cmchek.c File Reference

#include "cmp.h"

Go to the source code of this file.

Defines
#define	REG_MAX_PLAUSIBLE_KEY_SIZE
Functions
ULONG	CmpCheckRegistry2 (HCELL_INDEX Cell, HCELL_INDEX ParentCell)
ULONG	CmpCheckKey (HCELL_INDEX Cell, HCELL_INDEX ParentCell)
ULONG	CmpCheckValueList (PHHIVE Hive, PCELL_DATA List, ULONG Count)
ULONG	CmCheckRegistry (PCMHIVE CmHive, BOOLEAN Clean)
Variables
ULONG	CmpUsedStorage
PCMHIVE	CmpMasterHive
struct {
PHHIVE   Hive
ULONG   Status
}	CmCheckRegistryDebug
struct {
PHHIVE   Hive
ULONG   Status
}	CmpCheckRegistry2Debug
struct {
PHHIVE   Hive
ULONG   Status
HCELL_INDEX   Cell
PCELL_DATA   CellPoint
PVOID   RootPoint
ULONG   Index
}	CmpCheckKeyDebug
struct {
PHHIVE   Hive
ULONG   Status
PCELL_DATA   List
ULONG   Index
HCELL_INDEX   Cell
PCELL_DATA   CellPoint
}	CmpCheckValueListDebug
PHHIVE	CmpCheckHive
BOOLEAN	CmpCheckClean

---

Define Documentation

#define REG_MAX_PLAUSIBLE_KEY_SIZE

Value: ((FIELD_OFFSET(CM_KEY_NODE, Name)) + \ (sizeof(WCHAR) * MAX_KEY_NAME_LENGTH) + 16) Definition at line 27 of file cmchek.c. Referenced by CmpCheckKey().

---

Function Documentation

ULONG CmCheckRegistry (  PCMHIVE  CmHive, BOOLEAN  Clean )

Definition at line 108 of file cmchek.c. References _HHIVE::BaseBlock, CmCheckRegistryDebug, CmpCheckClean, CmpCheckHive, CmpCheckRegistry2(), CmpMasterHive, CmpUsedStorage, CmpValidateHiveSecurityDescriptors(), HCELL_NIL, Hive, _CMHIVE::Hive, HvCheckHive(), _HBASE_BLOCK::RootCell, and UsedStorage. Referenced by CmpInitializeHive(), CmpInitializeSystemHive(), and HvRefreshHive(). : Check consistency of the registry within a given hive. Start from root, and check that: . Each child key points back to its parent. . All allocated cells are refered to exactly once (requires looking inside the hive structure...) [This also detects space leaks.] . All allocated cells are reachable from the root. NOTE: Exactly 1 ref rule may change with security. Arguments: CmHive - supplies a pointer to the CM hive control structure for the hive of interest. Clean - if TRUE, references to volatile cells will be zapped (done at startup only to avoid groveling hives twice.) if FALSE, nothing will be changed. Return Value: 0 if Hive is OK. Error return indicator if not. RANGE: 3000 - 3999 --*/ { PHHIVE Hive; ULONG rc = 0; ULONG Storage; if (CmHive == CmpMasterHive) { return(0); } CmpUsedStorage = 0; CmCheckRegistryDebug.Hive = (PHHIVE)CmHive; CmCheckRegistryDebug.Status = 0; // // check the underlying hive and get storage use // Hive = &CmHive->Hive; rc = HvCheckHive(Hive, &Storage); if (rc != 0) { CmCheckRegistryDebug.Status = rc; return rc; } // // Call recursive helper to check out the values and subkeys // CmpCheckHive = (PHHIVE)CmHive; CmpCheckClean = Clean; rc = CmpCheckRegistry2(Hive->BaseBlock->RootCell, HCELL_NIL); // // Validate all the security descriptors in the hive // if (!CmpValidateHiveSecurityDescriptors(Hive)) { KdPrint(("CmCheckRegistry:")); KdPrint((" CmpValidateHiveSecurityDescriptors failed\n")); rc = 3040; CmCheckRegistryDebug.Status = rc; } #if 0 // // Check allocated storage against used storage // if (CmpUsedStorage != Storage) { KdPrint(("CmCheckRegistry:")); KdPrint((" Storage Used:%08lx Allocated:%08lx\n", UsedStorage, Storage)); rc = 3042; CmCheckRegistryDebug.Status = rc; } #endif // // Print a bit of a summary (make sure this data avail in all error cases) // if (rc > 0) { KdPrint(("CmCheckRegistry Failed (%d): CmHive:%08lx\n", rc, CmHive)); KdPrint((" Hive:%08lx Root:%08lx\n", Hive, Hive->BaseBlock->RootCell)); } return rc; }

