stub_GdiDdDDIPinDirectFlipResources
NtGdiDdDDIPollDisplayChildren
NtGdiDdDDIPresent
stub_GdiDdDDIPresentMultiPlaneOverlay
stub_GdiDdDDIPresentMultiPlaneOverlay2
stub_GdiDdDDIPresentMultiPlaneOverlay3
NtGdiDdDDIQueryAdapterInfo
stub_GdiDdDDIQueryAllocationResidency
stub_GdiDdDDIQueryClockCalibration
stub_GdiDdDDIQueryFSEBlock
stub_GdiDdDDIQueryProcessOfferInfo
stub_GdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName
NtGdiDdDDIQueryResourceInfo
NtGdiDdDDIQueryResourceInfoFromNtHandle
stub_GdiDdDDIQueryStatistics
stub_GdiDdDDIQueryVidPnExclusiveOwnership
stub_GdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDIReclaimAllocations
NtGdiDdDDIReclaimAllocations2
stub_GdiDdDDIReleaseKeyedMutex
NtGdiDdDDIReleaseKeyedMutex2
stub_GdiDdDDIReleaseProcessVidPnSourceOwners
stub_GdiDdDDIReleaseSwapChain
NtGdiDdDDIRender
NtGdiDdDDIReserveGpuVirtualAddress
NtGdiDdDDISetAllocationPriority
stub_GdiDdDDISetContextInProcessSchedulingPriority
NtGdiDdDDISetContextSchedulingPriority
stub_GdiDdDDISetDisplayMode
stub_GdiDdDDISetDisplayPrivateDriverFormat
stub_GdiDdDDISetDodIndirectSwapchain
stub_GdiDdDDISetFSEBlock
stub_GdiDdDDISetGammaRamp
NtGdiDdDDISetHwProtectionTeardownRecovery
stub_GdiDdDDISetProcessSchedulingPriorityClass
NtGdiDdDDISetQueuedLimit
stub_GdiDdDDISetStablePowerState
stub_GdiDdDDISetStereoEnabled
stub_GdiDdDDISetSyncRefreshCountWaitTarget
stub_GdiDdDDISetVidPnSourceHwProtection
stub_GdiDdDDISetVidPnSourceOwner
stub_GdiDdDDISetVidPnSourceOwner1
NtGdiDdDDIShareObjects
stub_GdiDdDDISharedPrimaryLockNotification
stub_GdiDdDDISharedPrimaryUnLockNotification
NtGdiDdDDISignalSynchronizationObject
stub_GdiDdDDISignalSynchronizationObjectFromCpu
NtGdiDdDDISignalSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu2
NtGdiDdDDISubmitCommand
stub_GdiDdDDISubmitCommandToHwQueue
stub_GdiDdDDISubmitSignalSyncObjectsToHwQueue
stub_GdiDdDDISubmitWaitForSyncObjectsToHwQueue
stub_GdiDdDDITrimProcessCommitment
NtGdiDdDDIUnlock
NtGdiDdDDIUnlock2
stub_GdiDdDDIUnpinDirectFlipResources
stub_GdiDdDDIUpdateAllocationProperty
stub_GdiDdDDIUpdateGpuVirtualAddress
stub_GdiDdDDIUpdateOverlay
stub_GdiDdDDIWaitForIdle
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDIWaitForSynchronizationObjectFromCpu
NtGdiDdDDIWaitForSynchronizationObjectFromGpu
NtGdiDdDDIWaitForVerticalBlankEvent
stub_GdiDdDDIWaitForVerticalBlankEvent2
stub_GdiDdDeleteDirectDrawObject
stub_GdiDdDestroyD3DBuffer
stub_GdiDdDestroyFullscreenSprite
stub_GdiDdDestroyMoComp
stub_GdiDdEndMoCompFrame
stub_GdiDdFlip
stub_GdiDdFlipToGDISurface
stub_GdiDdGetAvailDriverMemory
stub_GdiDdGetBltStatus
stub_GdiDdGetDC
stub_GdiDdGetDriverInfo
stub_GdiDdGetDriverState
stub_GdiDdGetDxHandle
stub_GdiDdGetFlipStatus
stub_GdiDdGetInternalMoCompInfo
stub_GdiDdGetMoCompBuffInfo
stub_GdiDdGetMoCompFormats
stub_GdiDdGetMoCompGuids
stub_GdiDdGetScanLine
stub_GdiDdLock
stub_GdiDdNotifyFullscreenSpriteUpdate
stub_GdiDdQueryDirectDrawObject
stub_GdiDdQueryMoCompStatus
stub_GdiDdQueryVisRgnUniqueness
stub_GdiDdReenableDirectDrawObject
stub_GdiDdReleaseDC
stub_GdiDdRenderMoComp
stub_GdiDdSetColorKey
stub_GdiDdSetExclusiveMode
stub_GdiDdSetGammaRamp
stub_GdiDdSetOverlayPosition
stub_GdiDdUnattachSurface
stub_GdiDdUnlock
stub_GdiDdUpdateOverlay
stub_GdiDdWaitForVerticalBlank
stub_GdiDeleteColorTransform
stub_GdiDescribePixelFormat
NtGdiDestroyOPMProtectedOutput
stub_GdiDestroyPhysicalMonitor
stub_GdiDoBanding
stub_GdiDrawEscape
stub_GdiDvpAcquireNotification
stub_GdiDvpCanCreateVideoPort
stub_GdiDvpColorControl
stub_GdiDvpCreateVideoPort
stub_GdiDvpDestroyVideoPort
stub_GdiDvpFlipVideoPort
stub_GdiDvpGetVideoPortBandwidth
stub_GdiDvpGetVideoPortConnectInfo
stub_GdiDvpGetVideoPortField
stub_GdiDvpGetVideoPortFlipStatus
stub_GdiDvpGetVideoPortInputFormats
stub_GdiDvpGetVideoPortLine
stub_GdiDvpGetVideoPortOutputFormats
stub_GdiDvpGetVideoSignalStatus
stub_GdiDvpReleaseNotification
stub_GdiDvpUpdateVideoPort
stub_GdiDvpWaitForVideoPortSync
stub_GdiDwmCreatedBitmapRemotingOutput
stub_GdiDxgGenericThunk
stub_GdiEllipse
stub_GdiEnableEudc
stub_GdiEndDoc
NtGdiEndGdiRendering
stub_GdiEndPage
stub_GdiEngAlphaBlend
stub_GdiEngAssociateSurface
stub_GdiEngBitBlt
stub_GdiEngCheckAbort
stub_GdiEngComputeGlyphSet
stub_GdiEngCopyBits
stub_GdiEngCreateBitmap
stub_GdiEngCreateClip
stub_GdiEngCreateDeviceBitmap
stub_GdiEngCreateDeviceSurface
stub_GdiEngCreatePalette
stub_GdiEngDeleteClip
stub_GdiEngDeletePalette
stub_GdiEngDeletePath
stub_GdiEngDeleteSurface
stub_GdiEngEraseSurface
stub_GdiEngFillPath
stub_GdiEngGradientFill
stub_GdiEngLineTo
stub_GdiEngLockSurface
stub_GdiEngMarkBandingSurface
stub_GdiEngPaint
stub_GdiEngPlgBlt
stub_GdiEngStretchBlt
stub_GdiEngStretchBltROP
stub_GdiEngStrokeAndFillPath
stub_GdiEngStrokePath
stub_GdiEngTextOut
stub_GdiEngTransparentBlt
stub_GdiEngUnlockSurface
NtGdiEnumFonts
stub_GdiEnumObjects
stub_GdiEudcLoadUnloadLink
stub_GdiExtFloodFill
stub_GdiFONTOBJ_cGetAllGlyphHandles
stub_GdiFONTOBJ_cGetGlyphs
stub_GdiFONTOBJ_pQueryGlyphAttrs
stub_GdiFONTOBJ_pfdg
stub_GdiFONTOBJ_pifi
stub_GdiFONTOBJ_pvTrueTypeFontFile
stub_GdiFONTOBJ_pxoGetXform
stub_GdiFONTOBJ_vGetInfo
stub_GdiFlattenPath
NtGdiFontIsLinked
stub_GdiForceUFIMapping
NtGdiFrameRgn
stub_GdiFullscreenControl
NtGdiGetBoundsRect
stub_GdiGetCOPPCompatibleOPMInformation
stub_GdiGetCertificate
NtGdiGetCertificateByHandle
stub_GdiGetCertificateSize
NtGdiGetCertificateSizeByHandle
NtGdiGetCharABCWidthsW
stub_GdiGetCharacterPlacementW
stub_GdiGetColorAdjustment
stub_GdiGetColorSpaceforBitmap
NtGdiGetCurrentDpiInfo
NtGdiGetDeviceCaps
stub_GdiGetDeviceCapsAll
stub_GdiGetDeviceGammaRamp
stub_GdiGetDeviceWidth
stub_GdiGetDhpdev
stub_GdiGetETM
stub_GdiGetEmbUFI
stub_GdiGetEmbedFonts
NtGdiGetEntry
stub_GdiGetEudcTimeStampEx
stub_GdiGetFontFileData
stub_GdiGetFontFileInfo
stub_GdiGetFontResourceInfoInternalW
stub_GdiGetFontUnicodeRanges
NtGdiGetGlyphIndicesW
stub_GdiGetGlyphIndicesWInternal
stub_GdiGetGlyphOutline
stub_GdiGetKerningPairs
stub_GdiGetLinkedUFIs
stub_GdiGetMiterLimit
stub_GdiGetMonitorID
NtGdiGetNumberOfPhysicalMonitors
NtGdiGetOPMInformation
NtGdiGetOPMRandomNumber
stub_GdiGetObjectBitmapHandle
stub_GdiGetPath
stub_GdiGetPerBandInfo
stub_GdiGetPhysicalMonitorDescription
stub_GdiGetPhysicalMonitors
stub_GdiGetProcessSessionFonts
stub_GdiGetPublicFontTableChangeCookie
NtGdiGetRealizationInfo
stub_GdiGetServerMetaFileBits
stub_GdiGetSpoolMessage
stub_GdiGetStats
stub_GdiGetStringBitmapW
NtGdiGetSuggestedOPMProtectedOutputArraySize
NtGdiGetTextExtentExW
stub_GdiGetUFI
stub_GdiGetUFIPathname
NtGdiGradientFill
stub_GdiHLSurfGetInformation
stub_GdiHLSurfSetInformation
stub_GdiHT_Get8BPPFormatPalette
stub_GdiHT_Get8BPPMaskPalette
stub_GdiIcmBrushInfo
NtGdiInit
stub_GdiInitSpool
stub_GdiMakeFontDir
stub_GdiMakeInfoDC
stub_GdiMakeObjectUnXferable
stub_GdiMakeObjectXferable
stub_GdiMirrorWindowOrg
stub_GdiMonoBitmap
stub_GdiMoveTo
stub_GdiOffsetClipRgn
stub_GdiPATHOBJ_bEnum
stub_GdiPATHOBJ_bEnumClipLines
stub_GdiPATHOBJ_vEnumStart
stub_GdiPATHOBJ_vEnumStartClipLines
stub_GdiPATHOBJ_vGetBounds
stub_GdiPathToRegion
stub_GdiPlgBlt
stub_GdiPolyDraw
stub_GdiPolyTextOutW
stub_GdiPtInRegion
stub_GdiPtVisible
stub_GdiQueryFonts
stub_GdiRemoveFontResourceW
stub_GdiRemoveMergeFont
stub_GdiResetDC
stub_GdiResizePalette
NtGdiRoundRect
stub_GdiSTROBJ_bEnum
stub_GdiSTROBJ_bEnumPositionsOnly
stub_GdiSTROBJ_bGetAdvanceWidths
stub_GdiSTROBJ_dwGetCodePage
stub_GdiSTROBJ_vEnumStart
stub_GdiScaleViewportExtEx
stub_GdiScaleWindowExtEx
stub_GdiSelectBrush
stub_GdiSelectClipPath
stub_GdiSelectPen
stub_GdiSetBitmapAttributes
stub_GdiSetBrushAttributes
stub_GdiSetColorAdjustment
stub_GdiSetColorSpace
stub_GdiSetDeviceGammaRamp
stub_GdiSetFontXform
NtGdiSetIcmMode
stub_GdiSetLinkedUFIs
stub_GdiSetMagicColors
NtGdiSetOPMSigningKeyAndSequenceNumbers
stub_GdiSetPUMPDOBJ
stub_GdiSetPixelFormat
stub_GdiSetRectRgn
stub_GdiSetSizeDevice
stub_GdiSetSystemPaletteUse
stub_GdiSetTextJustification
NtGdiSetUMPDSandboxState
stub_GdiStartDoc
stub_GdiStartPage
stub_GdiStrokeAndFillPath
stub_GdiStrokePath
stub_GdiSwapBuffers
stub_GdiTransparentBlt
stub_GdiUMPDEngFreeUserMem
stub_GdiUnloadPrinterDriver
stub_GdiUnmapMemFont
stub_GdiUpdateColors
stub_GdiUpdateTransform
stub_GdiWidenPath
stub_GdiXFORMOBJ_bApplyXform
stub_GdiXFORMOBJ_iGetXform
stub_GdiXLATEOBJ_cGetPalette
stub_GdiXLATEOBJ_hGetColorTransform
stub_GdiXLATEOBJ_iXlate
stub_HWCursorUpdatePointer
stub_MITActivateInputProcessing
stub_MITBindInputTypeToMonitors
stub_MITCoreMsgKGetConnectionHandle
stub_MITCoreMsgKOpenConnectionTo
stub_MITCoreMsgKSend
stub_MITDeactivateInputProcessing
stub_MITDisableMouseIntercept
stub_MITEnableMouseIntercept
stub_MITSetInputCallbacks
stub_MITSynthesizeMouseInput
stub_MITSynthesizeTouchInput
stub_MITUpdateInputGlobals
stub_MITWaitForMultipleObjectsEx
stub_NotifyPresentToCompositionSurface
stub_OpenCompositionSurfaceDirtyRegion
stub_OpenCompositionSurfaceSectionInfo
stub_OpenCompositionSurfaceSwapChainHandleInfo
stub_QueryCompositionInputIsImplicit
stub_QueryCompositionInputQueueAndTransform
stub_QueryCompositionInputSink
stub_QueryCompositionInputSinkLuid
stub_QueryCompositionInputSinkViewId
stub_QueryCompositionSurfaceBinding
stub_QueryCompositionSurfaceHDRMetaData
stub_QueryCompositionSurfaceRenderingRealization
NtQueryCompositionSurfaceStatistics
stub_RIMAddInputObserver
stub_RIMAreSiblingDevices
stub_RIMDeviceIoControl
stub_RIMFreeInputBuffer
stub_RIMGetDevicePreparsedData
stub_RIMGetDevicePreparsedDataLockfree
stub_RIMGetDeviceProperties
stub_RIMGetDevicePropertiesLockfree
stub_RIMGetPhysicalDeviceRect
stub_RIMGetSourceProcessId
stub_RIMObserveNextInput
stub_RIMOnPnpNotification
stub_RIMOnTimerNotification
stub_RIMReadInput
stub_RIMRegisterForInput
stub_RIMRemoveInputObserver
stub_RIMSetTestModeStatus
stub_RIMUnregisterForInput
stub_RIMUpdateInputObserverRegistration
stub_SetCompositionSurfaceAnalogExclusive
stub_SetCompositionSurfaceBufferCompositionModeAndOrientation
stub_SetCompositionSurfaceDirectFlipState
stub_SetCompositionSurfaceHDRMetaData
stub_SetCompositionSurfaceIndependentFlipInfo
stub_SetCompositionSurfaceStatistics
stub_TokenManagerConfirmOutstandingAnalogToken
NtTokenManagerCreateCompositionTokenHandle
stub_TokenManagerGetAnalogExclusiveSurfaceUpdates
stub_TokenManagerGetAnalogExclusiveTokenEvent
stub_TokenManagerOpenSectionAndEvents
stub_TokenManagerThread
NtUnBindCompositionSurface
stub_UpdateInputSinkTransforms
stub_UserAcquireIAMKey
stub_UserAcquireInteractiveControlBackgroundAccess
stub_UserAddClipboardFormatListener
NtUserAssociateInputContext
NtUserAutoPromoteMouseInPointer
stub_UserAutoRotateScreen
stub_UserBeginInkFeedbackSession
stub_UserBlockInput
stub_UserBroadcastThemeChangeEvent
NtUserBuildHimcList
stub_UserBuildPropList
stub_UserCalculatePopupWindowPosition
stub_UserCallHwndOpt
stub_UserCanBrokerForceForeground
stub_UserChangeDisplaySettings
NtUserChangeWindowMessageFilterEx
stub_UserCheckAccessForIntegrityLevel
stub_UserCheckProcessForClipboardAccess
stub_UserCheckProcessSession
stub_UserCheckWindowThreadDesktop
NtUserChildWindowFromPointEx
stub_UserClearForeground
NtUserClipCursor
stub_UserCompositionInputSinkLuidFromPoint
stub_UserCompositionInputSinkViewInstanceIdFromPoint
NtUserCreateDCompositionHwndTarget
stub_UserCreateDesktopEx
NtUserCreateInputContext
stub_UserCreateWindowStation
stub_UserCtxDisplayIOCtl
stub_UserDeferWindowPosAndBand
NtUserDelegateCapturePointers
NtUserDelegateInput
NtUserDestroyDCompositionHwndTarget
NtUserDestroyInputContext
stub_UserDisableImmersiveOwner
stub_UserDisableProcessWindowFiltering
NtUserDisableThreadIme
stub_UserDiscardPointerFrameMessages
NtUserDisplayConfigGetDeviceInfo
stub_UserDisplayConfigSetDeviceInfo
stub_UserDoSoundConnect
stub_UserDoSoundDisconnect
stub_UserDragDetect
stub_UserDragObject
stub_UserDrawAnimatedRects
stub_UserDrawCaption
stub_UserDrawCaptionTemp
stub_UserDrawMenuBarTemp
stub_UserDwmGetRemoteSessionOcclusionEvent
stub_UserDwmGetRemoteSessionOcclusionState
stub_UserDwmKernelShutdown
stub_UserDwmKernelStartup
stub_UserDwmValidateWindow
stub_UserEnableChildWindowDpiMessage
stub_UserEnableIAMAccess
NtUserEnableMouseInPointer
stub_UserEnableMouseInputForCursorSuppression
stub_UserEnableNonClientDpiScaling
stub_UserEnableTouchPad
stub_UserEnableWindowResizeOptimization
stub_UserEndInkFeedbackSession
NtUserEndMenu
stub_UserEvent
stub_UserFlashWindowEx
stub_UserFrostCrashedWindow
stub_UserGetAppImeLevel
stub_UserGetAutoRotationState
NtUserGetCIMSSM
NtUserGetCaretPos
stub_UserGetClipCursor
stub_UserGetClipboardAccessToken
stub_UserGetClipboardViewer
stub_UserGetComboBoxInfo
NtUserGetCurrentInputMessageSource
NtUserGetCursorDims
NtUserGetCursorInfo
NtUserGetDManipHookInitFunction
stub_UserGetDesktopID
stub_UserGetDisplayAutoRotationPreferences
stub_UserGetDisplayAutoRotationPreferencesByProcessId
NtUserGetDisplayConfigBufferSizes
NtUserGetDpiForMonitor
NtUserGetGestureConfig
stub_UserGetGestureExtArgs
stub_UserGetGestureInfo
stub_UserGetGuiResources
stub_UserGetHimetricScaleFactorFromPixelLocation
NtUserGetImeHotKey
NtUserGetImeInfoEx
NtUserGetInputLocaleInfo
stub_UserGetInteractiveControlDeviceInfo
stub_UserGetInteractiveControlInfo
stub_UserGetInteractiveCtrlSupportedWaveforms
stub_UserGetInternalWindowPos
NtUserGetKeyNameText
NtUserGetKeyboardLayoutName
NtUserGetLayeredWindowAttributes
stub_UserGetListBoxInfo
stub_UserGetMenuIndex
stub_UserGetMenuItemRect
stub_UserGetMouseMovePointsEx
NtUserGetPhysicalDeviceRect
NtUserGetPointerCursorId
NtUserGetPointerDevice
stub_UserGetPointerDeviceCursors
NtUserGetPointerDeviceProperties
NtUserGetPointerDeviceRects
NtUserGetPointerDevices
NtUserGetPointerFrameArrivalTimes
NtUserGetPointerInfoList
NtUserGetPointerInputTransform
NtUserGetPointerType
NtUserGetPrecisionTouchPadConfiguration
stub_UserGetPriorityClipboardFormat
NtUserGetProcessDpiAwarenessContext
NtUserGetProcessUIContextInformation
NtUserGetQueueStatusReadonly
stub_UserGetRawInputBuffer
NtUserGetRawInputData
stub_UserGetRawInputDeviceInfo
NtUserGetRawInputDeviceList
NtUserGetRawPointerDeviceData
stub_UserGetRegisteredRawInputDevices
stub_UserGetTopLevelWindow
stub_UserGetTouchInputInfo
stub_UserGetTouchValidationStatus
stub_UserGetUpdatedClipboardFormats
stub_UserGetWOWClass
NtUserGetWindowBand
NtUserGetWindowCompositionAttribute
stub_UserGetWindowCompositionInfo
stub_UserGetWindowDisplayAffinity
NtUserGetWindowFeedbackSetting
stub_UserGetWindowMinimizeRect
stub_UserGetWindowRgnEx
stub_UserGhostWindowFromHungWindow
NtUserHandleDelegatedInput
stub_UserHardErrorControl
NtUserHidePointerContactVisualization
stub_UserHiliteMenuItem
stub_UserHungWindowFromGhostWindow
stub_UserHwndQueryRedirectionInfo
stub_UserHwndSetRedirectionInfo
stub_UserImpersonateDdeClientWindow
stub_UserInheritWindowMonitor
stub_UserInitTask
stub_UserInitialize
stub_UserInitializeClientPfnArrays
stub_UserInitializeInputDeviceInjection
stub_UserInitializeInputDeviceInjectionWithParent
stub_UserInitializePointerDeviceInjection
stub_UserInitializePointerDeviceInjectionEx
stub_UserInitializeTouchInjection
stub_UserInjectDeviceInput
stub_UserInjectGesture
stub_UserInjectKeyboardInput
stub_UserInjectMouseInput
stub_UserInjectPointerInput
stub_UserInjectTouchInput
stub_UserInteractiveControlQueryUsage
stub_UserInternalGetWindowIcon
NtUserIsChildWindowDpiMessageEnabled
stub_UserIsMouseInPointerEnabled
stub_UserIsMouseInputEnabled
NtUserIsNonClientDpiScalingEnabled
NtUserIsTopLevelWindow
NtUserIsTouchWindow
NtUserIsWindowBroadcastingDpiToChildren
stub_UserLayoutCompleted
NtUserLinkDpiCursor
NtUserLoadKeyboardLayoutEx
stub_UserLockCursor
stub_UserLockWindowStation
stub_UserLockWorkStation
NtUserLogicalToPerMonitorDPIPhysicalPoint
NtUserLogicalToPhysicalPoint
stub_UserMNDragLeave
stub_UserMNDragOver
stub_UserMagControl
stub_UserMagGetContextInformation
stub_UserMagSetContextInformation
stub_UserMenuItemFromPoint
stub_UserMinMaximize
NtUserModifyWindowTouchCapability
stub_UserNavigateFocus
NtUserNotifyIMEStatus
NtUserOpenInputDesktop
stub_UserOpenThreadDesktop
stub_UserPaintMonitor
stub_UserPerMonitorDPIPhysicalToLogicalPoint
NtUserPhysicalToLogicalPoint
stub_UserPrintWindow
stub_UserPromoteMouseInPointer
NtUserPromotePointer
stub_UserQueryBSDRWindow
NtUserQueryDisplayConfig
stub_UserQueryInformationThread
NtUserQueryInputContext
stub_UserQuerySendMessage
stub_UserRealChildWindowFromPoint
stub_UserRealWaitMessageEx
stub_UserRegisterBSDRWindow
stub_UserRegisterDManipHook
stub_UserRegisterEdgy
stub_UserRegisterErrorReportingDialog
NtUserRegisterHotKey
stub_UserRegisterManipulationThread
stub_UserRegisterPointerDeviceNotifications
stub_UserRegisterPointerInputTarget
NtUserRegisterRawInputDevices
stub_UserRegisterServicesProcess
stub_UserRegisterSessionPort
stub_UserRegisterShellPTPListener
stub_UserRegisterTasklist
NtUserRegisterTouchHitTestingWindow
stub_UserRegisterTouchPadCapable
stub_UserRegisterUserApiHook
stub_UserReleaseDwmHitTestWaiters
stub_UserRemoteConnect
stub_UserRemoteRedrawRectangle
stub_UserRemoteRedrawScreen
stub_UserRemoteStopScreenUpdates
stub_UserRemoveClipboardFormatListener
stub_UserRemoveInjectionDevice
NtUserReportInertia
stub_UserResolveDesktopForWOW
stub_UserSendEventMessage
stub_UserSendInkFeedbackPayload
stub_UserSendInteractiveControlHapticsReport
stub_UserSetActivationFilter
stub_UserSetActiveProcessForMonitor
stub_UserSetAppImeLevel
stub_UserSetAutoRotation
stub_UserSetBrokeredForeground
stub_UserSetCalibrationData
stub_UserSetChildWindowNoActivate
stub_UserSetClassWord
stub_UserSetCoreWindow
stub_UserSetCoreWindowPartner
stub_UserSetCursorContents
stub_UserSetDisplayAutoRotationPreferences
stub_UserSetDisplayConfig
stub_UserSetDisplayMapping
stub_UserSetFallbackForeground
stub_UserSetFeatureReportResponse
NtUserSetGestureConfig
NtUserSetImeHotKey
NtUserSetImeInfoEx
NtUserSetImeOwnerWindow
stub_UserSetInteractiveControlFocus
stub_UserSetInteractiveCtrlRotationAngle
stub_UserSetInternalWindowPos
NtUserSetLayeredWindowAttributes
stub_UserSetManipulationInputTarget
stub_UserSetMenu
stub_UserSetMenuContextHelpId
stub_UserSetMenuFlagRtoL
stub_UserSetMirrorRendering
stub_UserSetObjectInformation
stub_UserSetPrecisionTouchPadConfiguration
NtUserSetProcessDpiAwarenessContext
NtUserSetProcessInteractionFlags
stub_UserSetProcessRestrictionExemption
stub_UserSetProcessUIAccessZorder
stub_UserSetShellWindowEx
stub_UserSetSysColors
stub_UserSetSystemCursor
stub_UserSetSystemTimer
NtUserSetThreadInputBlocked
NtUserSetThreadLayoutHandles
stub_UserSetWindowArrangement
stub_UserSetWindowBand
NtUserSetWindowCompositionAttribute
stub_UserSetWindowCompositionTransition
stub_UserSetWindowDisplayAffinity
NtUserSetWindowFeedbackSetting
stub_UserSetWindowRgnEx
stub_UserSetWindowShowState
stub_UserSetWindowStationUser
stub_UserShowSystemCursor
stub_UserShutdownBlockReasonCreate
stub_UserShutdownBlockReasonQuery
stub_UserShutdownReasonDestroy
stub_UserSignalRedirectionStartComplete
stub_UserSlicerControl
stub_UserSoundSentry
stub_UserSwitchDesktop
stub_UserSystemParametersInfoForDpi
stub_UserTestForInteractiveUser
NtUserTrackPopupMenuEx
NtUserTransformPoint
NtUserTransformRect
NtUserUndelegateInput
stub_UserUnloadKeyboardLayout
stub_UserUnlockWindowStation
stub_UserUnregisterHotKey
stub_UserUnregisterSessionPort
stub_UserUnregisterUserApiHook
stub_UserUpdateDefaultDesktopThumbnail
NtUserUpdateInputContext
stub_UserUpdateInstance
NtUserUpdateLayeredWindow
stub_UserUpdatePerUserSystemParameters
stub_UserUpdateWindowInputSinkHints
stub_UserUpdateWindowTrackingInfo
stub_UserUserHandleGrantAccess
stub_UserValidateHandleSecure
stub_UserWaitAvailableMessageEx
stub_UserWaitForInputIdle
stub_UserWaitForMsgAndEvent
stub_UserWaitForRedirectionStartComplete
stub_UserWindowFromPhysicalPoint
stub_ValidateCompositionSurfaceHandle
NtVisualCaptureBits
NtUserSetClassLongPtr
NtUserSetWindowLongPtr

