| """One-line descriptions for tagged Windows APIs. | |
| Source: MicrosoftDocs/sdk-api and windows-driver-docs-ddi, CC BY 4.0 (see NOTICE.md). | |
| Extracted from each page's `description:` YAML field. Missing entries fall back to a | |
| tag-derived sentence via short_doc(). | |
| """ | |
| from api_knowledge import API_TAGS | |
| MSDN_DOCS = { | |
| "AcquireSRWLockExclusive": "Acquires a slim reader/writer (SRW) lock in exclusive mode.", | |
| "AcquireSRWLockShared": "Acquires a slim reader/writer (SRW) lock in shared mode.", | |
| "AdjustTokenPrivileges": "Enables or disables privileges in the specified access token. Enabling or disabling privileges in an access token requires TOKEN_ADJUST_PRIVILEGES access.", | |
| "BCryptCloseAlgorithmProvider": "Closes an algorithm provider.", | |
| "BCryptCreateHash": "Called to create a hash or Message Authentication Code (MAC) object.", | |
| "BCryptDecrypt": "Decrypts a block of data.", | |
| "BCryptDestroyKey": "Destroys a key.", | |
| "BCryptEncrypt": "Encrypts a block of data. (BCryptEncrypt)", | |
| "BCryptFinishHash": "Retrieves the hash or Message Authentication Code (MAC) value for the data accumulated from prior calls to BCryptHashData.", | |
| "BCryptGenRandom": "Generates a random number.", | |
| "BCryptGenerateSymmetricKey": "Creates a key object for use with a symmetrical key encryption algorithm from a supplied key.", | |
| "BCryptHashData": "Performs a one way hash or Message Authentication Code (MAC) on a data buffer.", | |
| "BCryptOpenAlgorithmProvider": "Loads and initializes a CNG provider.", | |
| "CallNextHookEx": "Passes the hook information to the next hook procedure in the current hook chain. A hook procedure can call this function either before or after processing the hook information.", | |
| "ChangeServiceConfig": "Changes the configuration parameters of a service. (ANSI)", | |
| "ChangeServiceConfig2": "Changes the optional configuration parameters of a service. (ANSI)", | |
| "CheckRemoteDebuggerPresent": "Determines whether the specified process is being debugged.", | |
| "CloseClipboard": "Closes the clipboard.", | |
| "CloseServiceHandle": "Closes a handle to a service control manager or service object.", | |
| "CmCallbackGetKeyObjectID": "The CmCallbackGetKeyObjectID routine retrieves the unique identifier and object name that are associated with a specified registry key object.", | |
| "CmGetCallbackVersion": "The CmGetCallbackVersion routine retrieves the major and minor version numbers for the current version of the configuration manager's registry callback feature.", | |
| "CmRegisterCallback": "The CmRegisterCallback routine is obsolete for Windows Vista and later operating system versions. Use CmRegisterCallbackEx instead.The CmRegisterCallback routine registers a RegistryCallback routine.", | |
| "CmRegisterCallbackEx": "The CmRegisterCallbackEx routine registers a RegistryCallback routine.", | |
| "CmUnRegisterCallback": "The CmUnRegisterCallback routine unregisters a RegistryCallback routine that a CmRegisterCallback or CmRegisterCallbackEx routine previously registered.", | |
| "ControlService": "Sends a control code to a service. (ControlService)", | |
| "CopyFile": "The CopyFile function (winbase.h) copies an existing file to a new file.", | |
| "CopyFileEx": "Copies an existing file to a new file, notifying the application of its progress through a callback function. (CopyFileExA)", | |
| "CreateDirectory": "Creates a new directory. (CreateDirectoryA)", | |
| "CreateEvent": "Creates or opens a named or unnamed event object. (ANSI)", | |
| "CreateFile": "Creates or opens a file or I/O device. The most commonly used I/O devices are as follows:\\_file, file stream, directory, physical disk, volume, console buffer, tape drive, communications resource, mailslot, and pipe. (ANSI)", | |
| "CreateFileMapping": "Creates or opens a named or unnamed file mapping object for a specified file. (CreateFileMappingW)", | |
| "CreateMutex": "Creates or opens a named or unnamed mutex object. (ANSI)", | |
| "CreateProcess": "Creates a new process and its primary thread. The new process runs in the security context of the calling process. (ANSI)", | |
| "CreateProcessAsUser": "Creates a new process and its primary thread. The new process runs in the security context of the user represented by the specified token. (ANSI)", | |
| "CreateProcessWithLogon": "Creates a new process and its primary thread. Then the new process runs the specified executable file in the security context of the specified credentials (user, domain, and password). It can optionally load the user profile for a specified user.", | |
| "CreateProcessWithToken": "Creates a new process and its primary thread. The new process runs in the security context of the specified token. It can optionally load the user profile for the specified user.", | |
| "CreateRemoteThread": "Creates a thread that runs in the virtual address space of another process.", | |
| "CreateRemoteThreadEx": "Creates a thread that runs in the virtual address space of another process and optionally specifies extended attributes such as processor group affinity.", | |
| "CreateSemaphore": "Creates or opens a named or unnamed semaphore object. (CreateSemaphoreW)", | |
| "CreateService": "Creates a service object and adds it to the specified service control manager database. (ANSI)", | |
| "CreateThread": "Creates a thread to execute within the virtual address space of the calling process.", | |
| "CreateToolhelp32Snapshot": "Takes a snapshot of the specified processes, as well as the heaps, modules, and threads used by these processes.", | |
| "CreateWindow": "Creates an overlapped, pop-up, or child window. (ANSI)", | |
| "CreateWindowEx": "Creates an overlapped, pop-up, or child window with an extended window style; otherwise, this function is identical to the CreateWindow function. (ANSI)", | |
| "CryptAcquireContext": "Used to acquire a handle to a particular key container within a particular cryptographic service provider (CSP). This returned handle is used in calls to CryptoAPI functions that use the selected CSP. (ANSI)", | |
| "CryptCreateHash": "Initiates the hashing of a stream of data. It creates and returns to the calling application a handle to a cryptographic service provider (CSP) hash object.", | |
| "CryptDecrypt": "Decrypts data previously encrypted by using the CryptEncrypt function.", | |
| "CryptDeriveKey": "Generates cryptographic session keys derived from a base data value.", | |
| "CryptDestroyKey": "Releases the handle referenced by the hKey parameter.", | |
| "CryptEncrypt": "Encrypts data. The algorithm used to encrypt the data is designated by the key held by the CSP module and is referenced by the hKey parameter.", | |
| "CryptExportKey": "Exports a cryptographic key or a key pair from a cryptographic service provider (CSP) in a secure manner.", | |
| "CryptGenKey": "Generates a random cryptographic session key or a public/private key pair. A handle to the key or key pair is returned in phKey. This handle can then be used as needed with any CryptoAPI function that requires a key handle.", | |
| "CryptGenRandom": "Fills a buffer with cryptographically random bytes.", | |
| "CryptGetHashParam": "Retrieves data that governs the operations of a hash object.", | |
| "CryptHashData": "Adds data to a specified hash object.", | |
| "CryptImportKey": "Transfers a cryptographic key from a key BLOB into a cryptographic service provider (CSP).", | |
| "CryptReleaseContext": "Releases the handle of a cryptographic service provider (CSP) and a key container.", | |
| "DbgPrint": "The DbgPrint routine sends a message to the kernel debugger.", | |
| "DbgPrintEx": "The DbgPrintEx routine sends a string to the kernel debugger if the conditions you specify are met.", | |
| "DeleteCriticalSection": "Releases all resources used by an unowned critical section object.", | |
| "DeleteFile": "Deletes an existing file. (DeleteFileA)", | |
| "DeleteService": "Marks the specified service for deletion from the service control manager database.", | |
| "DestroyWindow": "Destroys the specified window.", | |
| "DispatchMessage": "The DispatchMessage function dispatches a message to a window procedure. It is typically used to dispatch a message retrieved by the GetMessage function.", | |
| "DnsQuery_A": "Is the generic query interface to the DNS namespace, and provides application developers with a DNS query resolution interface. (DnsQuery_A)", | |
| "DnsQuery_W": "Is the generic query interface to the DNS namespace, and provides application developers with a DNS query resolution interface. (DnsQuery_W)", | |
| "DuplicateToken": "Creates a new access token that duplicates one already in existence.", | |
| "DuplicateTokenEx": "Creates a new access token that duplicates an existing token. This function can create either a primary token or an impersonation token.", | |
| "EmptyClipboard": "Empties the clipboard and frees handles to data in the clipboard. The function then assigns ownership of the clipboard to the window that currently has the clipboard open.", | |
| "EnterCriticalSection": "Waits for ownership of the specified critical section object. The function returns when the calling thread is granted ownership.", | |