ULONG CmpCheckKey (  HCELL_INDEX  Cell, HCELL_INDEX  ParentCell )

Definition at line 323 of file cmchek.c. References Cell, _CM_KEY_NODE::Class, _CM_KEY_NODE::ClassLength, CM_KEY_FAST_LEAF, CM_KEY_INDEX_LEAF, CM_KEY_INDEX_ROOT, CM_KEY_NODE_SIGNATURE, CmpCheckClean, CmpCheckHive, CmpCheckKeyDebug, CmpCheckValueList(), _CM_KEY_INDEX::Count, _CHILD_LIST::Count, FALSE, HCELL_INDEX, HCELL_NIL, HvGetCell, HvGetCellSize(), HvGetCellType, HvIsCellAllocated(), HvMarkCellDirty(), _CELL_DATA::_u::KeyNode, _CM_KEY_INDEX::List, _CHILD_LIST::List, Name, _CM_KEY_NODE::NameLength, NULL, _CM_KEY_NODE::Parent, PCM_KEY_INDEX, REG_MAX_PLAUSIBLE_KEY_SIZE, _CM_KEY_NODE::Security, SetUsed, _CM_KEY_INDEX::Signature, _CM_KEY_NODE::Signature, Stable, _CM_KEY_NODE::SubKeyCounts, _CM_KEY_NODE::SubKeyLists, TRUE, _CELL_DATA::u, _CM_KEY_NODE::ValueList, and Volatile. Referenced by CmpCheckRegistry2(). : Check consistency of the registry, for a particular cell . Check that the cell's value list, child key list, class, security are OK. . Check that each value entry IN the list is OK. Globals: CmpCheckHive - hive we're working on CmpCheckClean - flag TRUE -> clean off volatiles, FALSE -> don't Arguments: Cell - HCELL_INDEX of subkey to work on. ParentCell - expected value of parent cell for Cell, unless HCELL_NIL, in which case ignore. Return Value: 0 if Hive is OK. Error return indicator if not. RANGE: 4000 - 4999 --*/ { PCELL_DATA pcell; ULONG size; ULONG usedlen; ULONG ClassLength; HCELL_INDEX Class; ULONG ValueCount; HCELL_INDEX ValueList; HCELL_INDEX Security; ULONG rc = 0; ULONG nrc = 0; ULONG i; PCM_KEY_INDEX Root; PCM_KEY_INDEX Leaf; ULONG SubCount; CmpCheckKeyDebug.Hive = CmpCheckHive; CmpCheckKeyDebug.Status = 0; CmpCheckKeyDebug.Cell = Cell; CmpCheckKeyDebug.CellPoint = NULL; CmpCheckKeyDebug.RootPoint = NULL; CmpCheckKeyDebug.Index = (ULONG)-1; // // Check key itself // if (! HvIsCellAllocated(CmpCheckHive, Cell)) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tNot allocated\n")); rc = 4010; CmpCheckKeyDebug.Status = rc; return rc; } pcell = HvGetCell(CmpCheckHive, Cell); SetUsed(CmpCheckHive, Cell); CmpCheckKeyDebug.CellPoint = pcell; size = HvGetCellSize(CmpCheckHive, pcell); if (size > REG_MAX_PLAUSIBLE_KEY_SIZE) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tImplausible size %lx\n", size)); rc = 4020; CmpCheckKeyDebug.Status = rc; return rc; } usedlen = FIELD_OFFSET(CM_KEY_NODE, Name) + pcell->u.KeyNode.NameLength; if (usedlen > size) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tKey is bigger than containing cell.\n")); rc = 4030; CmpCheckKeyDebug.Status = rc; return rc; } if (pcell->u.KeyNode.Signature != CM_KEY_NODE_SIGNATURE) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tNo key signature\n")); rc = 4040; CmpCheckKeyDebug.Status = rc; return rc; } if (ParentCell != HCELL_NIL) { if (pcell->u.KeyNode.Parent != ParentCell) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tWrong parent value.\n")); rc = 4045; CmpCheckKeyDebug.Status = rc; return rc; } } ClassLength = pcell->u.KeyNode.ClassLength; Class = pcell->u.KeyNode.Class; ValueCount = pcell->u.KeyNode.ValueList.Count; ValueList = pcell->u.KeyNode.ValueList.List; Security = pcell->u.KeyNode.Security; // // Check simple non-empty cases // if (ClassLength > 0) { if( Class == HCELL_NIL ) { pcell->u.KeyNode.ClassLength = 0; HvMarkCellDirty(CmpCheckHive, Cell); KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx has ClassLength = %lu and Class == HCELL_NIL\n", CmpCheckHive, Cell,ClassLength)); } else { if (HvIsCellAllocated(CmpCheckHive, Class) == FALSE) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tClass:%08lx - unallocated