↧

KiServiceTable from windows 10 build 14986

December 19, 2016, 5:59 am

≫ Next: KiServiceTable from windows 10 build 15007

≪ Previous: W32pServiceTableFilter from windows 10 build 14951 x64

KiServiceLimit .eq. 0x1c5

NtAccessCheck
NtWorkerFactoryWorkerReady
NtAcceptConnectPort
NtYieldExecution
NtWriteVirtualMemory
NtWriteRequestData
NtWriteFileGather
NtWriteFile
NtWaitLowEventPair
NtWaitHighEventPair
NtWaitForWorkViaWorkerFactory
NtWaitForSingleObject
NtWaitForMultipleObjects32
NtWaitForMultipleObjects
NtWaitForKeyedEvent
NtWaitForDebugEvent
NtWaitForAlertByThreadId
NtVdmControl
NtUnsubscribeWnfStateChange
NtUpdateWnfStateData
NtUnmapViewOfSection
NtUnmapViewOfSectionEx
NtUnlockVirtualMemory
NtUnlockFile
NtUnloadKeyEx
NtUnloadKey2
NtUnloadKey
NtUnloadDriver
NtUmsThreadYield
NtTranslateFilePath
NtTraceEvent
NtTraceControl
NtThawTransactions
NtThawRegistry
NtTestAlert
NtTerminateThread
NtTerminateProcess
NtTerminateJobObject
NtSystemDebugControl
NtSuspendThread
NtSuspendProcess
NtSubscribeWnfStateChange
NtStopProfile
NtStartProfile
NtSinglePhaseReject
NtSignalAndWaitForSingleObject
NtShutdownWorkerFactory
NtShutdownSystem
NtSetWnfProcessNotificationEvent
NtSetVolumeInformationFile
NtSetValueKey
NtSetUuidSeed
NtSetTimerResolution
NtSetTimerEx
NtSetTimer
NtSetThreadExecutionState
NtSetSystemTime
NtSetSystemPowerState
NtSetSystemInformation
NtSetSystemEnvironmentValueEx
NtSetSystemEnvironmentValue
NtSetSecurityObject
NtSetQuotaInformationFile
NtSetLowWaitHighEventPair
NtSetLowEventPair
NtSetLdtEntries
NtSetIRTimer
NtSetTimer2
NtCancelTimer2
NtSetIoCompletionEx
NtSetIoCompletion
NtSetIntervalProfile
NtSetInformationWorkerFactory
NtSetInformationTransactionManager
NtSetInformationTransaction
NtSetInformationToken
NtSetInformationThread
NtSetInformationResourceManager
NtSetInformationProcess
NtSetInformationObject
NtSetInformationKey
NtSetInformationJobObject
NtSetInformationFile
NtSetInformationEnlistment
NtSetInformationDebugObject
NtSetHighWaitLowEventPair
NtSetHighEventPair
NtSetEventBoostPriority
NtSetEvent
NtSetEaFile
NtSetDriverEntryOrder
NtSetDefaultUILanguage
NtSetDefaultLocale
NtSetDefaultHardErrorPort
NtSetDebugFilterState
NtSetContextThread
NtSetCachedSigningLevel2
NtSetCachedSigningLevel
NtSetBootOptions
NtSetBootEntryOrder
NtSerializeBoot
NtSecureConnectPort
NtSaveMergedKeys
NtSaveKeyEx
NtSaveKey
NtRollforwardTransactionManager
NtRollbackTransaction
NtRollbackEnlistment
NtRollbackComplete
NtRevertContainerImpersonation
NtResumeThread
NtResumeProcess
NtRestoreKey
NtResetWriteWatch
NtResetEvent
NtRequestWaitReplyPort
NtRequestPort
NtReplyWaitReplyPort
NtReplyWaitReceivePortEx
NtReplyWaitReceivePort
NtReplyPort
NtReplacePartitionUnit
NtReplaceKey
NtRenameTransactionManager
NtRenameKey
NtRemoveProcessDebug
NtRemoveIoCompletionEx
NtRemoveIoCompletion
NtReleaseWorkerFactoryWorker
NtReleaseSemaphore
NtReleaseMutant
NtReleaseKeyedEvent
NtRegisterThreadTerminatePort
NtRegisterProtocolAddressInformation
NtRecoverTransactionManager
NtRecoverResourceManager
NtRecoverEnlistment
NtReadVirtualMemory
NtReadRequestData
NtReadOnlyEnlistment
NtReadFileScatter
NtReadFile
NtRaiseHardError
NtRaiseException
NtQueueApcThreadEx
NtQueueApcThread
NtQueryAuxiliaryCounterFrequency
NtQueryWnfStateData
NtQueryWnfStateNameInformation
NtQueryVolumeInformationFile
NtQueryVirtualMemory
NtQueryValueKey
NtQueryTimerResolution
NtQueryTimer
NtQuerySystemTime
NtQuerySystemInformationEx
NtQuerySystemInformation
NtQuerySystemEnvironmentValueEx
NtQuerySystemEnvironmentValue
NtQuerySymbolicLinkObject
NtQuerySemaphore
NtQuerySecurityPolicy
NtQuerySecurityObject
NtQuerySecurityAttributesToken
NtQuerySection
NtQueryQuotaInformationFile
NtQueryPortInformationProcess
NtQueryPerformanceCounter
NtQueryOpenSubKeysEx
NtQueryOpenSubKeys
NtQueryObject
NtQueryMutant
NtQueryMultipleValueKey
NtQueryLicenseValue
NtQueryKey
NtQueryIoCompletion
NtQueryIntervalProfile
NtQueryInstallUILanguage
NtQueryInformationWorkerFactory
NtQueryInformationTransactionManager
NtQueryInformationTransaction
NtQueryInformationToken
NtQueryInformationThread
NtQueryInformationResourceManager
NtQueryInformationProcess
NtQueryInformationPort
NtQueryInformationJobObject
NtQueryInformationFile
NtQueryInformationEnlistment
NtQueryInformationAtom
NtQueryFullAttributesFile
NtQueryEvent
NtQueryEaFile
NtQueryDriverEntryOrder
NtQueryDirectoryObject
NtQueryDirectoryFile
NtQueryDefaultUILanguage
NtQueryDefaultLocale
NtQueryDebugFilterState
NtQueryBootOptions
NtQueryBootEntryOrder
NtQueryAttributesFile
NtPulseEvent
NtProtectVirtualMemory
NtPropagationFailed
NtPropagationComplete
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtPrivilegeCheck
NtSetInformationVirtualMemory
NtPrePrepareEnlistment
NtPrePrepareComplete
NtPrepareEnlistment
NtPrepareComplete
NtPowerInformation
NtPlugPlayControl
NtOpenTransactionManager
NtOpenTransaction
NtOpenTimer
NtOpenThreadTokenEx
NtOpenThreadToken
NtOpenThread
NtOpenSymbolicLinkObject
NtOpenSession
NtOpenSemaphore
NtOpenSection
NtOpenResourceManager
NtOpenPartition
NtOpenProcessTokenEx
NtOpenProcessToken
NtOpenProcess
NtOpenPrivateNamespace
NtOpenObjectAuditAlarm
NtOpenMutant
NtOpenKeyTransactedEx
NtOpenKeyTransacted
NtOpenKeyEx
NtOpenKeyedEvent
NtOpenKey
NtOpenJobObject
NtOpenIoCompletion
NtOpenFile
NtOpenEventPair
NtOpenEvent
NtOpenEnlistment
NtOpenDirectoryObject
NtNotifyChangeSession
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtNotifyChangeDirectoryFile
NtManagePartition
NtModifyDriverEntry
NtModifyBootEntry
NtMapViewOfSection
NtMapUserPhysicalPagesScatter
NtMapUserPhysicalPages
NtMapCMFModule
NtMakeTemporaryObject
NtMakePermanentObject
NtLockVirtualMemory
NtLockRegistryKey
NtLockProductActivationKeys
NtLockFile
NtLoadKeyEx
NtLoadKey2
NtLoadKey
NtLoadEnclaveData
NtLoadDriver
NtListenPort
NtIsUILanguageComitted
NtIsSystemResumeAutomatic
NtIsProcessInJob
NtInitiatePowerAction
NtInitializeRegistry
NtInitializeNlsFiles
NtInitializeEnclave
NtImpersonateThread
NtImpersonateClientOfPort
NtImpersonateAnonymousToken
NtGetWriteWatch
NtGetNotificationResourceManager
NtGetNlsSectionPtr
NtGetNextThread
NtGetNextProcess
NtGetMUIRegistryInfo
NtGetDevicePowerState
NtGetCurrentProcessorNumberEx
NtGetCurrentProcessorNumber
NtGetContextThread
NtGetCompleteWnfStateSubscription
NtGetCachedSigningLevel
NtFsControlFile
NtFreezeTransactions
NtFreezeRegistry
NtFreeVirtualMemory
NtFreeUserPhysicalPages
NtFlushWriteBuffer
NtFlushVirtualMemory
NtFlushProcessWriteBuffers
NtFlushKey
NtFlushInstructionCache
NtFlushInstallUILanguage
NtFlushBuffersFile
NtFlushBuffersFileEx
NtFindAtom
NtFilterToken
NtFilterTokenEx
NtFilterBootOption
NtExtendSection
NtEnumerateValueKey
NtEnumerateTransactionObject
NtEnumerateSystemEnvironmentValuesEx
NtEnumerateKey
NtEnumerateDriverEntries
NtEnumerateBootEntries
NtEnableLastKnownGood
NtDuplicateToken
NtDuplicateObject
NtDrawText
NtDisplayString
NtDisableLastKnownGood
NtDeviceIoControlFile
NtDeleteWnfStateName
NtDeleteWnfStateData
NtDeleteValueKey
NtDeletePrivateNamespace
NtDeleteObjectAuditAlarm
NtDeleteKey
NtDeleteFile
NtDeleteDriverEntry
NtDeleteBootEntry
NtDeleteAtom
NtDelayExecution
NtDebugContinue
NtDebugActiveProcess
NtCreatePartition
NtCreateWorkerFactory
NtCreateWnfStateName
NtCreateWaitCompletionPacket
NtCreateWaitablePort
NtCreateUserProcess
NtCreateTransactionManager
NtCreateTransaction
NtCreateToken
NtCreateLowBoxToken
NtCreateTokenEx
NtCreateTimer
NtCreateThreadEx
NtCreateThread
NtCreateSymbolicLinkObject
NtCreateSemaphore
NtCreateSection
NtCreateResourceManager
NtCreateProfileEx
NtCreateProfile
NtCreateProcessEx
NtCreateProcess
NtCreatePrivateNamespace
NtCreatePort
NtCreatePagingFile
NtCreateNamedPipeFile
NtCreateMutant
NtCreateMailslotFile
NtCreateKeyTransacted
NtCreateKeyedEvent
NtCreateKey
NtCreateJobSet
NtCreateJobObject
NtCreateIRTimer
NtCreateTimer2
NtCreateIoCompletion
NtCreateFile
NtCreateEventPair
NtCreateEvent
NtCreateEnlistment
NtCreateEnclave
NtCreateDirectoryObjectEx
NtCreateDirectoryObject
NtCreateDebugObject
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
NtContinue
NtConnectPort
NtCompressKey
NtCompleteConnectPort
NtCompareTokens
NtCompareSigningLevels
NtCompareObjects
NtCompactKeys
NtCommitTransaction
NtCommitEnlistment
NtCommitComplete
NtCloseObjectAuditAlarm
NtClose
NtClearEvent
NtCancelWaitCompletionPacket
NtCancelTimer
NtCancelSynchronousIoFile
NtCancelIoFileEx
NtCancelIoFile
NtCallbackReturn
NtAssociateWaitCompletionPacket
NtAssignProcessToJobObject
NtAreMappedFilesTheSame
NtApphelpCacheControl
NtAlpcSetInformation
NtAlpcSendWaitReceivePort
NtAlpcRevokeSecurityContext
NtAlpcQueryInformationMessage
NtAlpcQueryInformation
NtAlpcOpenSenderThread
NtAlpcOpenSenderProcess
NtAlpcImpersonateClientOfPort
NtAlpcImpersonateClientContainerOfPort
NtAlpcDisconnectPort
NtAlpcDeleteSecurityContext
NtAlpcDeleteSectionView
NtAlpcDeleteResourceReserve
NtAlpcDeletePortSection
NtAlpcCreateSecurityContext
NtAlpcCreateSectionView
NtAlpcCreateResourceReserve
NtAlpcCreatePortSection
NtAlpcCreatePort
NtAlpcConnectPort
NtAlpcConnectPortEx
NtAlpcCancelMessage
NtAlpcAcceptConnectPort
NtAllocateVirtualMemory
NtAllocateUuids
NtAllocateUserPhysicalPages
NtAllocateReserveObject
NtAllocateLocallyUniqueId
NtAlertThreadByThreadId
NtAlertThread
NtAlertResumeThread
NtAdjustPrivilegesToken
NtAdjustGroupsToken
NtAdjustTokenClaimsAndDeviceGroups
NtAddDriverEntry
NtAddBootEntry
NtAddAtom
NtAddAtomEx
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultList
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByType
NtAccessCheckAndAuditAlarm
NtSetInformationSymbolicLink
NtCreateRegistryTransaction
NtOpenRegistryTransaction
NtCommitRegistryTransaction
NtRollbackRegistryTransaction