| "EnumChildWindows": "Enumerates the child windows that belong to the specified parent window by passing the handle to each child window, in turn, to an application-defined callback function.", | |
| "EnumProcessModules": "Retrieves a handle for each module in the specified process.", | |
| "EnumProcessModulesEx": "Retrieves a handle for each module in the specified process that meets the specified filter criteria.", | |
| "EnumProcesses": "Retrieves the process identifier for each process object in the system.", | |
| "EnumServicesStatus": "Enumerates services in the specified service control manager database. The name and status of each service are provided. (ANSI)", | |
| "EnumServicesStatusEx": "Enumerates services in the specified service control manager database. The name and status of each service are provided, along with additional data based on the specified information level. (ANSI)", | |
| "EnumWindows": "Enumerates all top-level windows on the screen by passing the handle to each window, in turn, to an application-defined callback function. EnumWindows continues until the last top-level window is enumerated or the callback function returns FALSE.", | |
| "EtwEventEnabled": "The EtwEventEnabled function verifies whether an event is enabled.", | |
| "EtwRegister": "The EtwRegister function registers the event provider and must be called before a provider can start tracing.", | |
| "EtwUnregister": "The EtwUnregister function unregisters the event provider and must be called before the provider exits.", | |
| "EtwWrite": "The EtwWrite function is a tracing function for publishing events in your kernel-mode driver code.", | |
| "ExAcquireFastMutex": "Learn more about the ExAcquireFastMutex routine.", | |
| "ExAcquireResourceExclusiveLite": "The ExAcquireResourceExclusiveLite routine acquires the given resource for exclusive access by the calling thread.", | |
| "ExAcquireResourceSharedLite": "The ExAcquireResourceSharedLite routine acquires the given resource for shared access by the calling thread.", | |
| "ExAllocatePool": "The ExAllocatePool routine is obsolete, and is exported for existing binaries only. Use ExAllocatePoolWithTag instead. ExAllocatePool allocates pool memory.", | |
| "ExAllocatePool2": "Learn more about: ExAllocatePool2", | |
| "ExAllocatePool3": "Learn more about: ExAllocatePool3", | |
| "ExAllocatePoolWithTag": "Obsolete. Use ExAllocatePool2 instead. The ExAllocatePoolWithTag routine allocates pool memory of the specified type and returns a pointer to the allocated block.", | |
| "ExCreateCallback": "The ExCreateCallback routine either creates a new callback object or opens an existing callback object on behalf of the caller.", | |
| "ExDeleteResourceLite": "The ExDeleteResourceLite routine deletes a given resource from the system's resource list.", | |
| "ExFreePool": "The ExFreePool macro (ntddk.h) routine deallocates a specified block of pool memory that was previously allocated.", | |
| "ExFreePoolWithTag": "The ExFreePoolWithTag routine deallocates a block of pool memory allocated with the specified tag.", | |
| "ExGetPreviousMode": "The ExGetPreviousMode routine returns the previous processor mode for the current thread.", | |
| "ExInitializeFastMutex": "The ExInitializeFastMutex routine initializes a fast mutex variable, used to synchronize mutually exclusive access by a set of threads to a shared resource.", | |
| "ExInitializeResourceLite": "The ExInitializeResourceLite routine initializes a resource variable.", | |
| "ExInitializeWorkItem": "ExInitializeWorkItem initializes a work-queue item with a caller-supplied context and callback routine to be queued for execution when a system worker thread is given control.", | |
| "ExNotifyCallback": "The ExNotifyCallback routine causes all callback routines registered for the given object to be called.", | |
| "ExQueueWorkItem": "ExQueueWorkItem inserts a given work item into a queue from which a system worker thread removes the item and gives control to the routine that the caller supplied to ExInitializeWorkItem.", | |
| "ExRegisterCallback": "The ExRegisterCallback routine registers a given callback routine with a given callback object.", | |
| "ExReleaseFastMutex": "Learn more about the ExReleaseFastMutex routine.", | |
| "ExReleaseResourceLite": "The ExReleaseResourceLite routine releases a specified executive resource owned by the current thread.", | |
| "ExSetTimerResolution": "The ExSetTimerResolution routine modifies the frequency at which the system clock interrupts. Use this routine with extreme caution (see the following Remarks section).", | |
| "ExUnregisterCallback": "The ExUnregisterCallback routine removes a callback routine previously registered with a callback object from the list of routines to be called during the notification process.", | |
| "ExitProcess": "Ends the calling process and all its threads.", | |
| "ExitThread": "Ends the calling thread.", | |
| "ExitWindowsEx": "Logs off the interactive user, shuts down the system, or shuts down and restarts the system.", | |
| "ExpandEnvironmentStrings": "Expands environment-variable strings and replaces them with the values defined for the current user. (ANSI)", | |
| "FindClose": "Closes a file search handle opened by the FindFirstFile, FindFirstFileEx, FindFirstFileNameW, FindFirstFileNameTransactedW, FindFirstFileTransacted, FindFirstStreamTransactedW, or FindFirstStreamW functions.", | |
| "FindFirstFile": "Searches a directory for a file or subdirectory with a name that matches a specific name (or partial name if wildcards are used). (ANSI)", | |
| "FindNextFile": "Continues a file search from a previous call to the FindFirstFile, FindFirstFileEx, or FindFirstFileTransacted functions. (ANSI)", | |
| "FindWindow": "Retrieves a handle to the top-level window whose class name and window name match the specified strings. This function does not search child windows. This function does not perform a case-sensitive search. (ANSI)", | |
| "FindWindowEx": "Retrieves a handle to a window whose class name and window name match the specified strings. The function searches child windows, beginning with the one following the specified child window. This function does not perform a case-sensitive search. (ANSI)", | |
| "FltBuildDefaultSecurityDescriptor": "FltBuildDefaultSecurityDescriptor builds a default security descriptor for use with FltCreateCommunicationPort.", | |
| "FltCloseCommunicationPort": "FltCloseCommunicationPort closes a minifilter driver's communication server port.", | |
| "FltCreateCommunicationPort": "Learn more about the FltCreateCommunicationPort function.", | |
| "FltGetFileNameInformation": "The FltGetFileNameInformation routine returns name information for a file or directory.", | |
| "FltGetRoutineAddress": "The FltGetRoutineAddress routine returns a pointer to a routine specified by the FltMgrRoutineName parameter.", | |
| "FltRegisterFilter": "FltRegisterFilter registers a minifilter driver.", | |
| "FltReleaseFileNameInformation": "FltReleaseFileNameInformation releases a file name information structure.", | |
| "FltSendMessage": "FltSendMessage sends a message to a waiting user-mode application on behalf of a minifilter driver or a minifilter driver instance.", | |
| "FltStartFiltering": "FltStartFiltering starts filtering for a registered minifilter driver.", | |
| "FltUnregisterFilter": "A registered minifilter driver calls FltUnregisterFilter to unregister itself so that the Filter Manager no longer calls it to process I/O operations.", | |
| "GetAddrInfoW": "Provides protocol-independent translation from a Unicode host name to an address.", | |
| "GetAsyncKeyState": "Determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState.", | |
| "GetClipboardData": "Retrieves data from the clipboard in a specified format. The clipboard must have been opened previously.", | |
| "GetCommandLine": "Retrieves the command-line string for the current process. (ANSI)", | |
| "GetComputerName": "Retrieves the NetBIOS name of the local computer. This name is established at system startup, when the system reads it from the registry. (ANSI)", | |
| "GetCurrentProcess": "Retrieves a pseudo handle for the current process.", | |
| "GetCurrentProcessId": "Retrieves the process identifier of the calling process.", | |
| "GetCurrentThread": "Retrieves a pseudo handle for the calling thread.", | |
| "GetCurrentThreadId": "Retrieves the thread identifier of the calling thread.", | |
| "GetEnvironmentStrings": "The GetEnvironmentStrings function (processenv.h) retrieves the environment variables for the current process.", | |
| "GetEnvironmentVariable": "Retrieves the contents of the specified variable from the environment block of the calling process. (GetEnvironmentVariableA)", | |
| "GetFileAttributes": "Retrieves file system attributes for a specified file or directory. (ANSI)", | |
| "GetFileSize": "Retrieves the size of the specified file, in bytes.", | |
| "GetForegroundWindow": "Retrieves a handle to the foreground window (the window with which the user is currently working). The system assigns a slightly higher priority to the thread that creates the foreground window than it does to other threads.", | |
| "GetKeyState": "Retrieves the status of the specified virtual key. The status specifies whether the key is up, down, or toggled (on, off alternating each time the key is pressed).", | |