class\n", Class)); rc = 4080; CmpCheckKeyDebug.Status = rc; return rc; } else { SetUsed(CmpCheckHive, Class); } } } if (Security != HCELL_NIL) { if (HvIsCellAllocated(CmpCheckHive, Security) == FALSE) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tSecurity:%08lx - unallocated security\n", Security)); rc = 4090; CmpCheckKeyDebug.Status = rc; return rc; } else if (HvGetCellType(Security) == Volatile) { SetUsed(CmpCheckHive, Security); } // // Else CmpValidateHiveSecurityDescriptors must do computation // } // // Check value list case // if (ValueCount > 0) { if (HvIsCellAllocated(CmpCheckHive, ValueList) == FALSE) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tValueList:%08lx - unallocated valuelist\n", ValueList)); rc = 4100; CmpCheckKeyDebug.Status = rc; return rc; } else { SetUsed(CmpCheckHive, ValueList); pcell = HvGetCell(CmpCheckHive, ValueList); nrc = CmpCheckValueList(CmpCheckHive, pcell, ValueCount); if (nrc != 0) { KdPrint(("List was for CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); rc = nrc; CmpCheckKeyDebug.CellPoint = pcell; CmpCheckKeyDebug.Status = rc; return rc; } } } // // Check subkey list case // pcell = HvGetCell(CmpCheckHive, Cell); CmpCheckKeyDebug.CellPoint = pcell; if ((HvGetCellType(Cell) == Volatile) && (pcell->u.KeyNode.SubKeyCounts[Stable] != 0)) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tVolatile Cell has Stable children\n")); rc = 4108; CmpCheckKeyDebug.Status = rc; return rc; } else if (pcell->u.KeyNode.SubKeyCounts[Stable] > 0) { if (! HvIsCellAllocated(CmpCheckHive, pcell->u.KeyNode.SubKeyLists[Stable])) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tStableKeyList:%08lx - unallocated\n", pcell->u.KeyNode.SubKeyLists[Stable])); rc = 4110; CmpCheckKeyDebug.Status = rc; return rc; } else { SetUsed(CmpCheckHive, pcell->u.KeyNode.SubKeyLists[Stable]); // // Prove that the index is OK // Root = (PCM_KEY_INDEX)HvGetCell( CmpCheckHive, pcell->u.KeyNode.SubKeyLists[Stable] ); CmpCheckKeyDebug.RootPoint = Root; if ((Root->Signature == CM_KEY_INDEX_LEAF) || (Root->Signature == CM_KEY_FAST_LEAF)) { if ((ULONG)Root->Count != pcell->u.KeyNode.SubKeyCounts[Stable]) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tBad Index count @%08lx\n", Root)); rc = 4120; CmpCheckKeyDebug.Status = rc; return rc; } } else if (Root->Signature == CM_KEY_INDEX_ROOT) { SubCount = 0; for (i = 0; i < Root->Count; i++) { CmpCheckKeyDebug.Index = i; if (! HvIsCellAllocated(CmpCheckHive, Root->List[i])) { KdPrint(("CmpCheckKey: Hive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tBad Leaf Cell %08lx Root@%08lx\n", Root->List[i], Root)); rc = 4130; CmpCheckKeyDebug.Status = rc; return rc; } Leaf = (PCM_KEY_INDEX)HvGetCell(CmpCheckHive, Root->List[i]); if ((Leaf->Signature != CM_KEY_INDEX_LEAF) && (Leaf->Signature != CM_KEY_FAST_LEAF)) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tBad Leaf Index @%08lx Root@%08lx\n", Leaf, Root)); rc = 4140; CmpCheckKeyDebug.Status = rc; return rc; } SetUsed(CmpCheckHive, Root->List[i]); SubCount += Leaf->Count; } if (pcell->u.KeyNode.SubKeyCounts[Stable] != SubCount) { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tBad count in index, SubCount=%08lx\n", SubCount)); rc = 4150; CmpCheckKeyDebug.Status = rc; return rc; } } else { KdPrint(("CmpCheckKey: CmpCheckHive:%08lx Cell:%08lx\n", CmpCheckHive, Cell)); KdPrint(("\tBad Root index signature @%08lx\n", Root)); rc = 4120; CmpCheckKeyDebug.Status = rc; return rc; } } } // // force volatiles to be empty, if this is a load operation // if (CmpCheckClean == TRUE) { pcell->u.KeyNode.SubKeyCounts[Volatile] = 0; pcell->u.KeyNode.SubKeyLists[Volatile] = HCELL_NIL; } return rc; }