↧

KiServiceTable from windows 10 build 15007

January 19, 2017, 5:14 am

≫ Next: KiServiceTable from windows 10 build 15007 x64

≪ Previous: KiServiceTable from windows 10 build 14986

KiServiceLimit .eq. 0x1c8

NtAccessCheck
NtWorkerFactoryWorkerReady
NtAcceptConnectPort
NtYieldExecution
NtWriteVirtualMemory
NtWriteRequestData
NtWriteFileGather
NtWriteFile
NtWaitLowEventPair
NtWaitHighEventPair
NtWaitForWorkViaWorkerFactory
NtWaitForSingleObject
NtWaitForMultipleObjects32
NtWaitForMultipleObjects
NtWaitForKeyedEvent
NtWaitForDebugEvent
NtWaitForAlertByThreadId
NtVdmControl
NtUnsubscribeWnfStateChange
NtUpdateWnfStateData
NtUnmapViewOfSection
NtUnmapViewOfSectionEx
NtUnlockVirtualMemory
NtUnlockFile
NtUnloadKeyEx
NtUnloadKey2
NtUnloadKey
NtUnloadDriver
NtUmsThreadYield
NtTranslateFilePath
NtTraceEvent
NtTraceControl
NtThawTransactions
NtThawRegistry
NtTestAlert
NtTerminateThread
NtTerminateProcess
NtTerminateJobObject
NtSystemDebugControl
NtSuspendThread
NtSuspendProcess
NtSubscribeWnfStateChange
NtStopProfile
NtStartProfile
NtSinglePhaseReject
NtSignalAndWaitForSingleObject
NtShutdownWorkerFactory
NtShutdownSystem
NtSetWnfProcessNotificationEvent
NtSetVolumeInformationFile
NtSetValueKey
NtSetUuidSeed
NtSetTimerResolution
NtSetTimerEx
NtSetTimer
NtSetThreadExecutionState
NtSetSystemTime
NtSetSystemPowerState
NtSetSystemInformation
NtSetSystemEnvironmentValueEx
NtSetSystemEnvironmentValue
NtSetSecurityObject
NtSetQuotaInformationFile
NtSetLowWaitHighEventPair
NtSetLowEventPair
NtSetLdtEntries
NtSetIRTimer
NtSetTimer2
NtCancelTimer2
NtSetIoCompletionEx
NtSetIoCompletion
NtSetIntervalProfile
NtSetInformationWorkerFactory
NtSetInformationTransactionManager
NtSetInformationTransaction
NtSetInformationToken
NtSetInformationThread
NtSetInformationResourceManager
NtSetInformationProcess
NtSetInformationObject
NtSetInformationKey
NtSetInformationJobObject
NtSetInformationFile
NtSetInformationEnlistment
NtSetInformationDebugObject
NtSetHighWaitLowEventPair
NtSetHighEventPair
NtSetEventBoostPriority
NtSetEvent
NtSetEaFile
NtSetDriverEntryOrder
NtSetDefaultUILanguage
NtSetDefaultLocale
NtSetDefaultHardErrorPort
NtSetDebugFilterState
NtSetContextThread
NtSetCachedSigningLevel2
NtSetCachedSigningLevel
NtSetBootOptions
NtSetBootEntryOrder
NtSerializeBoot
NtSecureConnectPort
NtSaveMergedKeys
NtSaveKeyEx
NtSaveKey
NtRollforwardTransactionManager
NtRollbackTransaction
NtRollbackEnlistment
NtRollbackComplete
NtRevertContainerImpersonation
NtResumeThread
NtResumeProcess
NtRestoreKey
NtResetWriteWatch
NtResetEvent
NtRequestWaitReplyPort
NtRequestPort
NtReplyWaitReplyPort
NtReplyWaitReceivePortEx
NtReplyWaitReceivePort
NtReplyPort
NtReplacePartitionUnit
NtReplaceKey
NtRenameTransactionManager
NtRenameKey
NtRemoveProcessDebug
NtRemoveIoCompletionEx
NtRemoveIoCompletion
NtReleaseWorkerFactoryWorker
NtReleaseSemaphore
NtReleaseMutant
NtReleaseKeyedEvent
NtRegisterThreadTerminatePort
NtRegisterProtocolAddressInformation
NtRecoverTransactionManager
NtRecoverResourceManager
NtRecoverEnlistment
NtReadVirtualMemory
NtReadRequestData
NtReadOnlyEnlistment
NtReadFileScatter
NtReadFile
NtRaiseHardError
NtRaiseException
NtQueueApcThreadEx
NtQueueApcThread
NtQueryAuxiliaryCounterFrequency
NtQueryWnfStateData
NtQueryWnfStateNameInformation
NtQueryVolumeInformationFile
NtQueryVirtualMemory
NtQueryValueKey
NtQueryTimerResolution
NtQueryTimer
NtQuerySystemTime
NtQuerySystemInformationEx
NtQuerySystemInformation
NtQuerySystemEnvironmentValueEx
NtQuerySystemEnvironmentValue
NtQuerySymbolicLinkObject
NtQuerySemaphore
NtQuerySecurityPolicy
NtQuerySecurityObject
NtQuerySecurityAttributesToken
NtQuerySection
NtQueryQuotaInformationFile
NtQueryPortInformationProcess
NtQueryPerformanceCounter
NtQueryOpenSubKeysEx
NtQueryOpenSubKeys
NtQueryObject
NtQueryMutant
NtQueryMultipleValueKey
NtQueryLicenseValue
NtQueryKey
NtQueryIoCompletion
NtQueryIntervalProfile
NtQueryInstallUILanguage
NtQueryInformationWorkerFactory
NtQueryInformationTransactionManager
NtQueryInformationTransaction
NtQueryInformationToken
NtQueryInformationThread
NtQueryInformationResourceManager
NtQueryInformationProcess
NtQueryInformationPort
NtQueryInformationJobObject
NtQueryInformationFile
NtQueryInformationEnlistment
NtQueryInformationByName
NtQueryInformationAtom
NtQueryFullAttributesFile
NtQueryEvent
NtQueryEaFile
NtQueryDriverEntryOrder
NtQueryDirectoryObject
NtQueryDirectoryFile
NtQueryDefaultUILanguage
NtQueryDefaultLocale
NtQueryDebugFilterState
NtQueryBootOptions
NtQueryBootEntryOrder
NtQueryAttributesFile
NtPulseEvent
NtProtectVirtualMemory
NtPropagationFailed
NtPropagationComplete
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtPrivilegeCheck
NtSetInformationVirtualMemory
NtPrePrepareEnlistment
NtPrePrepareComplete
NtPrepareEnlistment
NtPrepareComplete
NtPowerInformation
NtPlugPlayControl
NtOpenTransactionManager
NtOpenTransaction
NtOpenTimer
NtOpenThreadTokenEx
NtOpenThreadToken
NtOpenThread
NtOpenSymbolicLinkObject
NtOpenSession
NtOpenSemaphore
NtOpenSection
NtOpenResourceManager
NtOpenPartition
NtOpenProcessTokenEx
NtOpenProcessToken
NtOpenProcess
NtOpenPrivateNamespace
NtOpenObjectAuditAlarm
NtOpenMutant
NtOpenKeyTransactedEx
NtOpenKeyTransacted
NtOpenKeyEx
NtOpenKeyedEvent
NtOpenKey
NtOpenJobObject
NtOpenIoCompletion
NtOpenFile
NtOpenEventPair
NtOpenEvent
NtOpenEnlistment
NtOpenDirectoryObject
NtNotifyChangeSession
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtNotifyChangeDirectoryFile
NtManagePartition
NtModifyDriverEntry
NtModifyBootEntry
NtMapViewOfSection
NtMapUserPhysicalPagesScatter
NtMapUserPhysicalPages
NtMapCMFModule
NtMakeTemporaryObject
NtMakePermanentObject
NtLockVirtualMemory
NtLockRegistryKey
NtLockProductActivationKeys
NtLockFile
NtLoadKeyEx
NtLoadKey2
NtLoadKey
NtLoadHotPatch
NtLoadEnclaveData
NtLoadDriver
NtListenPort
NtIsUILanguageComitted
NtIsSystemResumeAutomatic
NtIsProcessInJob
NtInitiatePowerAction
NtInitializeRegistry
NtInitializeNlsFiles
NtInitializeEnclave
NtImpersonateThread
NtImpersonateClientOfPort
NtImpersonateAnonymousToken
NtGetWriteWatch
NtGetNotificationResourceManager
NtGetNlsSectionPtr
NtGetNextThread
NtGetNextProcess
NtGetMUIRegistryInfo
NtGetDevicePowerState
NtGetCurrentProcessorNumberEx
NtGetCurrentProcessorNumber
NtGetContextThread
NtGetCompleteWnfStateSubscription
NtGetCachedSigningLevel
NtFsControlFile
NtFreezeTransactions
NtFreezeRegistry
NtFreeVirtualMemory
NtFreeUserPhysicalPages
NtFlushWriteBuffer
NtFlushVirtualMemory
NtFlushProcessWriteBuffers
NtFlushKey
NtFlushInstructionCache
NtFlushInstallUILanguage
NtFlushBuffersFile
NtFlushBuffersFileEx
NtFindAtom
NtFilterToken
NtFilterTokenEx
NtFilterBootOption
NtExtendSection
NtEnumerateValueKey
NtEnumerateTransactionObject
NtEnumerateSystemEnvironmentValuesEx
NtEnumerateKey
NtEnumerateDriverEntries
NtEnumerateBootEntries
NtEnableLastKnownGood
NtDuplicateToken
NtDuplicateObject
NtDrawText
NtDisplayString
NtDisableLastKnownGood
NtDeviceIoControlFile
NtDeleteWnfStateName
NtDeleteWnfStateData
NtDeleteValueKey
NtDeletePrivateNamespace
NtDeleteObjectAuditAlarm
NtDeleteKey
NtDeleteFile
NtDeleteDriverEntry
NtDeleteBootEntry
NtDeleteAtom
NtDelayExecution
NtDebugContinue
NtDebugActiveProcess
NtCreatePartition
NtCreateWorkerFactory
NtCreateWnfStateName
NtCreateWaitCompletionPacket
NtCreateWaitablePort
NtCreateUserProcess
NtCreateTransactionManager
NtCreateTransaction
NtCreateToken
NtCreateLowBoxToken
NtCreateTokenEx
NtCreateTimer
NtCreateThreadEx
NtCreateThread
NtCreateSymbolicLinkObject
NtCreateSemaphore
NtCreateSection
NtCreateResourceManager
NtCreateProfileEx
NtCreateProfile
NtCreateProcessEx
NtCreateProcess
NtCreatePrivateNamespace
NtCreatePort
NtCreatePagingFile
NtCreateNamedPipeFile
NtCreateMutant
NtCreateMailslotFile
NtCreateKeyTransacted
NtCreateKeyedEvent
NtCreateKey
NtCreateJobSet
NtCreateJobObject
NtCreateIRTimer
NtCreateTimer2
NtCreateIoCompletion
NtCreateFile
NtCreateEventPair
NtCreateEvent
NtCreateEnlistment
NtCreateEnclave
NtCreateDirectoryObjectEx
NtCreateDirectoryObject
NtCreateDebugObject
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
NtContinue
NtConnectPort
NtCompressKey
NtCompleteConnectPort
NtCompareTokens
NtCompareSigningLevels
NtCompareObjects
NtCompactKeys
NtCommitTransaction
NtCommitEnlistment
NtCommitComplete
NtCloseObjectAuditAlarm
NtClose
NtClearEvent
NtCancelWaitCompletionPacket
NtCancelTimer
NtCancelSynchronousIoFile
NtCancelIoFileEx
NtCancelIoFile
NtCallbackReturn
NtAssociateWaitCompletionPacket
NtAssignProcessToJobObject
NtAreMappedFilesTheSame
NtApphelpCacheControl
NtAlpcSetInformation
NtAlpcSendWaitReceivePort
NtAlpcRevokeSecurityContext
NtAlpcQueryInformationMessage
NtAlpcQueryInformation
NtAlpcOpenSenderThread
NtAlpcOpenSenderProcess
NtAlpcImpersonateClientOfPort
NtAlpcImpersonateClientContainerOfPort
NtAlpcDisconnectPort
NtAlpcDeleteSecurityContext
NtAlpcDeleteSectionView
NtAlpcDeleteResourceReserve
NtAlpcDeletePortSection
NtAlpcCreateSecurityContext
NtAlpcCreateSectionView
NtAlpcCreateResourceReserve
NtAlpcCreatePortSection
NtAlpcCreatePort
NtAlpcConnectPort
NtAlpcConnectPortEx
NtAlpcCancelMessage
NtAlpcAcceptConnectPort
NtAllocateVirtualMemory
NtAllocateUuids
NtAllocateUserPhysicalPages
NtAllocateReserveObject
NtAllocateLocallyUniqueId
NtAlertThreadByThreadId
NtAlertThread
NtAlertResumeThread
NtAdjustPrivilegesToken
NtAdjustGroupsToken
NtAdjustTokenClaimsAndDeviceGroups
NtAddDriverEntry
NtAddBootEntry
NtAddAtom
NtAddAtomEx
NtAcquireProcessActivityReference
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultList
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByType
NtAccessCheckAndAuditAlarm
NtSetInformationSymbolicLink
NtCreateRegistryTransaction
NtOpenRegistryTransaction
NtCommitRegistryTransaction
NtRollbackRegistryTransaction