| "GetKeyboardState": "Copies the status of the 256 virtual keys to the specified buffer.", | |
| "GetLastError": "Retrieves the calling thread's last-error code value.", | |
| "GetLocalTime": "Retrieves the current local date and time.", | |
| "GetMessage": "The GetMessage function retrieves a message from the calling thread's message queue. (GetMessage)", | |
| "GetModuleHandle": "Retrieves a module handle for the specified module. The module must have been loaded by the calling process. (ANSI)", | |
| "GetModuleHandleEx": "Retrieves a module handle for the specified module and increments the module's reference count unless GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT is specified. The module must have been loaded by the calling process. (ANSI)", | |
| "GetNativeSystemInfo": "Retrieves information about the current system to an application running under WOW64.", | |
| "GetProcAddress": "Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).", | |
| "GetSystemInfo": "Retrieves information about the current system.", | |
| "GetSystemTime": "Retrieves the current system date and time in Coordinated Universal Time (UTC) format.", | |
| "GetSystemTimeAsFileTime": "Retrieves the current system date and time. The information is in Coordinated Universal Time (UTC) format.", | |
| "GetThreadContext": "Retrieves the context of the specified thread.", | |
| "GetTickCount": "Retrieves the number of milliseconds that have elapsed since the system was started, up to 49.7 days.", | |
| "GetTickCount64": "Retrieves the number of milliseconds that have elapsed since the system was started.", | |
| "GetTokenInformation": "Retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.", | |
| "GetUserName": "Retrieves the name of the user associated with the current thread. (ANSI)", | |
| "GetVersion": "With the release of Windows 8.1, the behavior of the GetVersion API has changed in the value it will return for the operating system version. The value returned by the GetVersion function now depends on how the application is manifested.", | |
| "GetVersionEx": "With the release of Windows 8.1, the behavior of the GetVersionEx API has changed in the value it will return for the operating system version. The value returned by the GetVersionEx function now depends on how the application is manifested. (ANSI)", | |
| "GetWindowText": "Copies the text of the specified window's title bar (if it has one) into a buffer. If the specified window is a control, the text of the control is copied. However, GetWindowText cannot retrieve the text of a control in another application. (ANSI)", | |
| "GetWindowThreadProcessId": "Retrieves the identifier of the thread that created the specified window and, optionally, the identifier of the process that created the window.", | |
| "GlobalAlloc": "Allocates the specified number of bytes from the heap. (GlobalAlloc)", | |
| "GlobalFree": "Frees the specified global memory object and invalidates its handle.", | |
| "HeapAlloc": "Allocates a block of memory from a heap. The allocated memory is not movable.", | |
| "HeapFree": "Frees a memory block allocated from a heap by the HeapAlloc or HeapReAlloc function.", | |
| "HeapReAlloc": "Reallocates a block of memory from a heap. This function enables you to resize a memory block and change other memory block properties.", | |
| "HttpAddRequestHeaders": "Adds one or more HTTP request headers to the HTTP request handle. (HttpAddRequestHeadersA)", | |
| "HttpOpenRequest": "Creates an HTTP request handle. (ANSI)", | |
| "HttpQueryInfo": "Retrieves header information associated with an HTTP request. (ANSI)", | |
| "HttpSendRequest": "Sends the specified request to the HTTP server, allowing callers to send extra data beyond what is normally passed to HttpSendRequestEx. (ANSI)", | |
| "ImpersonateLoggedOnUser": "Lets the calling thread impersonate the security context of a logged-on user. The user is represented by a token handle.", | |
| "InitializeCriticalSection": "Initializes a critical section object.", | |
| "InitiateShutdown": "Initiates a shutdown and restart of the specified computer, and restarts any applications that have been registered for restart. (ANSI)", | |
| "InitiateSystemShutdown": "Initiates a shutdown and optional restart of the specified computer. (ANSI)", | |
| "InitiateSystemShutdownEx": "Initiates a shutdown and optional restart of the specified computer, and optionally records the reason for the shutdown. (ANSI)", | |
| "InternetConnect": "Opens a File Transfer Protocol (FTP) or HTTP session for a given site. (ANSI)", | |
| "InternetOpen": "Initializes an application's use of the WinINet functions. (ANSI)", | |
| "InternetOpenUrl": "Opens a resource specified by a complete FTP or HTTP URL. (ANSI)", | |
| "InternetReadFile": "Reads data from a handle opened by the InternetOpenUrl, FtpOpenFile, or HttpOpenRequest function.", | |
| "InternetSetOption": "Sets an Internet option. (ANSI)", | |
| "InternetWriteFile": "Writes data to an open Internet file.", | |
| "IoAllocateIrp": "The IoAllocateIrp routine allocates an IRP, given the number of I/O stack locations for each driver layered under the caller, and, optionally, for the caller.", | |
| "IoAllocateWorkItem": "The IoAllocateWorkItem routine allocates a work item.", | |
| "IoAttachDevice": "The IoAttachDevice routine attaches the caller's device object to a named target device object, so that I/O requests bound for the target device are routed first to the caller.", | |
| "IoAttachDeviceToDeviceStack": "The IoAttachDeviceToDeviceStack routine attaches the caller's device object to the highest device object in the chain and returns a pointer to the previously highest device object.", | |
| "IoBuildAsynchronousFsdRequest": "The IoBuildAsynchronousFsdRequest routine allocates and sets up an IRP to be sent to lower-level drivers.", | |
| "IoBuildDeviceIoControlRequest": "The IoBuildDeviceIoControlRequest routine allocates and sets up an IRP for a synchronously processed device control request.", | |
| "IoBuildSynchronousFsdRequest": "The IoBuildSynchronousFsdRequest routine allocates and sets up an IRP for a synchronously processed I/O request.", | |
| "IoCallDriver": "The IoCallDriver routine sends an IRP to the driver associated with a specified device object.", | |
| "IoCancelIrp": "The IoCancelIrp routine sets the cancel bit in a given IRP and calls the cancel routine for the IRP if there is one.", | |
| "IoCompleteRequest": "The IoCompleteRequest routine indicates that the caller has completed all processing for a given I/O request and is returning the given IRP to the I/O manager.", | |
| "IoCreateDevice": "The IoCreateDevice routine creates a device object for use by a driver.", | |
| "IoCreateFile": "The IoCreateFile routine either causes a new file or directory to be created, or it opens an existing file, device, directory, or volume, giving the caller a handle for the file object.", | |
| "IoCreateSymbolicLink": "The IoCreateSymbolicLink routine sets up a symbolic link between a device object name and a user-visible name for the device.", | |
| "IoDeleteDevice": "The IoDeleteDevice routine removes a device object from the system, for example, when the underlying device is removed from the system.", | |
| "IoDeleteSymbolicLink": "The IoDeleteSymbolicLink routine removes a symbolic link from the system.", | |
| "IoDetachDevice": "The IoDetachDevice routine releases an attachment between the caller's device object and a lower driver's device object.", | |
| "IoFreeIrp": "The IoFreeIrp routine releases a caller-allocated IRP from the caller's IoCompletion routine.", | |
| "IoFreeWorkItem": "The IoFreeWorkItem routine frees a work item that was allocated by IoAllocateWorkItem.", | |
| "IoGetCurrentProcess": "The IoGetCurrentProcess routine returns a pointer to the current process.", | |
| "IoGetDeviceObjectPointer": "The IoGetDeviceObjectPointer routine returns a pointer to the top object in the named device object's stack and a pointer to the corresponding file object, if the requested access to the objects can be granted.", | |
| "IoGetRequestorProcess": "The IoGetRequestorProcess routine returns a process pointer for the thread that originally requested a given I/O operation.", | |
| "IoGetRequestorProcessId": "The IoGetRequestorProcessId routine returns the unique 32-bit process ID for the thread that originally requested a given I/O operation.", | |
| "IoGetTopLevelIrp": "The IoGetTopLevelIrp routine in ntifs.h returns the value of the TopLevelIrp field of the current thread.", | |
| "IoOpenDeviceRegistryKey": "The IoOpenDeviceRegistryKey routine returns a handle to a registry state location for a particular device instance.", | |
| "IoQueueWorkItem": "The IoQueueWorkItem routine associates a WorkItem routine with a work item, and it inserts the work item into a queue for later processing by a system worker thread.", | |
| "IoRegisterDeviceInterface": "The IoRegisterDeviceInterface routine registers a device interface class, if it has not been previously registered, and creates a new instance of the interface class, which a driver can subsequently enable for use by applications or other system components.", | |