ULONG CmpCheckRegistry2 (  HCELL_INDEX  Cell, HCELL_INDEX  ParentCell )

Definition at line 210 of file cmchek.c. References Cell, CmpCheckHive, CmpCheckKey(), CmpCheckRegistry2Debug, CmpFindSubKeyByNumber(), HCELL_INDEX, HvGetCell, Index, _CELL_DATA::_u::KeyNode, _CM_KEY_NODE::Parent, Stable, _CM_KEY_NODE::SubKeyCounts, _CELL_DATA::u, and _CM_KEY_NODE::WorkVar. Referenced by CmCheckRegistry(). : Check consistency of the registry, from a particular cell on down. . Check that the cell's value list, child key list, class, security are OK. . Check that each value entry IN the list is OK. . Apply self to each child key list. Globals: CmpCheckHive - hive we're working on CmpCheckClean - flag TRUE -> clean off volatiles, FALSE -> don't Arguments: Cell - HCELL_INDEX of subkey to work on. ParentCell - expected value of parent cell for Cell, unless HCELL_NIL, in which case ignore. Return Value: 0 if Hive is OK. Error return indicator if not. RANGE: 4000 - 4999 --*/ { ULONG Index = 0; HCELL_INDEX StartCell = Cell; HCELL_INDEX SubKey; ULONG rc = 0; PCELL_DATA pcell; CmpCheckRegistry2Debug.Hive = CmpCheckHive; CmpCheckRegistry2Debug.Status = 0; // // A jump to NewKey amounts to a virtual call to check the // next child cell. (a descent into the tree) // // Cell, ParentCell, Index, and globals are defined // NewKey: rc = CmpCheckKey(Cell, ParentCell); if (rc != 0) { KdPrint(("\tChild is list entry #%08lx\n", Index)); CmpCheckRegistry2Debug.Status = rc; return rc; } // // save Index and check out children // pcell = HvGetCell(CmpCheckHive, Cell); pcell->u.KeyNode.WorkVar = Index; for (Index = 0; Index<pcell->u.KeyNode.SubKeyCounts[Stable]; Index++) { SubKey = CmpFindSubKeyByNumber(CmpCheckHive, (PCM_KEY_NODE)HvGetCell(CmpCheckHive,Cell), Index); // // "recurse" onto child // ParentCell = Cell; Cell = SubKey; goto NewKey; ResumeKey:; // A jump here is a virtual return // Cell, ParentCell and Index // must be defined } // // since we're here, we've checked out all the children // of the current cell. // if (Cell == StartCell) { // // we are done // return 0; } // // "return" to "parent instance" // pcell = HvGetCell(CmpCheckHive, Cell); Index = pcell->u.KeyNode.WorkVar; Cell = ParentCell; pcell = HvGetCell(CmpCheckHive, Cell); ParentCell = pcell->u.KeyNode.Parent; goto ResumeKey; }