↧

KiServiceTable from windows 10 build 15007 x64

January 19, 2017, 5:22 am

≫ Next: apisetschema.dll from windows 10 build 15025

≪ Previous: KiServiceTable from windows 10 build 15007

KiServiceLimit .eq. 0x1c8

NtAccessCheck
NtWorkerFactoryWorkerReady
NtAcceptConnectPort
NtMapUserPhysicalPagesScatter
NtWaitForSingleObject
NtCallbackReturn
NtReadFile
NtDeviceIoControlFile
NtWriteFile
NtRemoveIoCompletion
NtReleaseSemaphore
NtReplyWaitReceivePort
NtReplyPort
NtSetInformationThread
NtSetEvent
NtClose
NtQueryObject
NtQueryInformationFile
NtOpenKey
NtEnumerateValueKey
NtFindAtom
NtQueryDefaultLocale
NtQueryKey
NtQueryValueKey
NtAllocateVirtualMemory
NtQueryInformationProcess
NtWaitForMultipleObjects32
NtWriteFileGather
NtSetInformationProcess
NtCreateKey
NtFreeVirtualMemory
NtImpersonateClientOfPort
NtReleaseMutant
NtQueryInformationToken
NtRequestWaitReplyPort
NtQueryVirtualMemory
NtOpenThreadToken
NtQueryInformationThread
NtOpenProcess
NtSetInformationFile
NtMapViewOfSection
NtAccessCheckAndAuditAlarm
NtUnmapViewOfSection
NtReplyWaitReceivePortEx
NtTerminateProcess
NtSetEventBoostPriority
NtReadFileScatter
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtQueryPerformanceCounter
NtEnumerateKey
NtOpenFile
NtDelayExecution
NtQueryDirectoryFile
NtQuerySystemInformation
NtOpenSection
NtQueryTimer
NtFsControlFile
NtWriteVirtualMemory
NtCloseObjectAuditAlarm
NtDuplicateObject
NtQueryAttributesFile
NtClearEvent
NtReadVirtualMemory
NtOpenEvent
NtAdjustPrivilegesToken
NtDuplicateToken
NtContinue
NtQueryDefaultUILanguage
NtQueueApcThread
NtYieldExecution
NtAddAtom
NtCreateEvent
NtQueryVolumeInformationFile
NtCreateSection
NtFlushBuffersFile
NtApphelpCacheControl
NtCreateProcessEx
NtCreateThread
NtIsProcessInJob
NtProtectVirtualMemory
NtQuerySection
NtResumeThread
NtTerminateThread
NtReadRequestData
NtCreateFile
NtQueryEvent
NtWriteRequestData
NtOpenDirectoryObject
NtAccessCheckByTypeAndAuditAlarm
NtQuerySystemTime
NtWaitForMultipleObjects
NtSetInformationObject
NtCancelIoFile
NtTraceEvent
NtPowerInformation
NtSetValueKey
NtCancelTimer
NtSetTimer
NtAccessCheckByType
NtAccessCheckByTypeResultList
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtAcquireProcessActivityReference
NtAddAtomEx
NtAddBootEntry
NtAddDriverEntry
NtAdjustGroupsToken
NtAdjustTokenClaimsAndDeviceGroups
NtAlertResumeThread
NtAlertThread
NtAlertThreadByThreadId
NtAllocateLocallyUniqueId
NtAllocateReserveObject
NtAllocateUserPhysicalPages
NtAllocateUuids
NtAlpcAcceptConnectPort
NtAlpcCancelMessage
NtAlpcConnectPort
NtAlpcConnectPortEx
NtAlpcCreatePort
NtAlpcCreatePortSection
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtAlpcCreateSecurityContext
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
NtAlpcDeleteSectionView
NtAlpcDeleteSecurityContext
NtAlpcDisconnectPort
NtAlpcImpersonateClientContainerOfPort
NtAlpcImpersonateClientOfPort
NtAlpcOpenSenderProcess
NtAlpcOpenSenderThread
NtAlpcQueryInformation
NtAlpcQueryInformationMessage
NtAlpcRevokeSecurityContext
NtAlpcSendWaitReceivePort
NtAlpcSetInformation
NtAreMappedFilesTheSame
NtAssignProcessToJobObject
NtAssociateWaitCompletionPacket
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtCancelTimer2
NtCancelWaitCompletionPacket
NtCommitComplete
NtCommitEnlistment
NtCommitRegistryTransaction
NtCommitTransaction
NtCompactKeys
NtCompareObjects
NtCompareSigningLevels
NtCompareTokens
NtCompleteConnectPort
NtCompressKey
NtConnectPort
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
NtCreateDebugObject
NtCreateDirectoryObject
NtCreateDirectoryObjectEx
NtCreateEnclave
NtCreateEnlistment
NtCreateEventPair
NtCreateIRTimer
NtCreateIoCompletion
NtCreateJobObject
NtCreateJobSet
NtCreateKeyTransacted
NtCreateKeyedEvent
NtCreateLowBoxToken
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreatePagingFile
NtCreatePartition
NtCreatePort
NtCreatePrivateNamespace
NtCreateProcess
NtCreateProfile
NtCreateProfileEx
NtCreateRegistryTransaction
NtCreateResourceManager
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateThreadEx
NtCreateTimer
NtCreateTimer2
NtCreateToken
NtCreateTokenEx
NtCreateTransaction
NtCreateTransactionManager
NtCreateUserProcess
NtCreateWaitCompletionPacket
NtCreateWaitablePort
NtCreateWnfStateName
NtCreateWorkerFactory
NtDebugActiveProcess
NtDebugContinue
NtDeleteAtom
NtDeleteBootEntry
NtDeleteDriverEntry
NtDeleteFile
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeletePrivateNamespace
NtDeleteValueKey
NtDeleteWnfStateData
NtDeleteWnfStateName
NtDisableLastKnownGood
NtDisplayString
NtDrawText
NtEnableLastKnownGood
NtEnumerateBootEntries
NtEnumerateDriverEntries
NtEnumerateSystemEnvironmentValuesEx
NtEnumerateTransactionObject
NtExtendSection
NtFilterBootOption
NtFilterToken
NtFilterTokenEx
NtFlushBuffersFileEx
NtFlushInstallUILanguage
NtFlushInstructionCache
NtFlushKey
NtFlushProcessWriteBuffers
NtFlushVirtualMemory
NtFlushWriteBuffer
NtFreeUserPhysicalPages
NtFreezeRegistry
NtFreezeTransactions
NtGetCachedSigningLevel
NtGetCompleteWnfStateSubscription
NtGetContextThread
NtGetCurrentProcessorNumber
NtGetCurrentProcessorNumberEx
NtGetDevicePowerState
NtGetMUIRegistryInfo
NtGetNextProcess
NtGetNextThread
NtGetNlsSectionPtr
NtGetNotificationResourceManager
NtGetWriteWatch
NtImpersonateAnonymousToken
NtImpersonateThread
NtInitializeEnclave
NtInitializeNlsFiles
NtInitializeRegistry
NtInitiatePowerAction
NtIsSystemResumeAutomatic
NtIsUILanguageComitted
NtListenPort
NtLoadDriver
NtLoadEnclaveData
NtLoadHotPatch
NtLoadKey
NtLoadKey2
NtLoadKeyEx
NtLockFile
NtLockProductActivationKeys
NtLockRegistryKey
NtLockVirtualMemory
NtMakePermanentObject
NtMakeTemporaryObject
NtManagePartition
NtMapCMFModule
NtMapUserPhysicalPages
NtModifyBootEntry
NtModifyDriverEntry
NtNotifyChangeDirectoryFile
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtNotifyChangeSession
NtOpenEnlistment
NtOpenEventPair
NtOpenIoCompletion
NtOpenJobObject
NtOpenKeyEx
NtOpenKeyTransacted
NtOpenKeyTransactedEx
NtOpenKeyedEvent
NtOpenMutant
NtOpenObjectAuditAlarm
NtOpenPartition
NtOpenPrivateNamespace
NtOpenProcessToken
NtOpenRegistryTransaction
NtOpenResourceManager
NtOpenSemaphore
NtOpenSession
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenTimer
NtOpenTransaction
NtOpenTransactionManager
NtPlugPlayControl
NtPrePrepareComplete
NtPrePrepareEnlistment
NtPrepareComplete
NtPrepareEnlistment
NtPrivilegeCheck
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtPropagationComplete
NtPropagationFailed
NtPulseEvent
NtQueryAuxiliaryCounterFrequency
NtQueryBootEntryOrder
NtQueryBootOptions
NtQueryDebugFilterState
NtQueryDirectoryObject
NtQueryDriverEntryOrder
NtQueryEaFile
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationByName
NtQueryInformationEnlistment
NtQueryInformationJobObject
NtQueryInformationPort
NtQueryInformationResourceManager
NtQueryInformationTransaction
NtQueryInformationTransactionManager
NtQueryInformationWorkerFactory
NtQueryInstallUILanguage
NtQueryIntervalProfile
NtQueryIoCompletion
NtQueryLicenseValue
NtQueryMultipleValueKey
NtQueryMutant
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtQueryPortInformationProcess
NtQueryQuotaInformationFile
NtQuerySecurityAttributesToken
NtQuerySecurityObject
NtQuerySecurityPolicy
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQuerySystemEnvironmentValue
NtQuerySystemEnvironmentValueEx
NtQuerySystemInformationEx
NtQueryTimerResolution
NtQueryWnfStateData
NtQueryWnfStateNameInformation
NtQueueApcThreadEx
NtRaiseException
NtRaiseHardError
NtReadOnlyEnlistment
NtRecoverEnlistment
NtRecoverResourceManager
NtRecoverTransactionManager
NtRegisterProtocolAddressInformation
NtRegisterThreadTerminatePort
NtReleaseKeyedEvent
NtReleaseWorkerFactoryWorker
NtRemoveIoCompletionEx
NtRemoveProcessDebug
NtRenameKey
NtRenameTransactionManager
NtReplaceKey
NtReplacePartitionUnit
NtReplyWaitReplyPort
NtRequestPort
NtResetEvent
NtResetWriteWatch
NtRestoreKey
NtResumeProcess
NtRevertContainerImpersonation
NtRollbackComplete
NtRollbackEnlistment
NtRollbackRegistryTransaction
NtRollbackTransaction
NtRollforwardTransactionManager
NtSaveKey
NtSaveKeyEx
NtSaveMergedKeys
NtSecureConnectPort
NtSerializeBoot
NtSetBootEntryOrder
NtSetBootOptions
NtSetCachedSigningLevel
NtSetCachedSigningLevel2
NtSetContextThread
NtSetDebugFilterState
NtSetDefaultHardErrorPort
NtSetDefaultLocale
NtSetDefaultUILanguage
NtSetDriverEntryOrder
NtSetEaFile
NtSetHighEventPair
NtSetHighWaitLowEventPair
NtSetIRTimer
NtSetInformationDebugObject
NtSetInformationEnlistment
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationResourceManager
NtSetInformationSymbolicLink
NtSetInformationToken
NtSetInformationTransaction
NtSetInformationTransactionManager
NtSetInformationVirtualMemory
NtSetInformationWorkerFactory
NtSetIntervalProfile
NtSetIoCompletion
NtSetIoCompletionEx
NtSetLdtEntries
NtSetLowEventPair
NtSetLowWaitHighEventPair
NtSetQuotaInformationFile
NtSetSecurityObject
NtSetSystemEnvironmentValue
NtSetSystemEnvironmentValueEx
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer2
NtSetTimerEx
NtSetTimerResolution
NtSetUuidSeed
NtSetVolumeInformationFile
NtSetWnfProcessNotificationEvent
NtShutdownSystem
NtShutdownWorkerFactory
NtSignalAndWaitForSingleObject
NtSinglePhaseReject
NtStartProfile
NtStopProfile
NtSubscribeWnfStateChange
NtSuspendProcess
NtSuspendThread
NtSystemDebugControl
NtTerminateJobObject
NtTestAlert
NtThawRegistry
NtThawTransactions
NtTraceControl
NtTranslateFilePath
NtUmsThreadYield
NtUnloadDriver
NtUnloadKey
NtUnloadKey2
NtUnloadKeyEx
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSectionEx
NtUnsubscribeWnfStateChange
NtUpdateWnfStateData
NtVdmControl
NtWaitForAlertByThreadId
NtWaitForDebugEvent
NtWaitForKeyedEvent
NtWaitForWorkViaWorkerFactory
NtWaitHighEventPair
NtWaitLowEventPair

↧

apisetschema.dll from windows 10 build 15025

February 7, 2017, 8:56 am

≫ Next: IMAGE_DYNAMIC_RELOCATION_TABLE.Version 2

≪ Previous: KiServiceTable from windows 10 build 15007 x64

lots of new modules was added:

win-core-registry-fromapp
win-gaming-expandedresources
win-gaming-gamemonitor
win-ngc-serialization
win-security-isolatedcontainer
win-shcore-path
onecore-appmodel-tdlmigration
onecore-hcap-svf
onecore-hnetcfg
onecore-mpc-input
onecore-shlwapi
onecore-spectrumsyncclient
win-adsi-activeds
win-appcompat-aepic
win-appmodel-restrictedappcontainer-internal
win-audiocore-spatial
win-base-rstrtmgr
win-core-iuri
win-core-winsrv
win-deployment-productenumerator
win-dx-dinput8
win-eventing-pdh
win-fs-cscapi
win-gaming-gamechatoverlay
win-gdi-gdiplus
win-hyperv-compute
win-kernel32-process
win-kioskmode-config
win-mapi-mapi32
win-mininput-inputhost
win-mm-wmvcore
win-net-netbios
win-net-netshell
win-net-nfdapi
win-nfc-semgr
win-ntuser-rawinput
win-odbc-odbc32
win-parentalcontrols-setup
win-resources-deployment
win-rtcore-ntuser-winevent
win-security-appinfoext
win-security-certpoleng
win-security-slc
win-shell-aclui
win-shell-comctl32
win-shell-efsadu
win-shell-ntshrui
win-shell-shdocvw
win-wnv