| "IoRegisterFileSystem": "The IoRegisterFileSystem routine adds a file system's control device object to the global file system queue.", | |
| "IoRegisterFsRegistrationChange": "Learn more about the IoRegisterFsRegistrationChange function.", | |
| "IoRegisterShutdownNotification": "The IoRegisterShutdownNotification routine registers the driver to receive an IRP_MJ_SHUTDOWN IRP when the system is shut down.", | |
| "IoSetCompletionRoutine": "The IoSetCompletionRoutine routine registers an IoCompletion routine, which will be called when the next-lower-level driver has completed the requested operation for the given IRP.", | |
| "IoSetCompletionRoutineEx": "The IoSetCompletionRoutineEx routine registers an IoCompletion routine, which is called when the next-lower-level driver has completed the requested operation for the given IRP.", | |
| "IoSetTopLevelIrp": "The IoSetTopLevelIrp routine in ntifs.h sets the value of the TopLevelIrp field of the current thread.", | |
| "IoWMIRegistrationControl": "The IoWMIRegistrationControl routine registers or unregisters the caller as a WMI data provider for a specified device object.", | |
| "IofCallDriver": "Call **IoCallDriver** instead. Sends an IRP to the driver associated with a specified device object.", | |
| "IsDebuggerPresent": "Determines whether the calling process is being debugged by a user-mode debugger.", | |
| "KdPrintEx": "The KdPrintEx macro sends a string to the kernel debugger if the conditions you specify are met.A call to KdPrintEx requires double parentheses.", | |
| "KeAcquireInStackQueuedSpinLock": "Learn more about the KeAcquireInStackQueuedSpinLock routine.", | |
| "KeAcquireSpinLock": "The KeAcquireSpinLock routine acquires a spin lock so the caller can synchronize access to shared data in a multiprocessor-safe way by raising IRQL.", | |
| "KeAcquireSpinLockAtDpcLevel": "The KeAcquireSpinLockAtDpcLevel routine acquires a spin lock when the caller is already running at IRQL >= DISPATCH_LEVEL.", | |
| "KeBugCheck": "The KeBugCheck routine brings down the system in a controlled manner when the caller discovers an unrecoverable inconsistency that would corrupt the system if the caller continued to run.", | |
| "KeBugCheckEx": "The KeBugCheckEx routine brings down the system in a controlled manner when the caller discovers an unrecoverable inconsistency that would corrupt the system if the caller continued to run.", | |
| "KeCancelTimer": "The KeCancelTimer routine dequeues a timer object before the timer interval, if any was set, expires.", | |
| "KeClearEvent": "The KeClearEvent routine sets an event to a not-signaled state.", | |
| "KeDelayExecutionThread": "The KeDelayExecutionThread routine puts the current thread into an alertable or nonalertable wait state for a specified interval.", | |
| "KeGetCurrentIrql": "The KeGetCurrentIrql routine returns the current IRQL.", | |
| "KeGetCurrentThread": "The KeGetCurrentThread routine identifies the current thread.", | |
| "KeInitializeDpc": "The KeInitializeDpc routine initializes a DPC object, and registers a CustomDpc routine for that object.", | |
| "KeInitializeEvent": "The KeInitializeEvent routine initializes an event object as a synchronization (single waiter) or notification type event and sets it to a signaled or not-signaled state.", | |
| "KeInitializeMutex": "The KeInitializeMutex routine initializes a mutex object, setting it to a signaled state.", | |
| "KeInitializeSemaphore": "The KeInitializeSemaphore routine initializes a semaphore object with a specified count and specifies an upper limit that the count can attain.", | |
| "KeInitializeSpinLock": "The KeInitializeSpinLock routine initializes a variable of type KSPIN_LOCK.", | |
| "KeInitializeTimer": "The KeInitializeTimer routine initializes a timer object.", | |
| "KeInitializeTimerEx": "The KeInitializeTimerEx routine initializes an extended kernel timer object.", | |
| "KeInsertQueueDpc": "The KeInsertQueueDpc routine queues a DPC for execution.", | |
| "KeLowerIrql": "The KeLowerIrql routine restores the IRQL on the current processor to its original value.", | |
| "KeQueryPerformanceCounter": "Learn more about the KeQueryPerformanceCounter routine.", | |
| "KeRaiseIrqlToDpcLevel": "The KeRaiseIrqlToDpcLevel routine raises the hardware priority to IRQL = DISPATCH_LEVEL, thereby masking off interrupts of equivalent or lower IRQL on the current processor.", | |
| "KeReleaseInStackQueuedSpinLock": "The KeReleaseInStackQueuedSpinLock routine releases a queued spin lock acquired by KeAcquireInStackQueuedSpinLock.", | |
| "KeReleaseMutex": "The KeReleaseMutex routine releases a mutex object, and specifies whether the caller is to call one of the KeWaitXxx routines as soon as KeReleaseMutex returns control.", | |
| "KeReleaseSemaphore": "The KeReleaseSemaphore routine releases the specified semaphore object.", | |
| "KeReleaseSpinLock": "The KeReleaseSpinLock routine releases a spin lock and restores the original IRQL at which the caller was running.", | |
| "KeReleaseSpinLockFromDpcLevel": "Learn how the KeReleaseSpinLockFromDpcLevel routine releases an executive spin lock without changing the IRQL.", | |
| "KeRemoveQueueDpc": "The KeRemoveQueueDpc routine removes the specified DPC object from the system DPC queue.", | |
| "KeResetEvent": "The KeResetEvent routine resets a specified event object to a not-signaled state and returns the previous state of that event object.", | |
| "KeSetEvent": "The KeSetEvent routine sets an event object to a signaled state if the event was not already signaled, and returns the previous state of the event object.", | |
| "KeSetTimer": "The KeSetTimer routine sets the absolute or relative interval at which a timer object is to be set to a signaled state and, optionally, supplies a CustomTimerDpc routine to be executed when that interval expires.", | |
| "KeSetTimerEx": "The KeSetTimerEx routine sets the absolute or relative interval at which a timer object is to be set to a signaled state, optionally supplies a CustomTimerDpc routine to be executed when that interval expires, and optionally supplies a recurring interval for the timer.", | |
| "KeStackAttachProcess": "The KeStackAttachProcess routine attaches the current thread to the address space of the target process.", | |
| "KeUnstackDetachProcess": "The KeUnstackDetachProcess routine detaches the current thread from the address space of a process and restores the previous attach state.", | |
| "KeWaitForMultipleObjects": "The KeWaitForMultipleObjects routine puts the current thread into an alertable or nonalertable wait state until any or all of a number of dispatcher objects are set to a signaled state or (optionally) until the wait times out.", | |
| "KeWaitForSingleObject": "The KeWaitForSingleObject routine puts the current thread into a wait state until the given dispatcher object is set to a signaled state or (optionally) until the wait times out.", | |
| "LeaveCriticalSection": "Releases ownership of the specified critical section object.", | |
| "LoadLibrary": "Loads the specified module into the address space of the calling process. (LoadLibraryA)", | |
| "LoadLibraryEx": "Loads the specified module into the address space of the calling process. (LoadLibraryExA)", | |
| "LocalAlloc": "Allocates the specified number of bytes from the heap. (LocalAlloc)", | |
| "LocalFree": "Frees the specified local memory object and invalidates its handle.", | |
| "LogonUser": "The Win32 LogonUser function attempts to log a user on to the local computer. LogonUser returns a handle to a user token that you can use to impersonate user. (ANSI)", | |
| "LogonUserEx": "The LogonUserEx function attempts to log a user on to the local computer. (ANSI)", | |
| "LookupPrivilegeValue": "Retrieves the locally unique identifier (LUID) used on a specified system to locally represent the specified privilege name. (ANSI)", | |
| "MapViewOfFile": "Maps a view of a file mapping into the address space of a calling process.", | |
| "MapViewOfFileEx": "Maps a view of a file mapping into the address space of a calling process. A caller can optionally specify a suggested base memory address for the view.", | |
| "MessageBox": "The MessageBox function displays a modal dialog box that contains a system icon, a set of buttons, and a brief application-specific message.", | |
| "MessageBoxEx": "Creates, displays, and operates a message box. (ANSI)", | |
| "MmAllocateContiguousMemory": "The MmAllocateContiguousMemory routine allocates a range of contiguous, nonpaged physical memory and maps it to the system address space.", | |
| "MmAllocateNonCachedMemory": "The MmAllocateNonCachedMemory routine allocates a virtual address range of non-cached and cache-aligned memory.", | |
| "MmBuildMdlForNonPagedPool": "The MmBuildMdlForNonPagedPool routine receives an MDL that specifies a nonpaged virtual memory buffer, and updates it to describe the underlying physical pages.", | |
| "MmFreeContiguousMemory": "The MmFreeContiguousMemory routine releases a range of physically contiguous memory that was allocated by an MmAllocateContiguousMemoryXxx routine.", | |
| "MmFreeNonCachedMemory": "The MmFreeNonCachedMemory routine releases a range of noncached memory that was allocated by the MmAllocateNonCachedMemory routine.", | |
| "MmGetSystemAddressForMdlSafe": "Learn more about: MmGetSystemAddressForMdlSafe", | |