ULONG CmpCheckValueList (  PHHIVE  Hive, PCELL_DATA  List, ULONG  Count )

Definition at line 588 of file cmchek.c. References Cell, CM_KEY_VALUE_SIGNATURE, CM_KEY_VALUE_SPECIAL_SIZE, CmpCheckValueListDebug, Count, _CM_KEY_VALUE::Data, _CM_KEY_VALUE::DataLength, FALSE, HCELL_INDEX, HCELL_NIL, Hive, HvGetCell, HvGetCellSize(), HvIsCellAllocated(), _CELL_DATA::_u::KeyList, _CELL_DATA::_u::KeyValue, List, Name, _CM_KEY_VALUE::NameLength, NULL, SetUsed, _CM_KEY_VALUE::Signature, and _CELL_DATA::u. Referenced by CmpCheckKey(). 00595 : 00596 00597 Check consistency of a value list. 00598 . Each element allocated? 00599 . Each element have valid signature? 00600 . Data properly allocated? 00601 00602 Arguments: 00603 00604 Hive - containing Hive. 00605 00606 List - pointer to an array of HCELL_INDEX entries. 00607 00608 Count - number of entries in list. 00609 00610 Return Value: 00611 00612 0 if Hive is OK. Error return indicator if not. 00613 00614 RANGE: 5000 - 5999 00615 00616 --*/ 00617 { 00618 ULONG i; 00619 HCELL_INDEX Cell; 00620 PCELL_DATA pcell; 00621 ULONG size; 00622 ULONG usedlen; 00623 ULONG DataLength; 00624 HCELL_INDEX Data; 00625 ULONG rc = 0; 00626 00627 CmpCheckValueListDebug.Hive = Hive; 00628 CmpCheckValueListDebug.Status = 0; 00629 CmpCheckValueListDebug.List = List; 00630 CmpCheckValueListDebug.Index = (ULONG)-1; 00631 CmpCheckValueListDebug.Cell = 0; // NOT HCELL_NIL 00632 CmpCheckValueListDebug.CellPoint = NULL; 00633 00634 for (i = 0; i < Count; i++) { 00635 00636 // 00637 // Check out value entry's refs. 00638 // 00639 Cell = List->u.KeyList[i]; 00640 if (Cell == HCELL_NIL) { 00641 KdPrint(("CmpCheckValueList: List:%08lx i:%08lx\n", List, i)); 00642 KdPrint(("\tEntry is null\n")); 00643 rc = 5010; 00644 CmpCheckValueListDebug.Status = rc; 00645 CmpCheckValueListDebug.Index = i; 00646 CmpCheckValueListDebug.Cell = Cell; 00647 return rc; 00648 } 00649 if (HvIsCellAllocated(Hive, Cell) == FALSE) { 00650 KdPrint(("CmpCheckValueList: List:%08lx i:%08lx\n", List, i)); 00651 KdPrint(("\tEntry is not allocated\n")); 00652 rc = 5020; 00653 CmpCheckValueListDebug.Status = rc; 00654 CmpCheckValueListDebug.Index = i; 00655 CmpCheckValueListDebug.Cell = Cell; 00656 return rc; 00657 } else { 00658 SetUsed(Hive, Cell); 00659 } 00660 00661 // 00662 // Check out the value entry itself 00663 // 00664 pcell = HvGetCell(Hive, Cell); 00665 size = HvGetCellSize(Hive, pcell); 00666 if (pcell->u.KeyValue.Signature != CM_KEY_VALUE_SIGNATURE) { 00667 KdPrint(("CmpCheckValueList: List:%08lx i:%08lx\n", List, i)); 00668 KdPrint(("\tCell:%08lx - invalid value signature\n", Cell)); 00669 rc = 5030; 00670 CmpCheckValueListDebug.Status = rc; 00671 CmpCheckValueListDebug.Index = i; 00672 CmpCheckValueListDebug.Cell = Cell; 00673 CmpCheckValueListDebug.CellPoint = pcell; 00674 return rc; 00675 } 00676 usedlen = FIELD_OFFSET(CM_KEY_VALUE, Name) + pcell->u.KeyValue.NameLength; 00677 if (usedlen > size) { 00678 KdPrint(("CmpCheckValueList: List:%08lx i:%08lx\n", List, i)); 00679 KdPrint(("\tCell:%08lx - value bigger than containing cell\n", Cell)); 00680 rc = 5040; 00681 CmpCheckValueListDebug.Status = rc; 00682 CmpCheckValueListDebug.Index = i; 00683 CmpCheckValueListDebug.Cell = Cell; 00684 CmpCheckValueListDebug.CellPoint = pcell; 00685 return rc; 00686 } 00687 00688 // 00689 // Check out value entry's data 00690 // 00691 DataLength = pcell->u.KeyValue.DataLength; 00692 if (DataLength < CM_KEY_VALUE_SPECIAL_SIZE) { 00693 Data = pcell->u.KeyValue.Data; 00694 if ((DataLength == 0) && (Data != HCELL_NIL)) { 00695 KdPrint(("CmpCheckValueList: List:%08lx i:%08lx\n", List, i)); 00696 KdPrint(("\tCell:%08lx Data:%08lx - data not null\n", Cell, Data)); 00697 rc = 5050; 00698 CmpCheckValueListDebug.Status = rc; 00699 CmpCheckValueListDebug.Index = i; 00700 CmpCheckValueListDebug.Cell = Cell; 00701 CmpCheckValueListDebug.CellPoint = pcell; 00702 return rc; 00703 } 00704 if (DataLength > 0) { 00705 if (HvIsCellAllocated(Hive, Data) == FALSE) { 00706 KdPrint(("CmpCheckValueList: List:%08lx i:%08lx\n", List, i)); 00707 KdPrint(("\tCell:%08lx Data:%08lx - unallocated\n", Cell, Data)); 00708 rc = 5060; 00709 CmpCheckValueListDebug.Status = rc; 00710 CmpCheckValueListDebug.Index = i; 00711 CmpCheckValueListDebug.Cell = Cell; 00712 CmpCheckValueListDebug.CellPoint = pcell; 00713 return rc; 00714 } else { 00715 SetUsed(Hive, Data); 00716 } 00717 } 00718 } 00719 } 00720 return rc; 00721 } }