api-ms-onecoreuap-print-render-l1-1-0	printrenderapihost.dll
api-ms-onecoreuap-settingsync-status-l1-1-0	settingsynccore.dll
api-ms-win-appmodel-identity-l1-2-0	kernel.appcore.dll
api-ms-win-appmodel-runtime-internal-l1-1-4	kernel.appcore.dll
api-ms-win-appmodel-runtime-l1-1-2	kernel.appcore.dll
api-ms-win-appmodel-state-l1-1-2	kernel.appcore.dll
api-ms-win-appmodel-state-l1-2-0	kernel.appcore.dll
api-ms-win-appmodel-unlock-l1-1-0	kernel.appcore.dll
api-ms-win-base-bootconfig-l1-1-0	advapi32.dll
api-ms-win-base-util-l1-1-0	advapi32.dll
api-ms-win-composition-redirection-l1-1-0	dwmredir.dll
api-ms-win-composition-windowmanager-l1-1-0	udwm.dll
api-ms-win-core-apiquery-l1-1-0	ntdll.dll
api-ms-win-core-appcompat-l1-1-1	kernelbase.dll
api-ms-win-core-appinit-l1-1-0	kernel32.dll	kernelbase.dll
api-ms-win-core-atoms-l1-1-0	kernel32.dll
api-ms-win-core-bicltapi-l1-1-4	bi.dll
api-ms-win-core-biplmapi-l1-1-5	twinapi.appcore.dll
api-ms-win-core-biptcltapi-l1-1-5	twinapi.appcore.dll
api-ms-win-core-calendar-l1-1-0	kernel32.dll
api-ms-win-core-com-l1-1-2	combase.dll
api-ms-win-core-com-l2-1-1	coml2.dll
api-ms-win-core-com-midlproxystub-l1-1-0	combase.dll
api-ms-win-core-com-private-l1-1-1	combase.dll
api-ms-win-core-comm-l1-1-0	kernelbase.dll
api-ms-win-core-console-ansi-l2-1-0	kernel32.dll
api-ms-win-core-console-l1-1-0	kernelbase.dll
api-ms-win-core-console-l2-1-0	kernelbase.dll
api-ms-win-core-console-l3-1-0	kernelbase.dll
api-ms-win-core-crt-l1-1-0	ntdll.dll
api-ms-win-core-crt-l2-1-0	kernelbase.dll
api-ms-win-core-datetime-l1-1-2	kernelbase.dll
api-ms-win-core-debug-l1-1-2	kernelbase.dll
api-ms-win-core-debug-minidump-l1-1-0	dbgcore.dll
api-ms-win-core-delayload-l1-1-1	kernelbase.dll
api-ms-win-core-enclave-l1-1-0	kernelbase.dll
api-ms-win-core-errorhandling-l1-1-3	kernelbase.dll
api-ms-win-core-featurestaging-l1-1-1	shcore.dll
api-ms-win-core-fibers-l1-1-1	kernelbase.dll
api-ms-win-core-fibers-l2-1-1	kernelbase.dll
api-ms-win-core-file-ansi-l1-1-0	kernel32.dll
api-ms-win-core-file-ansi-l2-1-0	kernel32.dll
api-ms-win-core-file-l1-1-1	kernelbase.dll
api-ms-win-core-file-l1-2-2	kernelbase.dll
api-ms-win-core-file-l2-1-2	kernelbase.dll
api-ms-win-core-firmware-l1-1-0	kernel32.dll
api-ms-win-core-guard-l1-1-0	kernelbase.dll
api-ms-win-core-handle-l1-1-0	kernelbase.dll
api-ms-win-core-heap-l1-1-0	kernelbase.dll
api-ms-win-core-heap-l1-2-0	kernelbase.dll
api-ms-win-core-heap-l2-1-0	kernelbase.dll
api-ms-win-core-heap-obsolete-l1-1-0	kernel32.dll
api-ms-win-core-interlocked-l1-1-1	kernelbase.dll
api-ms-win-core-interlocked-l1-2-0	kernelbase.dll
api-ms-win-core-io-l1-1-1	kernel32.dll	kernelbase.dll
api-ms-win-core-job-l1-1-0	kernelbase.dll
api-ms-win-core-job-l2-1-1	kernel32.dll
api-ms-win-core-kernel32-legacy-ansi-l1-1-0	kernel32.dll
api-ms-win-core-kernel32-legacy-l1-1-5	kernel32.dll
api-ms-win-core-kernel32-private-l1-1-2	kernel32.dll
api-ms-win-core-largeinteger-l1-1-0	kernelbase.dll
api-ms-win-core-libraryloader-l1-1-1	kernelbase.dll
api-ms-win-core-libraryloader-l1-2-2	kernelbase.dll
api-ms-win-core-libraryloader-l2-1-0	kernelbase.dll
api-ms-win-core-libraryloader-private-l1-1-0	kernelbase.dll
api-ms-win-core-localization-ansi-l1-1-0	kernel32.dll
api-ms-win-core-localization-l1-1-0	kernelbase.dll
api-ms-win-core-localization-l1-2-2	kernelbase.dll
api-ms-win-core-localization-l2-1-0	kernelbase.dll
api-ms-win-core-localization-obsolete-l1-1-0	kernelbase.dll
api-ms-win-core-localization-obsolete-l1-2-0	kernelbase.dll
api-ms-win-core-localization-obsolete-l1-3-0	kernelbase.dll
api-ms-win-core-localization-private-l1-1-0	kernelbase.dll
api-ms-win-core-localregistry-l1-1-0	kernelbase.dll
api-ms-win-core-marshal-l1-1-0	combase.dll
api-ms-win-core-memory-l1-1-4	kernelbase.dll
api-ms-win-core-misc-l1-1-0	kernelbase.dll
api-ms-win-core-multipleproviderrouter-l1-1-0	mpr.dll
api-ms-win-core-namedpipe-ansi-l1-1-1	kernel32.dll
api-ms-win-core-namedpipe-l1-1-0	kernelbase.dll
api-ms-win-core-namedpipe-l1-2-2	kernelbase.dll
api-ms-win-core-namespace-ansi-l1-1-0	kernel32.dll
api-ms-win-core-namespace-l1-1-0	kernelbase.dll
api-ms-win-core-normalization-l1-1-0	kernelbase.dll
api-ms-win-core-path-l1-1-0	kernelbase.dll
api-ms-win-core-perfcounters-l1-1-0	kernelbase.dll
api-ms-win-core-privateprofile-l1-1-1	kernel32.dll
api-ms-win-core-processenvironment-ansi-l1-1-0	kernel32.dll
api-ms-win-core-processenvironment-l1-1-1	kernelbase.dll
api-ms-win-core-processenvironment-l1-2-0	kernelbase.dll
api-ms-win-core-processsecurity-l1-1-0	kernel32.dll	kernelbase.dll
api-ms-win-core-processsnapshot-l1-1-0	kernelbase.dll
api-ms-win-core-processthreads-l1-1-3	kernel32.dll	kernelbase.dll
api-ms-win-core-processtopology-l1-1-0	kernelbase.dll
api-ms-win-core-processtopology-l1-2-0	kernelbase.dll
api-ms-win-core-processtopology-obsolete-l1-1-1	kernel32.dll
api-ms-win-core-processtopology-private-l1-1-0	kernelbase.dll
api-ms-win-core-profile-l1-1-0	kernelbase.dll
api-ms-win-core-psapi-ansi-l1-1-0	kernelbase.dll
api-ms-win-core-psapi-l1-1-0	kernelbase.dll
api-ms-win-core-psapi-obsolete-l1-1-0	kernelbase.dll
api-ms-win-core-psapiansi-l1-1-0	kernelbase.dll
api-ms-win-core-psm-app-l1-1-0	twinapi.appcore.dll
api-ms-win-core-psm-appnotify-l1-1-0	twinapi.appcore.dll
api-ms-win-core-psm-info-l1-1-1	appsruprov.dll
api-ms-win-core-psm-key-l1-1-1	kernelbase.dll
api-ms-win-core-psm-plm-l1-1-3	twinapi.appcore.dll
api-ms-win-core-psm-plm-l1-2-0	twinapi.appcore.dll
api-ms-win-core-psm-rtimer-l1-1-1	twinapi.appcore.dll
api-ms-win-core-psm-tc-l1-1-1	twinapi.appcore.dll
api-ms-win-core-quirks-l1-1-1	kernelbase.dll
api-ms-win-core-realtime-l1-1-2	kernelbase.dll
api-ms-win-core-registry-fromapp-l1-1-0	reguwpapi.dll
api-ms-win-core-registry-l1-1-1	kernelbase.dll
api-ms-win-core-registry-l2-1-0	advapi32.dll
api-ms-win-core-registry-l2-2-0	advapi32.dll
api-ms-win-core-registry-private-l1-1-0	advapi32.dll
api-ms-win-core-registryuserspecific-l1-1-0	kernelbase.dll
api-ms-win-core-rtlsupport-l1-1-1	ntdll.dll
api-ms-win-core-rtlsupport-l1-2-0	ntdll.dll
api-ms-win-core-shlwapi-legacy-l1-1-0	kernelbase.dll
api-ms-win-core-shlwapi-obsolete-l1-1-0	kernelbase.dll
api-ms-win-core-shlwapi-obsolete-l1-2-0	kernelbase.dll
api-ms-win-core-shutdown-ansi-l1-1-0	advapi32.dll
api-ms-win-core-shutdown-l1-1-1	advapi32.dll
api-ms-win-core-sidebyside-ansi-l1-1-0	kernel32.dll
api-ms-win-core-sidebyside-l1-1-0	kernelbase.dll
api-ms-win-core-slapi-l1-1-0	clipc.dll
api-ms-win-core-string-l1-1-0	kernelbase.dll
api-ms-win-core-string-l2-1-1	kernelbase.dll
api-ms-win-core-string-obsolete-l1-1-1	kernel32.dll
api-ms-win-core-stringansi-l1-1-0	kernelbase.dll
api-ms-win-core-stringloader-l1-1-1	kernelbase.dll
api-ms-win-core-synch-ansi-l1-1-0	kernel32.dll
api-ms-win-core-synch-l1-1-1	kernelbase.dll
api-ms-win-core-synch-l1-2-1	kernelbase.dll
api-ms-win-core-sysinfo-l1-1-1	kernelbase.dll
api-ms-win-core-sysinfo-l1-2-3	kernelbase.dll
api-ms-win-core-sysinfo-l2-1-0	advapi32.dll
api-ms-win-core-systemtopology-l1-1-1	kernelbase.dll
api-ms-win-core-textinput-client-l1-1-0	textinputframework.dll
api-ms-win-core-threadpool-l1-1-0	kernelbase.dll
api-ms-win-core-threadpool-l1-2-0	kernelbase.dll
api-ms-win-core-threadpool-legacy-l1-1-0	kernelbase.dll
api-ms-win-core-threadpool-private-l1-1-0	kernelbase.dll
api-ms-win-core-timezone-l1-1-0	kernelbase.dll
api-ms-win-core-timezone-private-l1-1-0	kernelbase.dll
api-ms-win-core-toolhelp-l1-1-1	kernel32.dll
api-ms-win-core-ums-l1-1-0	kernel32.dll
api-ms-win-core-url-l1-1-0	kernelbase.dll
api-ms-win-core-util-l1-1-1	kernel32.dll	kernelbase.dll
api-ms-win-core-version-l1-1-1	kernelbase.dll
api-ms-win-core-version-private-l1-1-0	kernelbase.dll
api-ms-win-core-versionansi-l1-1-1	kernelbase.dll
api-ms-win-core-windowsceip-l1-1-0	kernelbase.dll
api-ms-win-core-windowserrorreporting-l1-1-1	kernelbase.dll
api-ms-win-core-winrt-error-l1-1-1	combase.dll
api-ms-win-core-winrt-errorprivate-l1-1-1	combase.dll
api-ms-win-core-winrt-l1-1-0	combase.dll
api-ms-win-core-winrt-propertysetprivate-l1-1-1	wintypes.dll
api-ms-win-core-winrt-registration-l1-1-0	combase.dll
api-ms-win-core-winrt-robuffer-l1-1-0	wintypes.dll
api-ms-win-core-winrt-roparameterizediid-l1-1-0	combase.dll
api-ms-win-core-winrt-string-l1-1-1	combase.dll
api-ms-win-core-wow64-l1-1-1	kernelbase.dll
api-ms-win-core-xstate-l1-1-2	ntdll.dll
api-ms-win-core-xstate-l2-1-0	kernelbase.dll
api-ms-win-crt-conio-l1-1-0	ucrtbase.dll
api-ms-win-crt-convert-l1-1-0	ucrtbase.dll
api-ms-win-crt-environment-l1-1-0	ucrtbase.dll
api-ms-win-crt-filesystem-l1-1-0	ucrtbase.dll
api-ms-win-crt-heap-l1-1-0	ucrtbase.dll
api-ms-win-crt-locale-l1-1-0	ucrtbase.dll
api-ms-win-crt-math-l1-1-0	ucrtbase.dll
api-ms-win-crt-multibyte-l1-1-0	ucrtbase.dll
api-ms-win-crt-private-l1-1-0	ucrtbase.dll
api-ms-win-crt-process-l1-1-0	ucrtbase.dll
api-ms-win-crt-runtime-l1-1-0	ucrtbase.dll
api-ms-win-crt-stdio-l1-1-0	ucrtbase.dll
api-ms-win-crt-string-l1-1-0	ucrtbase.dll
api-ms-win-crt-time-l1-1-0	ucrtbase.dll
api-ms-win-crt-utility-l1-1-0	ucrtbase.dll
api-ms-win-deprecated-apis-obsolete-l1-1-0	kernelbase.dll
api-ms-win-devices-config-l1-1-1	cfgmgr32.dll
api-ms-win-devices-query-l1-1-1	cfgmgr32.dll
api-ms-win-devices-swdevice-l1-1-1	cfgmgr32.dll
api-ms-win-downlevel-advapi32-l1-1-1	kernelbase.dll
api-ms-win-downlevel-advapi32-l2-1-1	sechost.dll
api-ms-win-downlevel-advapi32-l3-1-0	ntmarta.dll
api-ms-win-downlevel-advapi32-l4-1-0	advapi32.dll
api-ms-win-downlevel-kernel32-l1-1-0	kernelbase.dll
api-ms-win-downlevel-kernel32-l2-1-0	kernel32.dll
api-ms-win-downlevel-normaliz-l1-1-0	kernelbase.dll
api-ms-win-downlevel-ole32-l1-1-1	combase.dll
api-ms-win-downlevel-shell32-l1-1-0	shcore.dll
api-ms-win-downlevel-shlwapi-l1-1-1	kernelbase.dll
api-ms-win-downlevel-shlwapi-l2-1-1	shcore.dll
api-ms-win-downlevel-user32-l1-1-1	kernelbase.dll
api-ms-win-downlevel-version-l1-1-0	kernelbase.dll
api-ms-win-dwmapi-l1-1-0	dwmapi.dll
api-ms-win-dx-d3dkmt-l1-1-3	gdi32.dll
api-ms-win-eventing-classicprovider-l1-1-0	kernelbase.dll
api-ms-win-eventing-consumer-l1-1-0	sechost.dll
api-ms-win-eventing-controller-l1-1-0	sechost.dll
api-ms-win-eventing-legacy-l1-1-0	advapi32.dll
api-ms-win-eventing-obsolete-l1-1-0	sechost.dll
api-ms-win-eventing-provider-l1-1-0	kernelbase.dll
api-ms-win-eventing-tdh-l1-1-0	tdh.dll	mintdh.dll
api-ms-win-eventlog-legacy-l1-1-0	advapi32.dll
api-ms-win-eventlog-private-l1-1-0	advapi32.dll
api-ms-win-gaming-expandedresources-l1-1-0	gamemode.dll
api-ms-win-gaming-gamemonitor-l1-1-0	gamemonitor.dll
api-ms-win-gaming-tcui-l1-1-3	gamingtcui.dll
api-ms-win-gdi-dpiinfo-l1-1-0	gdi32.dll
api-ms-win-gdi-internal-uap-l1-1-0	gdi32full.dll
api-ms-win-http-time-l1-1-0	kernelbase.dll
api-ms-win-legacy-shlwapi-l1-1-0	kernelbase.dll
api-ms-win-mm-joystick-l1-1-0	winmmbase.dll
api-ms-win-mm-mci-l1-1-0	winmm.dll
api-ms-win-mm-misc-l1-1-1	winmmbase.dll
api-ms-win-mm-misc-l2-1-0	winmm.dll
api-ms-win-mm-mme-l1-1-0	winmmbase.dll
api-ms-win-mm-playsound-l1-1-0	winmm.dll
api-ms-win-mm-time-l1-1-0	kernel32.dll
api-ms-win-net-isolation-l1-1-1	firewallapi.dll
api-ms-win-networking-interfacecontexts-l1-1-0	ondemandconnroutehelper.dll
api-ms-win-ngc-serialization-l1-1-0	ngckeyenum.dll
api-ms-win-ntuser-ie-message-l1-1-0	user32.dll
api-ms-win-ntuser-ie-window-l1-1-0	user32.dll
api-ms-win-ntuser-ie-wmpointer-l1-1-0	user32.dll
api-ms-win-ntuser-rectangle-l1-1-0	user32.dll
api-ms-win-ntuser-sysparams-l1-1-0	user32.dll
api-ms-win-obsolete-localization-l1-1-0	kernelbase.dll
api-ms-win-obsolete-psapi-l1-1-0	kernelbase.dll
api-ms-win-obsolete-shlwapi-l1-1-0	kernelbase.dll
api-ms-win-ole32-ie-l1-1-0	ole32.dll
api-ms-win-oobe-notification-l1-1-0	kernel32.dll
api-ms-win-perf-legacy-l1-1-0	advapi32.dll
api-ms-win-power-base-l1-1-0	powrprof.dll
api-ms-win-power-limitsmanagement-l1-1-0	powrprof.dll
api-ms-win-power-setting-l1-1-0	powrprof.dll
api-ms-win-ro-typeresolution-l1-1-0	wintypes.dll
api-ms-win-rtcore-ntuser-clipboard-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-draw-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-private-l1-1-5	user32.dll
api-ms-win-rtcore-ntuser-shell-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-synch-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-window-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-winevent-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-wmpointer-l1-1-3	user32.dll
api-ms-win-rtcore-ole32-clipboard-l1-1-1	ole32.dll
api-ms-win-security-accesshlpr-l1-1-0	sechost.dll
api-ms-win-security-activedirectoryclient-l1-1-1	kernelbase.dll
api-ms-win-security-appcontainer-l1-1-0	kernelbase.dll
api-ms-win-security-audit-l1-1-1	sechost.dll
api-ms-win-security-base-ansi-l1-1-0	advapi32.dll
api-ms-win-security-base-l1-1-1	kernelbase.dll
api-ms-win-security-base-l1-2-2	kernelbase.dll
api-ms-win-security-base-private-l1-1-1	kernelbase.dll
api-ms-win-security-capability-l1-1-0	sechost.dll
api-ms-win-security-cpwl-l1-1-0	advapi32.dll
api-ms-win-security-credentials-l1-1-0	sechost.dll
api-ms-win-security-credentials-l2-1-0	sechost.dll
api-ms-win-security-cryptoapi-l1-1-0	cryptsp.dll
api-ms-win-security-grouppolicy-l1-1-0	kernelbase.dll
api-ms-win-security-isolatedcontainer-l1-1-0	shcore.dll
api-ms-win-security-logon-l1-1-1	advapi32.dll
api-ms-win-security-lsalookup-ansi-l2-1-0	advapi32.dll
api-ms-win-security-lsalookup-l1-1-2	sechost.dll
api-ms-win-security-lsalookup-l2-1-1	advapi32.dll
api-ms-win-security-lsapolicy-l1-1-1	sechost.dll
api-ms-win-security-provider-ansi-l1-1-0	advapi32.dll
api-ms-win-security-provider-l1-1-0	ntmarta.dll
api-ms-win-security-sddl-ansi-l1-1-0	advapi32.dll
api-ms-win-security-sddl-l1-1-0	sechost.dll
api-ms-win-security-sddlparsecond-l1-1-0	sechost.dll
api-ms-win-security-systemfunctions-l1-1-0	advapi32.dll
api-ms-win-security-trustee-l1-1-1	advapi32.dll
api-ms-win-service-core-ansi-l1-1-1	advapi32.dll
api-ms-win-service-core-l1-1-2	sechost.dll
api-ms-win-service-management-l1-1-0	sechost.dll
api-ms-win-service-management-l2-1-0	sechost.dll
api-ms-win-service-private-l1-1-3	sechost.dll
api-ms-win-service-winsvc-l1-1-0	sechost.dll
api-ms-win-service-winsvc-l1-2-0	sechost.dll
api-ms-win-shcore-comhelpers-l1-1-0	shcore.dll
api-ms-win-shcore-obsolete-l1-1-0	shcore.dll
api-ms-win-shcore-path-l1-1-0	shcore.dll
api-ms-win-shcore-registry-l1-1-1	shcore.dll
api-ms-win-shcore-scaling-l1-1-2	shcore.dll
api-ms-win-shcore-stream-l1-1-0	shcore.dll
api-ms-win-shcore-stream-winrt-l1-1-0	shcore.dll
api-ms-win-shcore-sysinfo-l1-1-0	shcore.dll
api-ms-win-shcore-thread-l1-1-0	shcore.dll
api-ms-win-shcore-unicodeansi-l1-1-0	shcore.dll
api-ms-win-shell-associations-l1-1-0	windows.storage.dll
api-ms-win-shell-changenotify-l1-1-0	windows.storage.dll
api-ms-win-shell-dataobject-l1-1-0	windows.storage.dll
api-ms-win-shell-namespace-l1-1-0	windows.storage.dll
api-ms-win-shell-shdirectory-l1-1-0	shcore.dll
api-ms-win-shell-shellcom-l1-1-0	kernelbase.dll
api-ms-win-shell-shellfolders-l1-1-0	windows.storage.dll
api-ms-win-shlwapi-ie-l1-1-0	shlwapi.dll
api-ms-win-shlwapi-winrt-storage-l1-1-1	shlwapi.dll
api-ms-win-storage-exports-external-l1-1-0	windows.storage.dll
api-ms-win-storage-exports-internal-l1-1-0	windows.storage.dll
api-ms-win-winrt-search-folder-l1-1-0	windows.storage.search.dll
ext-ms-net-eap-sim-l1-1-0	eapsimextdesktop.dll
ext-ms-net-vpn-soh-l1-1-0	vpnsohdesktop.dll
ext-ms-onecore-appdefaults-l1-1-0	windows.storage.dll
ext-ms-onecore-appmodel-plm-l1-1-1	execmodelclient.dll
ext-ms-onecore-appmodel-staterepository-internal-l1-1-0	windows.staterepositoryclient.dll
ext-ms-onecore-appmodel-tdlmigration-l1-1-0	tdlmigration.dll
ext-ms-onecore-appmodel-veventdispatcher-l1-1-0	veeventdispatcher.dll
ext-ms-onecore-dcomp-l1-1-0	dcomp.dll
ext-ms-onecore-hcap-svf-l1-1-0	svf.dll
ext-ms-onecore-hlink-l1-1-0	hlink.dll
ext-ms-onecore-hnetcfg-l1-1-0	hnetcfgclient.dll
ext-ms-onecore-mpc-input-l1-1-0	shellcompositor.dll
ext-ms-onecore-shlwapi-l1-1-0	shlwapi.dll
ext-ms-onecore-spectrumsyncclient-l1-1-0	spectrumsyncclient.dll
ext-ms-win-adsi-activeds-l1-1-0	activeds.dll
ext-ms-win-advapi32-auth-l1-1-0	advapi32.dll
ext-ms-win-advapi32-encryptedfile-l1-1-1	advapi32.dll
ext-ms-win-advapi32-eventlog-ansi-l1-1-0	advapi32.dll
ext-ms-win-advapi32-eventlog-l1-1-1	advapi32.dll