| "MmIsAddressValid": "The MmIsAddressValid routine checks whether a page fault will occur for a read or write operation at a given virtual address.Warning We do not recommend using this function.", | |
| "MmMapIoSpace": "The MmMapIoSpace routine maps the given physical address range to nonpaged system space.", | |
| "MmMapLockedPages": "The MmMapLockedPages routine is obsolete for Windows 2000 and later versions of Windows, and for Windows Me.", | |
| "MmMapLockedPagesSpecifyCache": "The MmMapLockedPagesSpecifyCache routine maps the physical pages that are described by an MDL to a virtual address, and enables the caller to specify the cache attribute that is used to create the mapping.", | |
| "MmProbeAndLockPages": "The MmProbeAndLockPages routine probes the specified virtual memory pages, makes them resident, and locks them in memory.", | |
| "MmProtectMdlSystemAddress": "The MmProtectMdlSystemAddress routine sets the protection type for a memory address range.", | |
| "MmSecureVirtualMemory": "The MmSecureVirtualMemory routine secures a user-space memory address range so that it cannot be freed and its protection type cannot be made more restrictive.", | |
| "MmUnlockPages": "The MmUnlockPages routine unlocks the physical pages that are described by the specified memory descriptor list (MDL).", | |
| "MmUnmapIoSpace": "The MmUnmapIoSpace routine unmaps a specified range of physical addresses previously mapped by MmMapIoSpace.", | |
| "MmUnmapLockedPages": "The MmUnmapLockedPages routine releases a mapping that was set up by a preceding call to the MmMapLockedPages or MmMapLockedPagesSpecifyCache routine.", | |
| "MmUnsecureVirtualMemory": "The MmUnsecureVirtualMemory routine unsecures a memory address range secured by the MmSecureVirtualMemory routine.", | |
| "Module32First": "The Module32First function (tlhelp32.h) retrieves information about the first module associated with a process.", | |
| "Module32Next": "The Module32Next function (tlhelp32.h) retrieves information about the next module associated with a process or thread.", | |
| "MoveFile": "The MoveFile function (winbase.h) moves an existing file or a directory, including its children.", | |
| "MoveFileEx": "Moves an existing file or directory, including its children, with various move options. (ANSI)", | |
| "MsgWaitForMultipleObjects": "Waits until one or all of the specified objects are in the signaled state or the time-out interval elapses. The objects can include input event objects.", | |
| "NCryptDecrypt": "Decrypts a block of encrypted data.", | |
| "NCryptEncrypt": "Encrypts a block of data. (NCryptEncrypt)", | |
| "NCryptOpenStorageProvider": "Loads and initializes a CNG key storage provider.", | |
| "NtAllocateVirtualMemory": "Learn more about the NtAllocateVirtualMemory routine.", | |
| "NtClose": "Deprecated. Closes the specified handle. NtClose is superseded by CloseHandle.", | |
| "NtCreateFile": "Creates a new file or directory, or opens an existing file, device, directory, or volume.", | |
| "NtCreateSection": "Learn about the NtCreateSection function.", | |
| "NtDeviceIoControlFile": "Deprecated. Builds descriptors for the supplied buffer(s) and passes the untyped data to the device driver associated with the file handle. NtDeviceIoControlFile is superseded by DeviceIoControl.", | |
| "NtFsControlFile": "Learn more about the NtFsControlFile routine.", | |
| "NtOpenFile": "Opens an existing file, device, directory, or volume, and returns a handle for the file object.", | |
| "NtOpenProcess": "The ZwOpenProcess routine opens a handle to a process object and sets the access rights to this object.", | |
| "NtOpenProcessToken": "The NtOpenProcessToken routine opens the access token associated with a process, and returns a handle that can be used to access that token.", | |
| "NtQueryDirectoryFile": "The NtQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file handle.", | |
| "NtQueryInformationFile": "The NtQueryInformationFile routine returns various kinds of information about a file object.", | |
| "NtQueryInformationProcess": "Retrieves information about the specified process. (NtQueryInformationProcess)", | |
| "NtQueryInformationThread": "Retrieves information about the specified thread. (NtQueryInformationThread)", | |
| "NtQuerySystemInformation": "Retrieves the specified system information.", | |
| "NtReadFile": "Learn more about the NtReadFile routine.", | |
| "NtSetInformationFile": "The NtSetInformationFile routine in ntifs.h changes various kinds of information about a file object.", | |
| "NtWriteFile": "Learn more about the NtWriteFile routine.", | |
| "ObDereferenceObject": "The ObDereferenceObject routine decrements the given object's reference count and performs retention checks.", | |
| "ObGetObjectSecurity": "The ObGetObjectSecurity routine gets the security descriptor for a given object.", | |
| "ObOpenObjectByPointer": "The ObOpenObjectByPointer function opens an object referenced by a pointer and returns a handle to the object.", | |
| "ObReferenceObjectByHandle": "The ObReferenceObjectByHandle routine provides access validation on the object handle, and, if access can be granted, returns the corresponding pointer to the object's body.", | |
| "ObReferenceObjectByPointer": "The ObReferenceObjectByPointer routine increments the pointer reference count for a given object.", | |
| "ObRegisterCallbacks": "The ObRegisterCallbacks routine registers a list of callback routines for thread, process, and desktop handle operations.", | |
| "ObUnRegisterCallbacks": "The ObUnRegisterCallbacks routine unregisters a set of callback routines that were registered with the ObRegisterCallbacks routine.", | |
| "ObfReferenceObject": "The ObfReferenceObject routine increments the reference count to the given object.", | |
| "OpenClipboard": "Opens the clipboard for examination and prevents other applications from modifying the clipboard content.", | |
| "OpenEvent": "Opens an existing named event object. (ANSI)", | |
| "OpenFile": "Creates, opens, reopens, or deletes a file.", | |
| "OpenFileMapping": "Opens a named file mapping object. (OpenFileMappingW)", | |
| "OpenMutex": "Opens an existing named mutex object.", | |
| "OpenProcess": "Opens an existing local process object.", | |
| "OpenProcessToken": "Opens the access token associated with a process.", | |
| "OpenSCManager": "Establishes a connection to the service control manager on the specified computer and opens the specified service control manager database. (ANSI)", | |
| "OpenSemaphore": "Opens an existing named semaphore object.", | |
| "OpenService": "Opens an existing service. (ANSI)", | |
| "OpenThread": "Opens an existing thread object.", | |
| "OpenThreadToken": "Opens the access token associated with a thread.", | |
| "OutputDebugString": "Sends a string to the debugger for display. (ANSI)", | |
| "PeekMessage": "Dispatches incoming nonqueued messages, checks the thread message queue for a posted message, and retrieves the message (if any exist). (ANSI)", | |
| "PostMessage": "Places (posts) a message in the message queue associated with the thread that created the specified window and returns without waiting for the thread to process the message. (ANSI)", | |
| "Process32First": "The Process32First function (tlhelp32.h) retrieves information about the first process encountered in a system snapshot.", | |
| "Process32Next": "The Process32Next function (tlhelp32.h) retrieves information about the next process recorded in a system snapshot.", | |
| "PsCreateSystemThread": "The PsCreateSystemThread routine creates a system thread that executes in kernel mode and returns a handle for the thread.", | |
| "PsGetCurrentProcessId": "The PsGetCurrentProcessId routine identifies the current thread's process.", | |
| "PsGetCurrentThread": "The PsGetCurrentThread routine identifies the current thread.", | |
| "PsGetCurrentThreadId": "The PsGetCurrentThreadId routine identifies the current thread.", | |
| "PsGetProcessId": "The PsGetProcessId routine returns the process identifier (process ID) that is associated with a specified process.", | |
| "PsIsSystemThread": "The PsIsSystemThread routine checks whether a given thread is a system thread.", | |
| "PsLookupProcessByProcessId": "The PsLookupProcessByProcessId routine accepts the process ID of a process and returns a referenced pointer to EPROCESS structure of the process.", | |
| "PsLookupThreadByThreadId": "The PsLookupThreadByThreadId routine accepts the thread ID of a thread and returns a referenced pointer to the ETHREAD structure of the thread.", | |
| "PsRemoveCreateThreadNotifyRoutine": "The PsRemoveCreateThreadNotifyRoutine routine removes a callback routine that was registered by the PsSetCreateThreadNotifyRoutine routine.", | |
| "PsRemoveLoadImageNotifyRoutine": "The PsRemoveLoadImageNotifyRoutine routine removes a callback routine that was registered by the PsSetLoadImageNotifyRoutine routine.", | |
| "PsSetCreateProcessNotifyRoutine": "The PsSetCreateProcessNotifyRoutine routine adds a driver-supplied callback routine to, or removes it from, a list of routines to be called whenever a process is created or deleted.", | |
| "PsSetCreateProcessNotifyRoutineEx": "The PsSetCreateProcessNotifyRoutineEx routine registers or removes a callback routine that notifies the caller when a process is created or exits.", | |