---

Variable Documentation

HCELL_INDEX Cell

Definition at line 96 of file cmchek.c. Referenced by CmDeleteKey(), CmDeleteValueKey(), CmEnumerateKey(), CmpAddInfoAfterParseFailure(), CmpAssignSecurityDescriptor(), CmpCacheLookup(), CmpCheckKey(), CmpCheckRegistry2(), CmpCheckValueList(), CmpCreateKeyControlBlock(), CmpCreateLinkNode(), CmpDeleteTree(), CmpDestroyHive(), CmpDoCompareKeyName(), CmpDoCreate(), CmpDoOpen(), CmpFreeKeyBody(), CmpFreeKeyByCell(), CmpFreeKeyValues(), CmpFreeSecurityDescriptor(), CmpFreeValue(), CmpGetObjectSecurity(), CmpInitializeKeyNameString(), CmpInitializeValueNameString(), CmpInsertSecurityCellList(), CmpIsLoadType(), CmpLoadHiveVolatile(), CmpMarkKeyDirty(), CmpMarkKeyParentDirty(), CmpMarkKeyValuesDirty(), CmpParseKey(), CmpRefreshHive(), CmpRemoveSecurityCellList(), CmpReportNotify(), CmQueryValueKey(), CmRestoreKey(), CmSaveKey(), CmSetLastWriteTimeKey(), CmSetValueKey(), CmUnloadKey(), EhpAttachSecurity(), HvFreeCell(), HvIsBinDirty(), HvIsCellAllocated(), HvMarkCellDirty(), HvpGetCellPaged(), NtQueryOpenSubKeys(), NtUnloadKey(), and ScanCell().

PCELL_DATA CellPoint

Definition at line 97 of file cmchek.c.

struct { ... } CmCheckRegistryDebug

Referenced by CmCheckRegistry().