ext-ms-win-advapi32-hwprof-l1-1-0	advapi32.dll
ext-ms-win-advapi32-idletask-l1-1-0	advapi32.dll
ext-ms-win-advapi32-lsa-l1-1-1	advapi32.dll
ext-ms-win-advapi32-msi-l1-1-0	advapi32.dll
ext-ms-win-advapi32-npusername-l1-1-0	advapi32.dll
ext-ms-win-advapi32-ntmarta-l1-1-0	advapi32.dll
ext-ms-win-advapi32-psm-app-l1-1-0	twinapi.appcore.dll
ext-ms-win-advapi32-registry-l1-1-0	advapi32.dll
ext-ms-win-advapi32-safer-l1-1-0	advapi32.dll
ext-ms-win-advapi32-shutdown-l1-1-0	advapi32.dll
ext-ms-win-appcompat-aepic-l1-1-0	aepic.dll
ext-ms-win-appcompat-apphelp-l1-1-0	apphelp.dll
ext-ms-win-appcompat-pcacli-l1-1-0	pcacli.dll
ext-ms-win-appmodel-daxcore-l1-1-1	daxexec.dll
ext-ms-win-appmodel-opc-l1-1-0	opcservices.dll
ext-ms-win-appmodel-restrictedappcontainer-internal-l1-1-0	kernel.appcore.dll
ext-ms-win-appmodel-state-ext-l1-2-0	kernel.appcore.dll
ext-ms-win-appxdeploymentclient-appxdeploy-l1-1-0	appxdeploymentclient.dll
ext-ms-win-appxdeploymentclient-appxdeployonecore-l1-1-0	appxdeploymentclient.dll
ext-ms-win-audiocore-coreaudiopolicymanager-l1-1-0	coreaudiopolicymanagerext.dll
ext-ms-win-audiocore-spatial-l1-1-0	audiosrvpolicymanager.dll
ext-ms-win-authz-claimpolicies-l1-1-0	authz.dll
ext-ms-win-authz-context-l1-1-0	authz.dll
ext-ms-win-authz-remote-l1-1-0	logoncli.dll
ext-ms-win-base-psapi-l1-1-0	psapi.dll
ext-ms-win-base-rstrtmgr-l1-1-0	rstrtmgr.dll
ext-ms-win-biometrics-winbio-core-l1-1-2	winbio.dll
ext-ms-win-biometrics-winbio-l1-1-0	winbio.dll
ext-ms-win-biometrics-winbio-l1-2-0	winbioext.dll
ext-ms-win-biometrics-winbio-l1-3-0	winbioext.dll
ext-ms-win-bluetooth-apis-l1-1-0	bluetoothapis.dll
ext-ms-win-bluetooth-apis-private-l1-1-0	bluetoothapis.dll
ext-ms-win-branding-winbrand-l1-1-1	winbrand.dll
ext-ms-win-casting-lockscreen-l1-1-0	castingshellext.dll
ext-ms-win-casting-shell-l1-1-0	castingshellext.dll
ext-ms-win-cluster-clusapi-l1-1-2	clusapi.dll
ext-ms-win-cluster-resutils-l1-1-1	resutils.dll
ext-ms-win-cmd-util-l1-1-0	cmdext.dll
ext-ms-win-cng-rng-l1-1-1	bcryptprimitives.dll
ext-ms-win-com-clbcatq-l1-1-0	clbcatq.dll
ext-ms-win-com-coml2-l1-1-1	coml2.dll
ext-ms-win-com-ole32-l1-1-5	ole32.dll
ext-ms-win-com-psmregister-l1-1-0	kernel.appcore.dll
ext-ms-win-com-psmregister-l1-2-2	kernel.appcore.dll
ext-ms-win-composition-ghost-l1-1-0	dwmghost.dll
ext-ms-win-composition-init-l1-1-0	dwminit.dll
ext-ms-win-compositor-hosting-l1-1-0	ism.dll
ext-ms-win-core-iuri-l1-1-0	urlmon.dll
ext-ms-win-core-psm-service-l1-1-3	psmserviceexthost.dll
ext-ms-win-core-resourcemanager-l1-1-0	rmclient.dll
ext-ms-win-core-resourcemanager-l1-2-0	rmclient.dll
ext-ms-win-core-resourcepolicy-l1-1-2	resourcepolicyclient.dll
ext-ms-win-core-resourcepolicyserver-l1-1-0	resourcepolicyserver.dll
ext-ms-win-core-storelicensing-l1-1-0	licensemanagerapi.dll
ext-ms-win-core-storelicensing-l1-2-0	licensemanagerapi.dll
ext-ms-win-core-winsrv-l1-1-0	winsrvext.dll
ext-ms-win-coreui-navshutdown-l1-1-0	navshutdown.dll
ext-ms-win-deployment-productenumerator-l1-1-0	productenumerator.dll
ext-ms-win-desktopappx-l1-1-1	daxexec.dll
ext-ms-win-devmgmt-dm-l1-1-1	dmapisetextimpldesktop.dll
ext-ms-win-devmgmt-policy-l1-1-0	policymanager.dll
ext-ms-win-direct2d-desktop-l1-1-0	direct2ddesktop.dll
ext-ms-win-domainjoin-netjoin-l1-1-0	netjoin.dll
ext-ms-win-dwmapi-ext-l1-1-0	dwmapi.dll
ext-ms-win-dwmapidxgi-ext-l1-1-0	dwmapi.dll
ext-ms-win-dx-d3d9-l1-1-0	d3d9.dll
ext-ms-win-dx-ddraw-l1-1-0	ddraw.dll
ext-ms-win-dx-dinput8-l1-1-0	dinput8.dll
ext-ms-win-edputil-policy-l1-1-1	edputil.dll
ext-ms-win-els-elscore-l1-1-0	elscore.dll
ext-ms-win-eventing-pdh-l1-1-0	pdh.dll
ext-ms-win-eventing-rundown-l1-1-0	etwrundown.dll
ext-ms-win-eventing-tdh-ext-l1-1-0	tdh.dll
ext-ms-win-familysafety-childaccount-l1-1-0	familysafetyext.dll
ext-ms-win-feclient-encryptedfile-l1-1-1	feclient.dll
ext-ms-win-firewallapi-webproxy-l1-1-1	firewallapi.dll
ext-ms-win-font-fontgroups-l1-1-0	fontgroupsoverride.dll
ext-ms-win-fs-clfs-l1-1-0	clfs.sys
ext-ms-win-fs-cscapi-l1-1-0	cscapi.dll
ext-ms-win-fs-vssapi-l1-1-0	vssapi.dll
ext-ms-win-fsutilext-ifsutil-l1-1-0	fsutilext.dll
ext-ms-win-fsutilext-ulib-l1-1-0	fsutilext.dll
ext-ms-win-fveapi-query-l1-1-0	fveapi.dll
ext-ms-win-gaming-gamechatoverlay-l1-1-0	gamechatoverlayext.dll
ext-ms-win-gaming-xblgamesave-l1-1-0	xblgamesaveext.dll
ext-ms-win-gaming-xinput-l1-1-0	xinputuap.dll
ext-ms-win-gdi-clipping-l1-1-0	gdi32full.dll
ext-ms-win-gdi-dc-create-l1-1-2	gdi32full.dll
ext-ms-win-gdi-dc-l1-2-1	gdi32full.dll
ext-ms-win-gdi-devcaps-l1-1-0	gdi32full.dll
ext-ms-win-gdi-draw-l1-1-3	gdi32full.dll
ext-ms-win-gdi-font-l1-1-3	gdi32full.dll
ext-ms-win-gdi-gdiplus-l1-1-0	gdiplus.dll
ext-ms-win-gdi-internal-desktop-l1-1-1	gdi32full.dll
ext-ms-win-gdi-metafile-l1-1-2	gdi32full.dll
ext-ms-win-gdi-path-l1-1-0	gdi32full.dll
ext-ms-win-gdi-print-l1-1-0	gdi32full.dll
ext-ms-win-gdi-private-l1-1-0	gdi32full.dll
ext-ms-win-gdi-render-l1-1-0	gdi32.dll
ext-ms-win-gdi-rgn-l1-1-0	gdi32full.dll
ext-ms-win-gdi-wcs-l1-1-0	gdi32full.dll
ext-ms-win-globalization-collation-l1-1-0	globcollationhost.dll
ext-ms-win-globalization-input-l1-1-1	globinputhost.dll
ext-ms-win-gpapi-grouppolicy-l1-1-0	gpapi.dll
ext-ms-win-gpsvc-grouppolicy-l1-1-0	gpsvc.dll
ext-ms-win-gui-dui70-l1-1-0	dui70.dll
ext-ms-win-gui-ieui-l1-1-0	ieui.dll
ext-ms-win-gui-uxinit-l1-1-0	uxinit.dll
ext-ms-win-hyperv-compute-l1-1-0	vmcompute.dll
ext-ms-win-imm-l1-1-1	imm32.dll
ext-ms-win-kernel32-appcompat-l1-1-0	kernel32.dll
ext-ms-win-kernel32-datetime-l1-1-0	kernel32.dll
ext-ms-win-kernel32-elevation-l1-1-0	kernel32.dll
ext-ms-win-kernel32-errorhandling-l1-1-0	kernel32.dll	faultrep.dll
ext-ms-win-kernel32-file-l1-1-0	kernel32.dll
ext-ms-win-kernel32-localization-l1-1-0	kernel32.dll
ext-ms-win-kernel32-package-current-l1-1-0	kernel.appcore.dll
ext-ms-win-kernel32-package-l1-1-2	kernel.appcore.dll
ext-ms-win-kernel32-process-l1-1-0	kernel32.dll
ext-ms-win-kernel32-quirks-l1-1-1	kernel32.dll
ext-ms-win-kernel32-registry-l1-1-0	kernel32.dll
ext-ms-win-kernel32-sidebyside-l1-1-0	kernel32.dll
ext-ms-win-kernel32-transacted-l1-1-0	kernel32.dll
ext-ms-win-kernel32-windowserrorreporting-l1-1-1	kernel32.dll
ext-ms-win-kernelbase-processthread-l1-1-0	kernel32.dll
ext-ms-win-kioskmode-config-l1-1-0	lockdownutil.dll
ext-ms-win-mapi-mapi32-l1-1-0	mapistub.dll
ext-ms-win-media-avi-l1-1-0	avifil32.dll
ext-ms-win-mf-vfw-l1-1-0	mfvfw.dll
ext-ms-win-mininput-cursorhost-l1-1-0	inputhost.dll
ext-ms-win-mininput-inputhost-l1-1-0	inputhost.dll
ext-ms-win-mininput-systeminputhost-l1-1-0	ism.dll
ext-ms-win-mm-msacm-l1-1-0	msacm32.dll
ext-ms-win-mm-pehelper-l1-1-0	mf.dll
ext-ms-win-mm-wmvcore-l1-1-0	wmvcore.dll
ext-ms-win-moderncore-win32k-base-ntgdi-l1-1-0	win32kfull.sys
ext-ms-win-moderncore-win32k-base-ntuser-l1-1-0	win32kfull.sys
ext-ms-win-moderncore-win32k-base-sysentry-l1-1-0	win32k.sys
ext-ms-win-mpr-multipleproviderrouter-l1-1-0	mprext.dll
ext-ms-win-mrmcorer-resmanager-l1-1-0	mrmcorer.dll
ext-ms-win-msa-ui-l1-1-0	msauserext.dll
ext-ms-win-msa-user-l1-1-1	msauserext.dll
ext-ms-win-msi-misc-l1-1-0	msi.dll
ext-ms-win-msiltcfg-msi-l1-1-0	msiltcfg.dll
ext-ms-win-msimg-draw-l1-1-0	msimg32.dll
ext-ms-win-net-cmvpn-l1-1-0	cmintegrator.dll
ext-ms-win-net-httpproxyext-l1-1-0	httpprxc.dll
ext-ms-win-net-isoext-l1-1-0	firewallapi.dll
ext-ms-win-net-netbios-l1-1-0	netbios.dll
ext-ms-win-net-netshell-l1-1-0	netshell.dll
ext-ms-win-net-nfdapi-l1-1-0	ndfapi.dll
ext-ms-win-netprovision-netprovfw-l1-1-0	netprovfw.dll
ext-ms-win-networking-nlaapi-l1-1-0	nlaapi.dll
ext-ms-win-networking-radiomonitor-l1-1-0	windows.devices.radios.dll
ext-ms-win-networking-wcmapi-l1-1-0	wcmapi.dll
ext-ms-win-networking-winipsec-l1-1-0	winipsec.dll
ext-ms-win-networking-wlanapi-l1-1-0	wlanapi.dll
ext-ms-win-newdev-config-l1-1-2	newdev.dll
ext-ms-win-nfc-semgr-l1-1-0	semgrsvc.dll
ext-ms-win-ntdsa-activedirectoryserver-l1-1-0	ntdsa.dll
ext-ms-win-ntdsapi-activedirectoryclient-l1-1-1	ntdsapi.dll
ext-ms-win-ntos-clipsp-l1-1-0	clipsp.sys
ext-ms-win-ntos-kcminitcfg-l1-1-0	cmimcext.sys
ext-ms-win-ntos-tm-l1-1-0	tm.sys
ext-ms-win-ntos-ucode-l1-1-0	ntosext.sys
ext-ms-win-ntos-werkernel-l1-1-1	werkernel.sys
ext-ms-win-ntuser-caret-l1-1-0	user32.dll
ext-ms-win-ntuser-chartranslation-l1-1-0	user32.dll
ext-ms-win-ntuser-dc-access-ext-l1-1-0	user32.dll
ext-ms-win-ntuser-dialogbox-l1-1-3	user32.dll
ext-ms-win-ntuser-draw-l1-1-2	user32.dll
ext-ms-win-ntuser-gui-l1-1-1	user32.dll
ext-ms-win-ntuser-gui-l1-2-0	user32.dll
ext-ms-win-ntuser-gui-l1-3-1	user32.dll
ext-ms-win-ntuser-keyboard-l1-1-1	user32.dll
ext-ms-win-ntuser-keyboard-l1-2-0	user32.dll
ext-ms-win-ntuser-keyboard-l1-3-0	user32.dll
ext-ms-win-ntuser-menu-l1-1-3	user32.dll
ext-ms-win-ntuser-message-l1-1-3	user32.dll
ext-ms-win-ntuser-misc-l1-1-0	user32.dll
ext-ms-win-ntuser-misc-l1-2-0	user32.dll
ext-ms-win-ntuser-misc-l1-3-0	user32.dll
ext-ms-win-ntuser-misc-l1-5-1	user32.dll
ext-ms-win-ntuser-mit-l1-1-0	user32.dll
ext-ms-win-ntuser-mouse-l1-1-1	user32.dll
ext-ms-win-ntuser-powermanagement-l1-1-0	user32.dll
ext-ms-win-ntuser-private-l1-1-1	user32.dll
ext-ms-win-ntuser-private-l1-2-0	user32.dll
ext-ms-win-ntuser-private-l1-3-2	user32.dll
ext-ms-win-ntuser-rawinput-l1-1-0	user32.dll
ext-ms-win-ntuser-rectangle-ext-l1-1-0	user32.dll
ext-ms-win-ntuser-rim-l1-1-1	user32.dll
ext-ms-win-ntuser-rotationmanager-l1-1-1	user32.dll
ext-ms-win-ntuser-server-l1-1-1	user32.dll
ext-ms-win-ntuser-string-l1-1-0	user32.dll
ext-ms-win-ntuser-synch-l1-1-0	user32.dll
ext-ms-win-ntuser-sysparams-ext-l1-1-1	user32.dll
ext-ms-win-ntuser-touch-hittest-l1-1-0	user32.dll
ext-ms-win-ntuser-uicontext-ext-l1-1-0	user32.dll
ext-ms-win-ntuser-window-l1-1-4	user32.dll
ext-ms-win-ntuser-windowclass-l1-1-2	user32.dll
ext-ms-win-ntuser-windowstation-ansi-l1-1-1	user32.dll
ext-ms-win-ntuser-windowstation-l1-1-2	user32.dll
ext-ms-win-odbc-odbc32-l1-1-0	odbc32.dll
ext-ms-win-ole32-bindctx-l1-1-0	ole32.dll
ext-ms-win-ole32-ie-ext-l1-1-0	ole32.dll
ext-ms-win-ole32-oleautomation-l1-1-0	ole32.dll
ext-ms-win-oleacc-l1-1-2	oleacc.dll
ext-ms-win-parentalcontrols-setup-l1-1-0	wpcapi.dll
ext-ms-win-pinenrollment-enrollment-l1-1-0	pinenrollmenthelper.dll
ext-ms-win-printer-prntvpt-l1-1-1	prntvpt.dll
ext-ms-win-printer-winspool-l1-1-4	winspool.drv
ext-ms-win-profile-extender-l1-1-0	userenv.dll
ext-ms-win-profile-profsvc-l1-1-0	profsvcext.dll
ext-ms-win-profile-userenv-l1-1-1	profext.dll
ext-ms-win-provisioning-platform-l1-1-0	provplatformdesktop.dll
ext-ms-win-ras-rasapi32-l1-1-2	rasapi32.dll
ext-ms-win-ras-rasdlg-l1-1-0	rasdlg.dll
ext-ms-win-ras-rasman-l1-1-0	rasman.dll
ext-ms-win-ras-tapi32-l1-1-1	tapi32.dll
ext-ms-win-raschapext-eap-l1-1-0	raschapext.dll
ext-ms-win-rastlsext-eap-l1-1-0	rastlsext.dll
ext-ms-win-rdr-davhlpr-l1-1-0	davhlpr.dll
ext-ms-win-reinfo-query-l1-1-0	reinfo.dll
ext-ms-win-resourcemanager-gamemode-l1-1-0	rmclient.dll
ext-ms-win-resourcemanager-gamemode-l1-2-0	rmclient.dll
ext-ms-win-resources-deployment-l1-1-0	mrmdeploy.dll
ext-ms-win-ro-typeresolution-l1-1-0	wintypes.dll
ext-ms-win-rometadata-dispenser-l1-1-0	rometadata.dll
ext-ms-win-rpc-firewallportuse-l1-1-0	rpcrtremote.dll
ext-ms-win-rpc-ssl-l1-1-0	rpcrtremote.dll
ext-ms-win-rtcore-gdi-devcaps-l1-1-1	gdi32.dll
ext-ms-win-rtcore-gdi-object-l1-1-0	gdi32.dll
ext-ms-win-rtcore-gdi-rgn-l1-1-1	gdi32.dll
ext-ms-win-rtcore-ntuser-cursor-l1-1-1	user32.dll
ext-ms-win-rtcore-ntuser-dc-access-l1-1-1	user32.dll
ext-ms-win-rtcore-ntuser-dpi-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-dpi-l1-2-0	user32.dll
ext-ms-win-rtcore-ntuser-iam-l1-1-1	user32.dll
ext-ms-win-rtcore-ntuser-inputintercept-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-integration-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-rawinput-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-synch-ext-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-syscolors-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-sysparams-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-window-ext-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-winevent-ext-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-wmpointer-l1-1-0	user32.dll
ext-ms-win-samsrv-accountstore-l1-1-0	samsrv.dll
ext-ms-win-scesrv-server-l1-1-0	scesrv.dll
ext-ms-win-search-folder-l1-1-0	searchfolder.dll
ext-ms-win-secur32-translatename-l1-1-1	secur32.dll
ext-ms-win-security-appinfoext-l1-1-0	appinfoext.dll
ext-ms-win-security-authbrokerui-l1-1-0	authbrokerui.dll
ext-ms-win-security-capauthz-l1-1-1	capauthz.dll
ext-ms-win-security-certpoleng-l1-1-0	certpoleng.dll
ext-ms-win-security-credui-internal-l1-1-0	wincredui.dll
ext-ms-win-security-credui-l1-1-1	credui.dll
ext-ms-win-security-cryptui-l1-1-1	cryptui.dll
ext-ms-win-security-efs-l1-1-1	efsext.dll
ext-ms-win-security-efswrt-l1-1-1	efswrt.dll
ext-ms-win-security-kerberos-l1-1-0	kerberos.dll
ext-ms-win-security-shutdownext-l1-1-0	shutdownext.dll
ext-ms-win-security-slc-l1-1-0	slc.dll
ext-ms-win-security-srp-l1-1-1	srpapi.dll
ext-ms-win-security-tokenbrokerui-l1-1-0	tokenbrokerui.dll
ext-ms-win-security-vaultcli-l1-1-1	vaultcli.dll
ext-ms-win-security-winscard-l1-1-0	winscard.dll
ext-ms-win-sensors-core-private-l1-1-2	sensorsnativeapi.dll
ext-ms-win-sensors-utilities-private-l1-1-1	sensorsutilsv2.dll
ext-ms-win-session-userinit-l1-1-0	userinitext.dll
ext-ms-win-session-usermgr-l1-1-0	usermgrcli.dll
ext-ms-win-session-usertoken-l1-1-0	wtsapi32.dll
ext-ms-win-session-wininit-l1-1-0	wininitext.dll
ext-ms-win-session-winlogon-l1-1-0	winlogonext.dll
ext-ms-win-session-winsta-l1-1-2	winsta.dll
ext-ms-win-session-wtsapi32-l1-1-0	wtsapi32.dll
ext-ms-win-setupapi-classinstallers-l1-1-2	setupapi.dll
ext-ms-win-setupapi-inf-l1-1-1	setupapi.dll
ext-ms-win-setupapi-logging-l1-1-0	setupapi.dll
ext-ms-win-shell-aclui-l1-1-0	aclui.dll
ext-ms-win-shell-comctl32-da-l1-1-0	comctl32.dll
ext-ms-win-shell-comctl32-init-l1-1-1	comctl32.dll
ext-ms-win-shell-comctl32-l1-1-0	comctl32.dll
ext-ms-win-shell-comctl32-window-l1-1-0	comctl32.dll
ext-ms-win-shell-comdlg32-l1-1-1	comdlg32.dll
ext-ms-win-shell-directory-l1-1-0	windows.storage.dll
ext-ms-win-shell-efsadu-l1-1-0	efsadu.dll
ext-ms-win-shell-embeddedmode-l1-1-0	embeddedmodesvcapi.dll
ext-ms-win-shell-exports-internal-l1-1-0	shell32.dll
ext-ms-win-shell-ntshrui-l1-1-0	ntshrui.dll
ext-ms-win-shell-propsys-l1-1-0	propsys.dll
ext-ms-win-shell-settingsync-l1-1-3	settingsyncpolicy.dll
ext-ms-win-shell-shdocvw-l1-1-0	shdocvw.dll
ext-ms-win-shell-shell32-l1-2-2	shell32.dll
ext-ms-win-shell-shlwapi-l1-1-2	shlwapi.dll
ext-ms-win-shell-shlwapi-l1-2-0	shlwapi.dll
ext-ms-win-shell32-shellcom-l1-1-0	windows.storage.dll
ext-ms-win-shell32-shellfolders-l1-1-1	windows.storage.dll
ext-ms-win-shell32-shellfolders-l1-2-0	windows.storage.dll
ext-ms-win-smbshare-browser-l1-1-0	browser.dll
ext-ms-win-smbshare-browserclient-l1-1-0	browcli.dll
ext-ms-win-smbshare-sscore-l1-1-0	sscoreext.dll
ext-ms-win-spinf-inf-l1-1-0	spinf.dll
ext-ms-win-storage-hbaapi-l1-1-0	hbaapi.dll
ext-ms-win-storage-iscsidsc-l1-1-0	iscsidsc.dll
ext-ms-win-storage-sense-l1-1-0	storageusage.dll
ext-ms-win-storage-sense-l1-2-0	storageusage.dll
ext-ms-win-sxs-oleautomation-l1-1-0	sxs.dll
ext-ms-win-tsf-inputsetting-l1-1-0	input.dll
ext-ms-win-tsf-msctf-l1-1-2	msctf.dll
ext-ms-win-ttlsext-eap-l1-1-0	ttlsext.dll
ext-ms-win-uiacore-l1-1-3	uiautomationcore.dll
ext-ms-win-umpoext-umpo-l1-1-0	umpoext.dll
ext-ms-win-usp10-l1-1-0	gdi32full.dll
ext-ms-win-uwf-servicing-apis-l1-1-0	uwfservicingapi.dll
ext-ms-win-uxtheme-themes-l1-1-1	uxtheme.dll
ext-ms-win-wer-reporting-l1-1-2	wer.dll
ext-ms-win-wer-ui-l1-1-0	werui.dll
ext-ms-win-wer-wct-l1-1-0	wer.dll
ext-ms-win-wevtapi-eventlog-l1-1-3	wevtapi.dll
ext-ms-win-winrt-storage-l1-1-0	windows.storage.dll
ext-ms-win-winrt-storage-win32broker-l1-1-0	windows.storage.winrt.dll
ext-ms-win-wlan-grouppolicy-l1-1-0	wlgpclnt.dll
ext-ms-win-wlan-onexui-l1-1-0	onexui.dll
ext-ms-win-wlan-scard-l1-1-0	winscard.dll
ext-ms-win-wnv-l1-1-0	wnv.sys
ext-ms-win-wrp-sfc-l1-1-0	sfc.dll
ext-ms-win-wsclient-devlicense-l1-1-1	wsclient.dll
ext-ms-win-wwaext-misc-l1-1-0	wwaext.dll
ext-ms-win-wwaext-module-l1-1-0	wwaext.dll
ext-ms-win-wwan-wwapi-l1-1-2	wwapi.dll
ext-ms-win-xaml-controls-l1-1-0	windows.ui.xaml.phone.dll