| "PsSetCreateProcessNotifyRoutineEx2": "The PsSetCreateProcessNotifyRoutineEx2 routine registers or removes a callback routine that notifies the caller when a process is created or deleted.", | |
| "PsSetCreateThreadNotifyRoutine": "The PsSetCreateThreadNotifyRoutine routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.", | |
| "PsSetCreateThreadNotifyRoutineEx": "The PsSetCreateThreadNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified when a new thread is created and when such a thread is deleted.", | |
| "PsSetLoadImageNotifyRoutine": "The PsSetLoadImageNotifyRoutine routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded (or mapped into memory).", | |
| "PsSetLoadImageNotifyRoutineEx": "The PsSetLoadImageNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded (or mapped into memory).", | |
| "PsTerminateSystemThread": "The PsTerminateSystemThread routine terminates the current system thread.", | |
| "QueryPerformanceCounter": "Retrieves the current value of the performance counter, which is a high resolution (<1µs) time stamp that can be used for time-interval measurements.", | |
| "QueryPerformanceFrequency": "Retrieves the frequency of the performance counter.", | |
| "QueryServiceStatus": "Retrieves the current status of the specified service.", | |
| "QueryServiceStatusEx": "Retrieves the current status of the specified service based on the specified information level.", | |
| "QueueUserAPC": "Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread. (QueueUserAPC)", | |
| "QueueUserAPC2": "Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread. (QueueUserAPC2)", | |
| "ReadFile": "Reads data from the specified file or input/output (I/O) device. Reads occur at the position specified by the file pointer if supported by the device.", | |
| "ReadFileEx": "Reads data from the specified file or input/output (I/O) device. It reports its completion status asynchronously, calling the specified completion routine when reading is completed or canceled and the calling thread is in an alertable wait state.", | |
| "ReadProcessMemory": "Reads data from an area of memory in a specified process. The entire area to be read must be accessible or the operation fails.", | |
| "RegCloseKey": "Closes a handle to the specified registry key.", | |
| "RegCreateKey": "Creates the specified registry key. If the key already exists in the registry, the function opens it. (ANSI)", | |
| "RegCreateKeyEx": "Creates the specified registry key. If the key already exists, the function opens it. Note that key names are not case sensitive. (ANSI)", | |
| "RegDeleteKey": "Deletes a subkey and its values. (ANSI)", | |
| "RegDeleteKeyEx": "Deletes a subkey and its values from the specified platform-specific view of the registry. (ANSI)", | |
| "RegDeleteValue": "Removes a named value from the specified registry key. (ANSI)", | |
| "RegEnumKey": "Enumerates the subkeys of the specified open registry key. (RegEnumKeyA)", | |
| "RegEnumKeyEx": "Enumerates the subkeys of the specified open registry key. The function retrieves information about one subkey each time it is called. (ANSI)", | |
| "RegEnumValue": "Enumerates the values for the specified open registry key. The function copies one indexed value name and data block for the key each time it is called. (ANSI)", | |
| "RegOpenKey": "Opens the specified registry key. (ANSI)", | |
| "RegOpenKeyEx": "Opens the specified registry key. Note that key names are not case sensitive. (ANSI)", | |
| "RegQueryValue": "Retrieves the data associated with the default or unnamed value of a specified registry key. The data must be a null-terminated string. (ANSI)", | |
| "RegQueryValueEx": "Retrieves the type and data for the specified value name associated with an open registry key. (ANSI)", | |
| "RegSetValue": "Sets the data for the default or unnamed value of a specified registry key. The data must be a text string. (ANSI)", | |
| "RegSetValueEx": "Sets the data and type of a specified value under a registry key. (ANSI)", | |
| "RegisterHotKey": "Defines a system-wide hot key.", | |
| "ReleaseMutex": "Releases ownership of the specified mutex object.", | |
| "ReleaseSemaphore": "Increases the count of the specified semaphore object by a specified amount.", | |
| "RemoveDirectory": "Deletes an existing empty directory. (ANSI)", | |
| "ResetEvent": "Sets the specified event object to the nonsignaled state.", | |
| "ResumeThread": "Decrements a thread's suspend count. When the suspend count is decremented to zero, the execution of the thread is resumed.", | |
| "RevertToSelf": "Terminates the impersonation of a client application.", | |
| "RtlAllocateHeap": "The RtlAllocateHeap routine allocates a block of memory from a heap.", | |
| "RtlAnsiStringToUnicodeString": "Converts the specified ANSI source string into a Unicode string.", | |
| "RtlCaptureContext": "Retrieves a context record in the context of the caller.", | |
| "RtlCaptureStackBackTrace": "The RtlCaptureStackBackTrace routine captures a stack back trace by walking up the stack and recording the information for each frame.", | |
| "RtlCheckRegistryKey": "The RtlCheckRegistryKey routine checks for the existence of a given named key in the registry.", | |
| "RtlCompareMemory": "The RtlCompareMemory routine compares two blocks of memory and returns the number of bytes that match until the first difference.", | |
| "RtlCopyMemory": "The RtlCopyMemory routine copies the contents of a source memory block to a destination memory block.", | |
| "RtlCreateHeap": "The RtlCreateHeap routine creates a heap object that can be used by the calling process. This routine reserves space in the virtual address space of the process and allocates physical storage for a specified initial portion of this block.", | |
| "RtlCreateRegistryKey": "The RtlCreateRegistryKey routine adds a key object in the registry along a given relative path.", | |
| "RtlDeleteRegistryValue": "The RtlDeleteRegistryValue routine removes the specified entry name and the associated values from the registry along the given relative path.", | |
| "RtlDestroyHeap": "The RtlDestroyHeap routine destroys the specified heap object. RtlDestroyHeap decommits and releases all the pages of a private heap object, and it invalidates the handle to the heap.", | |
| "RtlEqualMemory": "The RtlEqualMemory routine compares two blocks of memory to determine whether the specified number of bytes are identical.", | |
| "RtlFreeHeap": "The RtlFreeHeap routine frees a memory block that was allocated from a heap by RtlAllocateHeap.", | |
| "RtlGetVersion": "The RtlGetVersion routine returns version information about the currently running operating system.", | |
| "RtlInitAnsiString": "The RtlInitAnsiString routine initializes a counted string of ANSI characters.", | |
| "RtlInitUnicodeString": "Initializes a counted Unicode string.", | |
| "RtlLookupFunctionEntry": "Searches the active function tables for an entry that corresponds to the specified PC value.", | |
| "RtlMoveMemory": "The RtlMoveMemory routine copies the contents of a source memory block to a destination memory block, and supports overlapping source and destination memory blocks.", | |
| "RtlQueryRegistryValues": "The RtlQueryRegistryValues routine allows the caller to query several values from the registry subtree with a single call.", | |
| "RtlRandom": "The RtlRandom routine returns a random number that was generated from a given seed value.", | |
| "RtlRandomEx": "The RtlRandomEx routine returns a random number that was generated from a given seed value.", | |
| "RtlSecureZeroMemory": "The RtlSecureZeroMemory routine securely fills a block of memory with zeros in a way that is guaranteed not to be optimized away by the compiler.", | |
| "RtlUnicodeStringToAnsiString": "Converts the specified Unicode source string into an ANSI string.", | |
| "RtlVirtualUnwind": "Retrieves the invocation context of the function that precedes the specified function context.", | |
| "RtlWriteRegistryValue": "The RtlWriteRegistryValue routine writes caller-supplied data into the registry along the specified relative path at the given value name.", | |
| "RtlZeroMemory": "The RtlZeroMemory macro (minitape.h) fills a block of memory with zeros, given a pointer to the block and the length, in bytes, to be filled.", | |
| "SeAccessCheck": "The SeAccessCheck routine determines whether the requested access rights can be granted to an object protected by a security descriptor and an object owner.", | |
| "SeCaptureSubjectContext": "The SeCaptureSubjectContext routine in ntifs.h captures the security context of the calling thread for access validation and auditing.", | |
| "SePrivilegeCheck": "The SePrivilegeCheck routine determines whether a specified set of privileges is enabled in the subject's access token.", | |
| "SeReleaseSubjectContext": "Learn more about the SeReleaseSubjectContext routine.", | |
| "SeSinglePrivilegeCheck": "The SeSinglePrivilegeCheck routine checks for the passed privilege value in the context of the current thread.", | |
| "SendInput": "Synthesizes keystrokes, mouse motions, and button clicks.", | |
| "SendMessage": "The SendMessage function sends the specified message to a window or windows. (SendMessage function)", | |
| "SetClipboardData": "Places data on the clipboard in a specified clipboard format.", | |
| "SetEnvironmentVariable": "Sets the contents of the specified environment variable for the current process. (SetEnvironmentVariableA)", | |
| "SetEvent": "Sets the specified event object to the signaled state.", | |
| "SetFilePointer": "Moves the file pointer of the specified file. (SetFilePointer)", | |
| "SetFilePointerEx": "Moves the file pointer of the specified file. (SetFilePointerEx)", | |
| "SetForegroundWindow": "Brings the thread that created the specified window into the foreground and activates the window.", | |
| "SetLastError": "Sets the last-error code for the calling thread.", | |
| "SetSystemPowerState": "Suspends the system by shutting power down. Depending on the ForceFlag parameter, the function either suspends operation immediately or requests permission from all applications and device drivers before doing so.", | |
| "SetThreadContext": "Sets the context for the specified thread.", | |
| "SetTokenInformation": "Sets various types of information for a specified access token.", | |
| "SetWindowText": "Changes the text of the specified window's title bar (if it has one). If the specified window is a control, the text of the control is changed. However, SetWindowText cannot change the text of a control in another application. (ANSI)", | |
| "SetWindowsHookEx": "Installs an application-defined hook procedure into a hook chain. (ANSI)", | |
| "ShellExecute": "Performs an operation on a specified file. (ShellExecuteA)", | |
| "ShellExecuteEx": "Performs an operation on a specified file. (ShellExecuteExA)", | |
| "ShowWindow": "Sets the specified window's show state.", | |
| "SignalObjectAndWait": "Signals one object and waits on another object as a single operation.", | |
| "Sleep": "Suspends the execution of the current thread until the time-out interval elapses.", | |
| "SleepEx": "Suspends the current thread until the specified condition is met.", | |
| "StartService": "Starts a service. (ANSI)", | |
| "SuspendThread": "Suspends the specified thread.", | |
| "TerminateProcess": "Terminates the specified process and all of its threads.", | |
| "Thread32First": "Retrieves information about the first thread of any process encountered in a system snapshot.", | |
| "Thread32Next": "Retrieves information about the next thread of any process encountered in the system memory snapshot.", | |
| "TranslateMessage": "Translates virtual-key messages into character messages. The character messages are posted to the calling thread's message queue, to be read the next time the thread calls the GetMessage or PeekMessage function.", | |
| "UnhookWindowsHookEx": "Removes a hook procedure installed in a hook chain by the SetWindowsHookEx function.", | |
| "UnregisterHotKey": "Frees a hot key previously registered by the calling thread.", | |
| "UpdateWindow": "The UpdateWindow function updates the client area of the specified window by sending a WM_PAINT message to the window if the window's update region is not empty.", | |
| "VirtualAlloc": "Reserves, commits, or changes the state of a region of pages in the virtual address space of the calling process. (VirtualAlloc)", | |
| "VirtualAllocEx": "Reserves, commits, or changes the state of a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero. (VirtualAllocEx)", | |
| "VirtualAllocExNuma": "Reserves, commits, or changes the state of a region of memory within the virtual address space of the specified process, and specifies the NUMA node for the physical memory.", | |
| "VirtualFree": "Releases, decommits, or releases and decommits a region of pages within the virtual address space of the calling process.", | |
| "VirtualFreeEx": "Releases, decommits, or releases and decommits a region of memory within the virtual address space of a specified process.", | |
| "VirtualProtect": "Changes the protection on a region of committed pages in the virtual address space of the calling process. (VirtualProtect)", | |
| "VirtualProtectEx": "Changes the protection on a region of committed pages in the virtual address space of a specified process.", | |
| "WSAAccept": "The WSAAccept function conditionally accepts a connection based on the return value of a condition function, provides quality of service flow specifications, and allows the transfer of connection data.", | |
| "WSACleanup": "The WSACleanup function (winsock.h) terminates use of the WS2_32.dll.", | |
| "WSAConnect": "The WSAConnect function establishes a connection to another socket application, exchanges connect data, and specifies required quality of service based on the specified FLOWSPEC structure.", | |
| "WSAPoll": "The WSAPoll function determines status of one or more sockets.", | |
| "WSARecv": "Receives data from a connected socket or a bound connectionless socket. (WSARecv)", | |
| "WSASend": "Sends data on a connected socket. (WSASend)", | |
| "WSASocket": "The WSASocket function creates a socket that is bound to a specific transport-service provider. (ANSI)", | |
| "WSAStartup": "The WSAStartup function (winsock.h) initiates use of the Winsock DLL by a process.", | |
| "WaitForMultipleObjects": "Waits until one or all of the specified objects are in the signaled state or the time-out interval elapses.", | |
| "WaitForMultipleObjectsEx": "Waits until one or all of the specified objects are in the signaled state, an I/O completion routine or asynchronous procedure call (APC) is queued to the thread, or the time-out interval elapses.", | |
| "WaitForSingleObject": "Waits until the specified object is in the signaled state or the time-out interval elapses.", | |
| "WaitForSingleObjectEx": "Waits until the specified object is in the signaled state, an I/O completion routine or asynchronous procedure call (APC) is queued to the thread, or the time-out interval elapses.", | |
| "WdfDeviceCreate": "The WdfDeviceCreate method creates a framework device object.", | |
| "WdfDeviceInitAssignName": "The WdfDeviceInitAssignName method assigns a device name to a device's device object.", | |
| "WdfDeviceInitSetIoType": "The WdfDeviceInitSetIoType method sets the method or preference for how a driver will access the data buffers that are included in read and write requests for a specified device.", | |
| "WdfDpcCreate": "The WdfDpcCreate method creates a framework DPC object and registers an EvtDpcFunc callback function.", | |
| "WdfDpcEnqueue": "The WdfDpcEnqueue method schedules the execution of a DPC object's EvtDpcFunc callback function.", | |
| "WdfDriverCreate": "The WdfDriverCreate method creates a framework driver object for the calling driver.", | |
| "WdfFileObjectGetFileName": "The WdfFileObjectGetFileName method returns the file name that a specified framework file object contains.", | |
| "WdfIoQueueCreate": "The WdfIoQueueCreate method creates and configures an I/O queue for a specified device.", | |
| "WdfIoTargetCreate": "The WdfIoTargetCreate method creates a remote I/O target for a specified device.", | |
| "WdfIoTargetSendIoctlSynchronously": "The WdfIoTargetSendIoctlSynchronously method builds a device control request and sends it synchronously to an I/O target.", | |
| "WdfMemoryCreate": "The WdfMemoryCreate method creates a framework memory object and allocates a memory buffer of a specified size.", | |
| "WdfRegistryAssignValue": "The WdfRegistryAssignValue method assigns specified data to a specified value name in the registry.", | |
| "WdfRegistryCreateKey": "The WdfRegistryCreateKey method creates and opens a specified registry key, or just opens the key if it already exists, and creates a framework registry-key object that represents the registry key.", | |
| "WdfRegistryOpenKey": "The WdfRegistryOpenKey method opens a specified registry key and creates a framework registry-key object that represents the registry key.", | |
| "WdfRegistryQueryValue": "The WdfRegistryQueryValue method retrieves the data that is currently assigned to a specified registry value.", | |
| "WdfRequestComplete": "The WdfRequestComplete method completes a specified I/O request and supplies a completion status.", | |
| "WdfRequestCompleteWithInformation": "The WdfRequestCompleteWithInformation method stores completion information and then completes a specified I/O request with a supplied completion status.", | |
| "WdfRequestGetParameters": "The WdfRequestGetParameters method retrieves the parameters that are associated with a specified framework request object.", | |
| "WdfSpinLockAcquire": "The WdfSpinLockAcquire method acquires a specified spin lock.", | |
| "WdfSpinLockCreate": "The WdfSpinLockCreate method creates a framework spin-lock object.", | |
| "WdfSpinLockRelease": "The WdfSpinLockAcquire method releases a specified spin lock.", | |
| "WdfTimerCreate": "The WdfTimerCreate method creates a framework timer object.", | |
| "WdfTimerStart": "The WdfTimerStart method starts a timer's clock.", | |
| "WdfWaitLockAcquire": "The WdfWaitLockAcquire method acquires a specified wait lock.", | |
| "WdfWaitLockCreate": "The WdfWaitLockCreate method creates a framework wait-lock object.", | |
| "WdfWaitLockRelease": "The WdfWaitLockRelease method releases a specified wait lock.", | |