↧

IMAGE_DYNAMIC_RELOCATION_TABLE.Version 2

March 1, 2017, 5:44 am

≫ Next: ida plugin for RFG fixups processing

≪ Previous: apisetschema.dll from windows 10 build 15025

it seems that around since w10 build 15007 format of rfg relocs was changed and field IMAGE_DYNAMIC_RELOCATION_TABLE.Version now has value 2. So lets install platform SDK for 15003 and see what was changed

First remarkable thing is that IMAGE_LOAD_CONFIG_DIRECTORY now has two additional fields:

    WORD       DynamicValueRelocTableSection;
    WORD       Reserved2;
    // since w10 build 15003 ?
    ULONGLONG  GuardRFVerifyStackPointerFunctionPointer; // VA
    DWORD      HotPatchTableOffset;

} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;

so sizeof(IMAGE_LOAD_CONFIG_DIRECTORY64) is now 0xf4
and we can also find declaration for yet several rfg related structs:

typedef struct _IMAGE_DYNAMIC_RELOCATION64_V2 {
    DWORD      HeaderSize;
    DWORD      FixupInfoSize;
    ULONGLONG  Symbol;
    DWORD      SymbolGroup;
    DWORD      Flags;
    // ...     variable length header fields
    // BYTE    FixupInfo[FixupInfoSize]
} IMAGE_DYNAMIC_RELOCATION64_V2, *PIMAGE_DYNAMIC_RELOCATION64_V2;

typedef struct _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER {
    BYTE       PrologueByteCount;
    // BYTE    PrologueBytes[PrologueByteCount];
} IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER;
typedef IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER UNALIGNED *PIMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER;

typedef struct _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER {
    DWORD      EpilogueCount;
    BYTE       EpilogueByteCount;
    BYTE       BranchDescriptorElementSize;
    WORD       BranchDescriptorCount;
    // BYTE    BranchDescriptors[...];
    // BYTE    BranchDescriptorBitMap[...];
} IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER;
typedef IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER UNALIGNED *PIMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER;

So how it look all together (sample was taken from ImagingDevices.exe):
load_config

.rdata:0000000140003100   dq 0      ; lc + c0 - DynamicValueRelocTable
.rdata:0000000140003108   dq 0      ; CHPEMetadataPointer
.rdata:0000000140003110   dq offset __guard_ss_verify_failure
.rdata:0000000140003118   dq offset __guard_ss_verify_failure_fptr
.rdata:0000000140003120   dd 30h    ; lc + e0 - DynamicValueRelocTableOffset
.rdata:0000000140003124   dd 6      ; lc + e4 - DynamicValueRelocTableSection
.rdata:0000000140003128   dq offset __guard_ss_verify_sp_fptr

rfg relocs in .reloc section at offset 0x30:

.reloc:0000000140019030   dd 2                  ; version
.reloc:0000000140019034   dd 0BFh               ; size
.reloc:0000000140019038   dd 22h              ; HeaderSize
.reloc:000000014001903C   dd 3Ch              ; FixupInfoSize
.reloc:0000000140019040   dq 1                ; Symbol - 1 - prolog
.reloc:0000000140019048   dd 1                ; SymbolGroup
.reloc:000000014001904C   dd 0                ; Flags
.reloc:0000000140019050   db    9                 ; PrologueByteCount
.reloc:0000000140019051 ; ---------------------------------------------------------------------------
.reloc:0000000140019051   db      66h   ; body of prolog
.reloc:0000000140019051   nop                        
.reloc:0000000140019053   nop   dword ptr [rax+00000000h]
.reloc:0000000140019053 ; ---------------------------------------------------------------------------
.reloc:000000014001905A   dd 1000h              ; va of rfg fixup block
.reloc:000000014001905E   dd 24h                ; sizeofblock
.reloc:0000000140019062   dw 0
.reloc:0000000140019064   dw 13Ch
.reloc:0000000140019066   dw 2ACh
.reloc:0000000140019068   dw 6F0h
.reloc:000000014001906A   dw 0A00h
.reloc:000000014001906C   dw 0AF0h
.reloc:000000014001906E   dw 0B54h
.reloc:0000000140019070   dw 0DD0h
.reloc:0000000140019072   dw 0E40h
.reloc:0000000140019074   dw 0EA0h
.reloc:0000000140019076   dw 0ED8h
.reloc:0000000140019078   dw 0F44h
.reloc:000000014001907A   dw 0FB0h
.reloc:000000014001907C   dw 0FD0h
.reloc:000000014001907E   dd 2000h              ; va of next rfg fixup block
.reloc:0000000140019082   dd 18h                ; sizeofblock

yep, it seems that body of prolog now stored in IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER after PrologueByteCount field. I have no idea why it was done bcs you anyway restricted with free space in prolog of each function

↧

ida plugin for RFG fixups processing

March 2, 2017, 7:38 am

≫ Next: ntdll ProtectedPolicies

≪ Previous: IMAGE_DYNAMIC_RELOCATION_TABLE.Version 2

I commited today code for Ida Pro plugin for RFG fixups processing - for both version 1 & 2

It seems that by default during automatic loading of pe files Ida don`t load .reloc section (where usually located RFG fixups). In such case I ask if you want to add new segment:

Sure it works only if original input file (you can extract it with get_input_file_path function) is still available. Also I used dirty hack - I am too lazy to parse PE file by hand, and it seems that node "$ PE header" keeps all sections (even not loaded in base !) in supvals

enjoy

Update: it seems that buggy ida sdk don`t contains doCode function and auto_mark_range actually does not take into account end argument, so body of prologs looks ugly

↧

ntdll ProtectedPolicies

April 6, 2017, 5:23 am

≫ Next: etwex - ida plugin for Etw traces IIDs searching

≪ Previous: ida plugin for RFG fixups processing

It seems that since windows 10 ntdll has security feature called "ProtectedPolicies" - you can query it with RtlQueryProtectedPolicy function. Prototype of this function is:
NTAPI NTSTATUS RtlQueryProtectedPolicy(GUID *, PDWORD out_flag);

Lets see how it works:

loc_6A277EFB:   ; CODE XREF: RtlQueryProtectedPolicy(x,x)+12 j
  push    edi
  mov     edi, offset _RtlpProtectedPoliciesSRWLock
  push    edi
  call    _RtlAcquireSRWLockShared@4    ; RtlAcquireSRWLockShared(x)
  push    offset _RtlpSearchProtectedPolicyEntry ; PtFuncCompare
  push    14h                           ; SizeOfElements
  push    ds:_RtlpProtectedPoliciesActiveCount ; NumOfElements
  push    ds:_RtlpProtectedPolicies     ; Base
  push    [ebp+Key]                     ; Key
  call    _bsearch

That policies stored in array RtlpProtectedPolicies, count located in RtlpProtectedPoliciesActiveCount and size of each policy is 0x14 bytes (0x18 under x64), so each policy looks like struct:
struct protected_policy
{
IID guid;
DWORD flag;
};

Lets see from where RtlQueryProtectedPolicy called

ntdll.dll:

from RtlpAddVectoredHandler with GUID {1FC98BCA-1BA9-4397-93F9-349EAD41E057}
from RtlGuardCheckLongJumpTarget with GUID {4F6AE3A6-8B1B-4623-A293-294CD743BBD1}

kernel32.dll:

from CheckForReadOnlyResourceFilter with GUID GUID_BasepAllowResourceConversion {739C343A-F3E1-4ED8-AC66-8435FEB7C5A5}

KernelBase.dll:

from QueryProtectedPolicy function

↧

etwex - ida plugin for Etw traces IIDs searching

April 21, 2017, 8:22 am

≫ Next: kernel etw traces in windows 10

≪ Previous: ntdll ProtectedPolicies

For example you may need to find which Etw providers located in some module. There are lots of functions can be used to register provider and manual searching is very boring
So I commited today code for Ida Pro plugin for Etw traces IIDs searching. It currently supports only 32bit PE files (much better if you load appropriate PDB file) and processing following functions:

TraceLoggingRegister
TraceLoggingRegisterEx
WPP_INIT_GUID_ARRAY
EtwRegister from import
EtwEventRegister from import
EventRegister from import

Samples of using:

twinui.dll
10086A04: FA386406-8E25-47F7-A03F-413635A55DC0 TwinUITraceLoggingProvider
_WPP_INIT_GUID_ARRAY@4 at 10224CC3

10088A40: 922771A3-305B-4375-9285-F734E8381CE3 _WPP_ThisDir_CTLGUID_APPPOS

10089150: 7C4A90A3-5BF4-4185-82E0-C073AC7F7007 _WPP_ThisDir_CTLGUID_AUTOPLAYLIB

10088390: F9A92EFE-77C3-4D19-8B00-1EE9E7CBE8C1 _WPP_ThisDir_CTLGUID_SHAREANDDEVICESLIB

10087E00: B22CFA4C-B683-4B89-A0D1-295300055D84 _WPP_ThisDir_CTLGUID_MTCUILIB

10087FB0: A1B23CA8-75BC-48B1-9AA6-BAC320C2DE2E _WPP_ThisDir_CTLGUID_BACKSTACKMUSICPLAYLIB

10087F10: 0A6EAEEE-4B93-43B1-B7D7-4ED7F8403A24 _WPP_ThisDir_CTLGUID_NOWPLAYINGSESSIONMANAGER

dxgkrnl.sys

49336: 703FCC13-B66F-5868-DDD9-E2DB7F381FFB Microsoft.Windows.TlgAggregateInternal

492FF: C6998471-62CD-424D-A9A3-FE4C1FA378A4 DxgKrnlTelemetry

492AF: 221D444C-D07E-4FDE-B425-15B746CF535B Microsoft.Windows.Graphics.DxgDiagnostics

↧

kernel etw traces in windows 10

May 3, 2017, 7:11 am

≫ Next: wnf kernelmode callbacks

≪ Previous: etwex - ida plugin for Etw traces IIDs searching

In windows 10 there is no good old EtwpGuidHashTable and all registered Etw stored in SILO. Let`s see how we can extract them

Check first function exported function EtwRegister:

  call    _PsGetCurrentServerSiloGlobals@0 ; PsGetCurrentServerSiloGlobals()
  push    [ebp+arg_C]
  mov     edx, [ebp+arg_0]
  push    dword ptr [ebp+4]
  mov     ecx, [eax+1F0h]               ; ESERVERSILO_GLOBALS.EtwSiloState
  push    [ebp+arg_8]
  push    [ebp+arg_4]
  push    3
  call    _EtwpRegisterProvider@28      ; EtwpRegisterProvider(x,x,x,x,x,x,x)

Function PsGetCurrentServerSiloGlobals returns processes SILO or default SILO PspHostSiloGlobals stored in kernel which has type ESERVERSILO_GLOBALS. Field EtwSiloState has type ETW_SILODRIVERSTATE:

struct _ETW_SILODRIVERSTATE {
  /*   0x0 */ /*|0x4|*/ struct _ESERVERSILO_GLOBALS* SiloGlobals;
  /*   0x8 */ /*|0x168|*/ struct _ETW_GUID_ENTRY EtwpSecurityProviderGuidEntry;
  /* 0x170 */ /*|0x100|*/ struct _EX_RUNDOWN_REF_CACHE_AWARE* EtwpLoggerRundown[64];
  /* 0x270 */ /*|0x100|*/ struct _WMI_LOGGER_CONTEXT* WmipLoggerContext[64];
  /* 0x370 */ /*|0x700|*/ struct _ETW_HASH_BUCKET EtwpGuidHashTable[64];
  /* 0xa70 */ /*|0x10|*/ unsigned short EtwpSecurityLoggers[8];
  /* 0xa80 */ /*|0x1|*/ unsigned char EtwpSecurityProviderEnableMask;
  /* 0xa84 */ /*|0x4|*/ long EtwpShutdownInProgress;
  /* 0xa88 */ /*|0x4|*/ unsigned long EtwpSecurityProviderPID;
  /* 0xa8c */ /*|0x10|*/ struct _ETW_PRIV_HANDLE_DEMUX_TABLE PrivHandleDemuxTable;
  /* 0xa9c */ /*|0x10|*/ struct _ETW_COUNTERS EtwpCounters;
  /* 0xab0 */ /*|0x8|*/ union _LARGE_INTEGER LogfileBytesWritten;
  /* 0xab8 */ /*|0x4|*/ struct _ETW_SILO_TRACING_BLOCK* ProcessorBlocks;
};

So we almost found our hashtable - this is EtwpGuidHashTable[64] with type ETW_HASH_BUCKET:

struct _ETW_HASH_BUCKET {
  /*  0x0 */ /*|0x18|*/ struct _LIST_ENTRY ListHead[3];
  /* 0x18 */ /*|0x4|*/ struct _EX_PUSH_LOCK BucketLock;
};

I don`t know why 3 list was used but we need to traverse all of them. Each list contains ETW_GUID_ENTRY:

struct _ETW_GUID_ENTRY {
  /*   0x0 */ /*|0x8|*/ struct _LIST_ENTRY GuidList;
  /*   0x8 */ /*|0x4|*/ long RefCount;
  /*   0xc */ /*|0x10|*/ struct _GUID Guid;
  /*  0x1c */ /*|0x8|*/ struct _LIST_ENTRY RegListHead;
  /*  0x24 */ /*|0x4|*/ void* SecurityDescriptor;
  /*  0x28 */ /*|0x10|*/ struct _ETW_LAST_ENABLE_INFO LastEnable;
  /*  0x28 */ /*|0x8|*/ unsigned __int64 MatchId;
  /*  0x38 */ /*|0x20|*/ struct _TRACE_ENABLE_INFO ProviderEnableInfo;
  /*  0x58 */ /*|0x100|*/ struct _TRACE_ENABLE_INFO EnableInfo[8];
  /* 0x158 */ /*|0x4|*/ struct _ETW_FILTER_HEADER* FilterData;
  /* 0x15c */ /*|0x4|*/ struct _ETW_SILODRIVERSTATE* SiloState;
  /* 0x160 */ /*|0x4|*/ struct _EX_PUSH_LOCK Lock;
  /* 0x164 */ /*|0x4|*/ struct _ETHREAD* LockOwner;
};