| "WdfWorkItemCreate": "The WdfWorkItemCreate method creates a framework work-item object, which can subsequently be added to the system's work-item queue.", | |
| "WdfWorkItemEnqueue": "The WdfWorkItemEnqueue method adds a specified framework work-item object to the system's work-item queue.", | |
| "WinExec": "Runs the specified application.", | |
| "WinHttpConnect": "The WinHttpConnect function specifies the initial target server of an HTTP request and returns an HINTERNET connection handle to an HTTP session for that initial target.", | |
| "WinHttpOpen": "Initializes, for an application, the use of WinHTTP functions and returns a WinHTTP-session handle.", | |
| "WinHttpOpenRequest": "The WinHttpOpenRequest function creates an HTTP request handle.", | |
| "WinHttpQueryHeaders": "The WinHttpQueryHeaders function retrieves header information associated with an HTTP request.", | |
| "WinHttpReadData": "The WinHttpReadData function reads data from a handle opened by the WinHttpOpenRequest function.", | |
| "WinHttpReceiveResponse": "The WinHttpReceiveResponse function waits to receive the response to an HTTP request initiated by WinHttpSendRequest.", | |
| "WinHttpSendRequest": "Sends the specified request to the HTTP server. (WinHttpSendRequest)", | |
| "WinHttpWriteData": "The WinHttpWriteData function writes request data to an HTTP server.", | |
| "WriteFile": "Writes data to the specified file or input/output (I/O) device.", | |
| "WriteFileEx": "Writes data to the specified file or input/output (I/O) device. It reports its completion status asynchronously, calling the specified completion routine when writing is completed or canceled and the calling thread is in an alertable wait state.", | |
| "WriteProcessMemory": "Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.", | |
| "ZwAllocateVirtualMemory": "The ZwAllocateVirtualMemory routine reserves, commits, or both, a region of pages within the user-mode virtual address space of a specified process.", | |
| "ZwClose": "The ZwClose routine in wdm.h closes an object handle. ZwClose is a generic routine that operates on any type of object.", | |
| "ZwCreateDirectoryObject": "The ZwCreateDirectoryObject routine creates or opens an object-directory object.", | |
| "ZwCreateFile": "The ZwCreateFile routine creates a new file or opens an existing file.", | |
| "ZwCreateKey": "The ZwCreateKey routine creates a new registry key or opens an existing one.", | |
| "ZwCreateSection": "The ZwCreateSection routine in wdm.h creates a section object. Once the handle pointed to is no longer in use, the driver must close it.", | |
| "ZwDeviceIoControlFile": "This routine sends a control code directly to a specified device driver, causing the corresponding driver to perform the specified operation.", | |
| "ZwDuplicateObject": "The ZwDuplicateObject routine creates a handle that is a duplicate of the specified source handle.", | |
| "ZwEnumerateKey": "The ZwEnumerateKey routine returns information about a subkey of an open registry key.", | |
| "ZwEnumerateValueKey": "The ZwEnumerateValueKey routine gets information about the value entries of an open key.", | |
| "ZwFsControlFile": "The ZwFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action.", | |
| "ZwLoadDriver": "The ZwLoadDriver routine loads a driver into the system.", | |
| "ZwMapViewOfSection": "The ZwMapViewOfSection routine maps a view of a section into the virtual address space of a subject process.", | |
| "ZwNotifyChangeKey": "Learn more about the ZwNotifyChangeKey function.", | |
| "ZwOpenDirectoryObject": "The ZwOpenDirectoryObject routine opens an existing directory object.", | |
| "ZwOpenFile": "The ZwOpenFile routine in wdm.h opens an existing file, directory, device, or volume. Once the handle pointed to is no longer in use, the driver must close it.", | |
| "ZwOpenKey": "The ZwOpenKey routine opens an existing registry key.", | |
| "ZwOpenProcess": "Learn how the ZwOpenProcess routine opens a handle to a process object and sets the access rights to this object.", | |
| "ZwOpenSection": "The ZwOpenSection routine opens a handle for an existing section object.", | |
| "ZwOpenSymbolicLinkObject": "The ZwOpenSymbolicLinkObject routine opens an existing symbolic link.", | |
| "ZwQueryDirectoryFile": "The ZwQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file handle.", | |
| "ZwQueryInformationFile": "The ZwQueryInformationFile routine returns various kinds of information about a file object.", | |
| "ZwQueryKey": "The ZwQueryKey routine provides information about the class of a registry key, and the number and sizes of its subkeys.", | |
| "ZwReadFile": "The ZwReadFile routine in wdm.h reads data from an open file. Callers of ZwReadFile must have already called ZwCreateFile.", | |
| "ZwSetInformationFile": "The ZwSetInformationFile routine in wdm.h changes various kinds of information about a file object. It ignores unsupported members of FILE_XXX_INFORMATION.", | |
| "ZwUnloadDriver": "The ZwUnloadDriver routine unloads a driver from the system.", | |
| "ZwUnmapViewOfSection": "The ZwUnmapViewOfSection routine unmaps a view of a section from the virtual address space of a subject process.", | |
| "ZwWriteFile": "The ZwWriteFile routine writes data to an open file.", | |
| "accept": "The accept function permits an incoming connection attempt on a socket.", | |
| "bind": "The bind function (winsock.h) associates a local address with a socket.", | |
| "closesocket": "The closesocket function (winsock.h) closes an existing socket.", | |
| "connect": "The connect function establishes a connection to a specified socket.", | |
| "getaddrinfo": "Provides protocol-independent translation from an ANSI host name to an address.", | |
| "gethostbyname": "The gethostbyname function (winsock.h) retrieves host information corresponding to a host name from a host database.", | |
| "inet_addr": "The inet_addr function (winsock.h) converts a string containing an IPv4 dotted-decimal address into a proper address for the IN_ADDR structure.", | |
| "inet_ntop": "The InetNtop function converts an IPv4 or IPv6 Internet network address into a string in Internet standard format. The ANSI version of this function is inet_ntop. (InetNtopA or inet_ntop)", | |
| "inet_pton": "The InetPton function converts an IPv4 or IPv6 Internet network address in its standard text presentation form into its numeric binary form. The ANSI version of this function is inet_pton. (InetPtonA or inet_pton)", | |
| "keybd_event": "Synthesizes a keystroke.", | |
| "listen": "The listen function places a socket in a state in which it is listening for an incoming connection.", | |
| "mouse_event": "The mouse_event function synthesizes mouse motion and button clicks.", | |
| "recv": "The recv function (winsock.h) receives data from a connected socket or a bound connectionless socket.", | |
| "recvfrom": "The recvfrom function receives a datagram and stores the source address.", | |
| "select": "The select function determines the status of one or more sockets, waiting if necessary, to perform synchronous I/O.", | |
| "send": "Sends data on a connected socket. (send)", | |
| "sendto": "The sendto function (winsock.h) sends data to a specific destination.", | |
| "shutdown": "The shutdown function (winsock.h) disables sends or receives on a socket.", | |
| "socket": "The socket function creates a socket that is bound to a specific transport service provider.", | |
| } | |
| _TAG_LEAD = { | |
| "other_process": "Interacts with another process.", | |
| "process_mem_write": "Writes to another process's memory.", | |
| "process_mem_read": "Reads another process's memory.", | |
| "mem_alloc": "Allocates memory.", | |
| "mem_protect": "Changes memory protection.", | |
| "create_thread": "Creates a thread.", | |
| "remote_thread": "Creates a thread in another process.", | |
| "create_process": "Creates or launches a process.", | |
| "file_io": "Performs file I/O.", | |
| "registry": "Accesses the Windows registry.", | |
| "network": "Performs network communication.", | |
| "dynamic_import": "Resolves an API or module at runtime.", | |
| "enum_process": "Enumerates processes, threads, or modules.", | |
| "keyboard_input": "Reads user input state.", | |
| "window_ui": "Interacts with windows or GUI.", | |
| "crypto": "Performs OS cryptographic operations.", | |
| "service": "Interacts with Windows services.", | |
| "token_priv": "Queries or modifies security tokens/privileges.", | |
| "sync": "Uses synchronization primitives.", | |
| "inspect_state": "Queries debug/timing/system state.", | |
| "shutdown_power": "Changes system power or reboots.", | |
| "clipboard": "Reads or writes the system clipboard.", | |
| "environment": "Reads process environment or command line.", | |
| "driver_io": "Creates or dispatches driver I/O (device objects, IRPs, IOCTLs).", | |
| "driver_object": "Manipulates named kernel objects.", | |
| "driver_callback": "Registers a kernel-mode callback or notification.", | |
| "kernel_sync": "Uses kernel synchronization primitives.", | |
| "dpc_apc": "Schedules a DPC, APC, timer or work item.", | |
| } | |
| def short_doc(name): | |
| d = MSDN_DOCS.get(name) | |
| if d: | |
| return d | |
| tags = API_TAGS.get(name, []) | |
| if not tags: | |
| return "" | |
| return " ".join(_TAG_LEAD.get(t, t) for t in tags) | |