ETW_GUID_ENTRY are chained by list GuidList
Sample of output:

KEtw10[18] list 0 - 17 items
 KEtw10[18.0]: RefCount 1 (C755EF4D-DE1C-4E7D-A10D-B8D1E26F5035) CTLGUID_EfsWrtCtlGuid
 KEtw10[18.1]: RefCount 1 (C906ED7B-D3D9-435B-97CD-22F4E7445F2A) Microsoft.Windows.WorkFolders
 KEtw10[18.2]: RefCount 2, KProvider - C1A60542-0621-455E-9326-FC12A2437B43
 KEtw10[18.3]: RefCount 2, KProvider - B702D31C-F586-4FC0-BCF5-F929745199A4
 KEtw10[18.4]: RefCount 1 (81F307DB-F5FB-4C3E-9B9D-8B39A9CB6198) CTLGUID_LmhsvcWppGuid
 KEtw10[18.5]: RefCount 4 (6966FE51-E224-4BAA-99BC-897B3ED3B823) Microsoft.Windows.BrokerBase
 KEtw10[18.6]: RefCount 1 (D0B639E0-E650-4D1D-8F39-1580ADE72784) CTLGUID_LsaTraceControlGuid
 KEtw10[18.7]: RefCount 1 (C1661A64-0A98-48E3-847F-70FFEA51C2EB) CTLGUID_COMPOSITE_BUS
 KEtw10[18.8]: RefCount 3 (CE8DEE0B-D539-4000-B0F8-77BED049C590) ControlGuid_UserModePowerService
 KEtw10[18.9]: RefCount 1, KProvider - BAD49E08-45BE-4E45-BECF-29965AA7D967
 KEtw10[18.10]: RefCount 6 (B92D1FF0-92EC-444D-B7EC-C016F971C000) Microsoft.Windows.Notifications.WpnCore.ToastInteractedWith
 KEtw10[18.11]: RefCount 2 (AA6F6A10-8A13-417D-8799-52361684BD76) Microsoft.Windows.ForegroundManager.RequestExtendedExecution
 KEtw10[18.12]: RefCount 1, KProvider - 72D164BF-FD64-4B2B-87A0-62DBCEC9AE2A
 KEtw10[18.13]: RefCount 4 (3DA5AA05-5152-551F-A243-80A4E743C70E) Microsoft.Windows.Skype.App.SkypeHomePageConversationSelected
 KEtw10[18.14]: RefCount 2 (22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716) PsProvGuid
 KEtw10[18.15]: RefCount 3 (0879871C-E412-4C6A-87A6-74581B0AFAC5) MicrosoftWindowsShellNetworkUX.PNILaunchNetworkUI
 KEtw10[18.16]: RefCount 3 (E18D0FC9-9515-4232-98E4-89E456D8551B) Microsoft-Windows-RTWorkQueue-Threading
KEtw10[18] list 2 - 1 items
 KEtw10[18.0]: RefCount 1, KProvider - 0D943590-B235-5BDB-F854-89520F32FC0B

↧

wnf kernelmode callbacks

May 24, 2017, 8:22 am

≫ Next: wincheck rc8.57

≪ Previous: kernel etw traces in windows 10

I already described how to enum usermode wnf callbacks
Now it`s time to enum WNF callbacks in kernel
It is not surprising that they stored in EPROCESS.WnfContext, this struct is undocumented but can be partially recovered from function ExpWnfCreateProcessContext:
offset 0 - WORD signature 0x906
offset 4 - WORD - size 0x88 (0x44 for x86)
offset 8 - eprocess
offset 0x10 - linked list for WNF contexts
offset 0x28 - push lock
offset 0x40 - linked list
offset 0x58 - linked list
offset 0x70 - linked list

Lets see at this struct in windbg

kd> nt!PsInitialSystemProcess
Evaluate expression: -8785642524704 = fffff802`6ee5efe0

kd> dp fffff802`6ee5efe0
fffff802`6ee5efe0  ffffb482`fce4f040

kd> dt _EPROCESS ffffb482`fce4f040
...

   +0x6b0 ThreadListLock   : _EX_PUSH_LOCK
   +0x6b8 WnfContext       : 0xffff9e0f`63a60c60 Void
   +0x6c0 ServerSilo       : (null) 
kd> dp ffff9e0f`63a60c60
ffff9e0f`63a60c60  00000000`00880906 ffffb482`fce4f040
ffff9e0f`63a60c70  ffff9e0f`65477ea0 fffff802`6f2415b8
ffff9e0f`63a60c80  00000000`00000000 00000000`00000000
ffff9e0f`63a60c90  00000000`00000000 00000000`00000000
ffff9e0f`63a60ca0  ffff9e0f`647eafd8 ffff9e0f`65ecb508
ffff9e0f`63a60cb0  00000000`00000000 ffff9e0f`63a3b518
ffff9e0f`63a60cc0  ffff9e0f`65e97598 00000000`00000000
ffff9e0f`63a60cd0  ffff9e0f`63a60cd0 ffff9e0f`63a60cd0

Lets look at list on offset 0x58:

kd> dps ffff9e0f`63a3b518
ffff9e0f`63a3b518  ffff9e0f`644358f8
ffff9e0f`63a3b520  ffff9e0f`63a60cb8
ffff9e0f`63a3b528  ffffb482`fce4f040
ffff9e0f`63a3b530  ffff9e0f`63a8e770
ffff9e0f`63a3b538  41504e50`00000801
ffff9e0f`63a3b540  ffff9e0f`69b042d0
ffff9e0f`63a3b548  ffff9e0f`63a8e7e8
ffff9e0f`63a3b550  fffff802`6ef52220 nt!PiUEventMetaNotificationCallback

ffffb482`fce4f040 - address of EPROCESS
41504e50 & 00000801 - WND id, but we need
id1: 801 xor A3BC0074 = A3BC0875
id2: 41504e50 xor 41C64E6D = 96003D
This is WNF_PNPA_DEVNODES_CHANGED
I got constants A3BC0074 and 41C64E6D from function ExpWnfDispatchKernelSubscription
So this struct looks like

struct WNF_CB
{
  LIST_ENTRY ListEntry;
  EPROCESS *eproc;
  PVOID unknown;
  DWORD id1;
  DWORD id2;
  LIST_ENTRY ListEntry2;
  PVOID cb;
};

And sample of output:

 [0]: FFFF9E0F63A3B518 EPROCESS FFFFB482FCE4F040 id1 A3BC0875 id2 96003D (WNF_PNPA_DEVNODES_CHANGED) cb FFFFF8026EF52220 \SystemRoot\system32\ntoskrnl.exe
 [1]: FFFF9E0F644358F8 EPROCESS FFFFB482FCE4F040 id1 A3BC3075 id2 41C6013D (WNF_PO_ENERGY_SAVER_OVERRIDE) cb FFFFF8026F160AE0 \SystemRoot\system32\ntoskrnl.exe
 [2]: FFFF9E0F644F8AC8 EPROCESS FFFFB482FCE4F040 id1 A3BC9075 id2 41C6013D (WNF_PO_BACKGROUND_ACTIVITY_POLICY) cb FFFFF8026F160A50 \SystemRoot\system32\ntoskrnl.exe
 [3]: FFFF9E0F645F21A8 EPROCESS FFFFB482FCE4F040 id1 A3BC6875 id2 41960A28 (WNF_EDP_PURGE_APP_LEARNING_EVT) cb FFFFF801DE665A00 \SystemRoot\System32\drivers\tcpip.sys
 [4]: FFFF9E0F645D84C8 EPROCESS FFFFB482FCE4F040 id1 A3BC9875 id2 41840B3E (WNF_SEB_SYSTEM_LPE) cb FFFFF801DDC51800 \SystemRoot\system32\drivers\CEA.sys
 [5]: FFFF9E0F6461C4D8 EPROCESS FFFFB482FCE4F040 id1 A3BD0075 id2 41840B3E (WNF_SEB_FULL_SCREEN_VIDEO_PLAYBACK) cb FFFFF801DDC51800 \SystemRoot\system32\drivers\CEA.sys
 [6]: FFFF9E0F6461C438 EPROCESS FFFFB482FCE4F040 id1 A3BC6075 id2 28F0222 cb FFFFF801DE017380 \SystemRoot\System32\DRIVERS\fvevol.sys
 [7]: FFFF9E0F6457F4F8 EPROCESS FFFFB482FCE4F040 id1 A3BC0875 id2 418B1E39 (WNF_TPM_OWNERSHIP_TAKEN) cb FFFFF801DE017380 \SystemRoot\System32\DRIVERS\fvevol.sys
 [8]: FFFF9E0F6460F338 EPROCESS FFFFB482FCE4F040 id1 A3BC0875 id2 41921C3E (WNF_SRT_WINRE_CONFIGURATION_CHANGE) cb FFFFF801DE017380 \SystemRoot\System32\DRIVERS\fvevol.sys
 [9]: FFFF9E0F64552748 EPROCESS FFFFB482FCE4F040 id1 A3BCB875 id2 41C6013D (WNF_PO_MODERN_STANDBY_EXIT_INITIATED) cb FFFFF801DFD69D80 \SystemRoot\System32\drivers\dxgkrnl.sys
 [10]: FFFF9E0F63A87DA8 EPROCESS FFFFB482FCE4F040 id1 A3BC0875 id2 41C6013D (WNF_PO_SCENARIO_CHANGE) cb FFFFF801DFC449E0 \SystemRoot\System32\drivers\dxgkrnl.sys
 [11]: FFFF9E0F64549EE8 EPROCESS FFFFB482FCE4F040 id1 A3BC1875 id2 12821A3F (WNF_RTDS_NAMED_PIPE_TRIGGER_CHANGED) cb FFFFF801DF7E7540 \SystemRoot\System32\drivers\npsvctrig.sys
 [12]: FFFF9E0F647E9F08 EPROCESS FFFFB482FCE4F040 id1 A3BDB075 id2 41840B3E (WNF_SEB_AUDIO_ACTIVITY) cb FFFFF8026EF51FE0 \SystemRoot\system32\ntoskrnl.exe
 [13]: FFFF9E0F647D51B8 EPROCESS FFFFB482FCE4F040 id1 A3BD0075 id2 41840B3E (WNF_SEB_FULL_SCREEN_VIDEO_PLAYBACK) cb FFFFF8026F157790 \SystemRoot\system32\ntoskrnl.exe
 [14]: FFFF9E0F647E9A38 EPROCESS FFFFB482FCE4F040 id1 A3BC7075 id2 41C6013D (WNF_PO_USER_AWAY_PREDICTION) cb FFFFF8026F157830 \SystemRoot\system32\ntoskrnl.exe
 [15]: FFFF9E0F64785B38 EPROCESS FFFFB482FCE4F040 id1 A3BC0945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [16]: FFFF9E0F647F37C8 EPROCESS FFFFB482FCE4F040 id1 A3BC1075 id2 41950828 cb FFFFF801DE9312E0 \SystemRoot\System32\Drivers\NTFS.sys
 [17]: FFFF9E0F64532728 EPROCESS FFFFB482FCE4F040 id1 A3BC5875 id2 41960A28 (WNF_EDP_DPL_KEYS_DROPPING) cb FFFFF801DE9A1850 \SystemRoot\System32\Drivers\NTFS.sys
 [18]: FFFF9E0F64A02F88 EPROCESS FFFFB482FCE4F040 id1 A3BC1875 id2 41960A28 (WNF_EDP_DPL_KEYS_STATE) cb FFFFF801DE9A1850 \SystemRoot\System32\Drivers\NTFS.sys
 [19]: FFFF9E0F68D8EC88 EPROCESS FFFFB482FCE4F040 id1 A3BD5C75 id2 13920028 (WNF_ENTR_EDPENFORCEMENTLEVEL_CACHED_POLICY_VALUE_CHANGED) cb FFFFF801DE9312E0 \SystemRoot\System32\Drivers\NTFS.sys
 [20]: FFFF9E0F68D8B1F8 EPROCESS FFFFB482FCE4F040 id1 A3BC2145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [21]: FFFF9E0F65595528 EPROCESS FFFFB482FCE4F040 id1 A3BC3145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [22]: FFFF9E0F6C391948 EPROCESS FFFFB482FCE4F040 id1 A3BC3945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [23]: FFFF9E0F6540A768 EPROCESS FFFFB482FCE4F040 id1 A3BC0875 id2 41C6013D (WNF_PO_SCENARIO_CHANGE) cb FFFFF801DFCAF930 \SystemRoot\System32\drivers\dxgkrnl.sys
 [24]: FFFF9E0F64B6B648 EPROCESS FFFFB482FCE4F040 id1 A3BC4145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [25]: FFFF9E0F68F30698 EPROCESS FFFFB482FCE4F040 id1 A3BC4945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [26]: FFFF9E0F65215558 EPROCESS FFFFB482FCE4F040 id1 A3BC5145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [27]: FFFF9E0F6531A3A8 EPROCESS FFFFB482FCE4F040 id1 A3BC6145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [28]: FFFF9E0F652E8548 EPROCESS FFFFB482FCE4F040 id1 A3BC6945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [29]: FFFF9E0F652A4338 EPROCESS FFFFB482FCE4F040 id1 A3BC7145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [30]: FFFF9E0F65301D78 EPROCESS FFFFB482FCE4F040 id1 A3BCE945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [31]: FFFF9E0F65254448 EPROCESS FFFFB482FCE4F040 id1 A3BD1945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [32]: FFFF9E0F6524ADF8 EPROCESS FFFFB482FCE4F040 id1 A3B02945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [33]: FFFF9E0F6C894A98 EPROCESS FFFFB482FCE4F040 id1 A3B03945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [34]: FFFF9E0F6C8B0348 EPROCESS FFFFB482FCE4F040 id1 A3B04145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [35]: FFFF9E0F64E0C7D8 EPROCESS FFFFB482FCE4F040 id1 A3B09945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [36]: FFFF9E0F64E285D8 EPROCESS FFFFB482FCE4F040 id1 A3B0E945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [37]: FFFF9E0F64ECD268 EPROCESS FFFFB482FCE4F040 id1 A3B33945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [38]: FFFF9E0F64EC37C8 EPROCESS FFFFB482FCE4F040 id1 A3BC0C75 id2 41960B29 (WNF_DEP_OOBE_COMPLETE) cb FFFFF801E07D0030 \SystemRoot\system32\drivers\cldflt.sys
 [39]: FFFF9E0F64EAF8D8 EPROCESS FFFFB482FCE4F040 id1 A3B36945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [40]: FFFF9E0F650B7C28 EPROCESS FFFFB482FCE4F040 id1 A3AE0145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [41]: FFFF9E0F650FBD68 EPROCESS FFFFB482FCE4F040 id1 A3AEF945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [42]: FFFF9E0F650AB1A8 EPROCESS FFFFB482FCE4F040 id1 A3AF0145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [43]: FFFF9E0F65109CC8 EPROCESS FFFFB482FCE4F040 id1 A3AF2145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [44]: FFFF9E0F6518C598 EPROCESS FFFFB482FCE4F040 id1 A3A8B145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [45]: FFFF9E0F6524DD68 EPROCESS FFFFB482FCE4F040 id1 A3BD5C75 id2 13920028 (WNF_ENTR_EDPENFORCEMENTLEVEL_CACHED_POLICY_VALUE_CHANGED) cb FFFFF801E0A25A70 \SystemRoot\system32\DRIVERS\mrxsmb.sys
 [46]: FFFF9E0F650B0A38 EPROCESS FFFFB482FCE4F040 id1 A39FF945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [47]: FFFF9E0F651DAC28 EPROCESS FFFFB482FCE4F040 id1 A3980145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [48]: FFFF9E0F63A1F8B8 EPROCESS FFFFB482FCE4F040 id1 A3980945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [49]: FFFF9E0F65C7F878 EPROCESS FFFFB482FCE4F040 id1 A398C145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [50]: FFFF9E0F65E97598 EPROCESS FFFFB482FCE4F040 id1 A3993145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [51]: FFFF9E0F65BEF028 EPROCESS FFFFB482FCE4F040 id1 A39A3145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [52]: FFFF9E0F664DFA38 EPROCESS FFFFB482FCE4F040 id1 A39A4945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [53]: FFFF9E0F66D69CE8 EPROCESS FFFFB482FCE4F040 id1 A39A6945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [54]: FFFF9E0F66DB2DE8 EPROCESS FFFFB482FCE4F040 id1 A3BC2475 id2 D83063E (WNF_SHEL_OOBE_USER_LOGON_COMPLETE) cb FFFFF801DE017380 \SystemRoot\System32\DRIVERS\fvevol.sys
 [55]: FFFF9E0F66D42438 EPROCESS FFFFB482FCE4F040 id1 A39B3945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [56]: FFFF9E0F66DD8C58 EPROCESS FFFFB482FCE4F040 id1 A39B6945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [57]: FFFF9E0F66B457F8 EPROCESS FFFFB482FCE4F040 id1 A39B9945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [58]: FFFF9E0F664C02C8 EPROCESS FFFFB482FCE4F040 id1 A3942145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [59]: FFFF9E0F67135DC8 EPROCESS FFFFB482FCE4F040 id1 A3944145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [60]: FFFF9E0F671DC898 EPROCESS FFFFB482FCE4F040 id1 A3951945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [61]: FFFF9E0F673464F8 EPROCESS FFFFB482FCE4F040 id1 A395B145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [62]: FFFF9E0F67721AA8 EPROCESS FFFFB482FCE4F040 id1 A3913945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [63]: FFFF9E0F67279F88 EPROCESS FFFFB482FCE4F040 id1 A3915945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [64]: FFFF9E0F6788A028 EPROCESS FFFFB482FCE4F040 id1 A3917145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [65]: FFFF9E0F675802B8 EPROCESS FFFFB482FCE4F040 id1 A391D945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [66]: FFFF9E0F67D34EE8 EPROCESS FFFFB482FCE4F040 id1 A388E945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [67]: FFFF9E0F67E7E448 EPROCESS FFFFB482FCE4F040 id1 A388F145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [68]: FFFF9E0F677834D8 EPROCESS FFFFB482FCE4F040 id1 A38B7145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [69]: FFFF9E0F67809738 EPROCESS FFFFB482FCE4F040 id1 A380A145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [70]: FFFF9E0F6753D5B8 EPROCESS FFFFB482FCE4F040 id1 A380B945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [71]: FFFF9E0F673BD758 EPROCESS FFFFB482FCE4F040 id1 A381F145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [72]: FFFF9E0F68A23398 EPROCESS FFFFB482FCE4F040 id1 A3821145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [73]: FFFF9E0F67E14448 EPROCESS FFFFB482FCE4F040 id1 A3823945 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys
 [74]: FFFF9E0F676EA8B8 EPROCESS FFFFB482FCE4F040 id1 A3824145 id2 41C64E6D cb FFFFF801DF86A640 \SystemRoot\system32\drivers\bam.sys

↧