BOOLEAN CmpCheckClean

Definition at line 104 of file cmchek.c. Referenced by CmCheckRegistry(), and CmpCheckKey().

PHHIVE CmpCheckHive

Definition at line 103 of file cmchek.c. Referenced by CmCheckRegistry(), CmpCheckKey(), and CmpCheckRegistry2().

struct { ... } CmpCheckKeyDebug

Referenced by CmpCheckKey().

struct { ... } CmpCheckRegistry2Debug

Referenced by CmpCheckRegistry2().

struct { ... } CmpCheckValueListDebug

Referenced by CmpCheckValueList().

PCMHIVE CmpMasterHive

Definition at line 36 of file cmchek.c. Referenced by CmCheckRegistry(), CmFlushKey(), CmInitSystem1(), CmpCreateLinkNode(), CmpCreateRegistryRoot(), CmpDestroyHive(), CmpDoFlushAll(), CmpGetHiveName(), CmpLoadHiveVolatile(), CmpParseKey(), CmpReportNotify(), CmRestoreKey(), and CmSaveKey().

ULONG CmpUsedStorage

Definition at line 34 of file cmchek.c. Referenced by CmCheckRegistry().

PHHIVE Hive

Definition at line 92 of file cmchek.c. Referenced by CmCheckRegistry(), CmDeleteKey(), CmDeleteValueKey(), CmEnumerateKey(), CmEnumerateValueKey(), CmFlushKey(), CmGetSystemDriverList(), CmpAddDriverToList(), CmpAddInfoAfterParseFailure(), CmpAddSubKey(), CmpAddToLeaf(), CmpAssignSecurityDescriptor(), CmpCacheLookup(), CmpCheckNotifyAccess(), CmpCheckValueList(), CmpCompareInIndex(), CmpCopyName(), CmpCreateKeyControlBlock(), CmpCreateLinkNode(), CmpCreateRootNode(), CmpDeleteTree(), CmpDestroyHive(), CmpDoCompareKeyName(), CmpDoCreate(), CmpDoCreateChild(), CmpDoFileSetSize(), CmpDoFindSubKeyByNumber(), CmpDoOpen(), CmpEnumKeyObjectCallback(), CmpFileFlush(), CmpFileRead(), CmpFileSetSize(), CmpFileWrite(), CmpFindDrivers(), CmpFindMatchingDescriptorCell(), CmpFindNameInList(), CmpFindNLSData(), CmpFindSubKeyByName(), CmpFindSubKeyByNumber(), CmpFindSubKeyInLeaf(), CmpFindSubKeyInRoot(), CmpFindTagIndex(), CmpFindValueByNameFromCache(), CmpFlushNotify(), CmpFreeDriverList(), CmpFreeKeyBody(), CmpFreeKeyByCell(), CmpFreeKeyValues(), CmpFreeSecurityDescriptor(), CmpFreeValue(), CmpGetKeySecurity(), CmpGetObjectSecurity(), CmpGetSymbolicLink(), CmpGetValueDataFromCache(), CmpGetValueKeyFromCache(), CmpGetValueListFromCache(), CmpInitializeHiveList(), CmpInsertSecurityCellList(), CmpIsLoadType(), CmpLoadHiveVolatile(), CmpMarkIndexDirty(), CmpMarkKeyDirty(), CmpMarkKeyParentDirty(), CmpMarkKeyValuesDirty(), CmpNameSize(), CmpNotifyChangeKey(), CmpNotifyTriggerCheck(), CmpParseKey(), CmpQueryKeyData(), CmpQueryKeyValueData(), CmpRefreshHive(), CmpRemoveSecurityCellList(), CmpRemoveSubKey(), CmpReportNotify(), CmpReportNotifyHelper(), CmpSelectLeaf(), CmpSetCurrentProfile(), CmpSetSecurityDescriptorInfo(), CmpSetValueKeyExisting(), CmpSetValueKeyNew(), CmpSortDriverList(), CmpSplitLeaf(), CmpValidateHiveSecurityDescriptors(), CmQueryMultipleValueKey(), CmReplaceKey(), CmRestoreKey(), CmSaveKey(), CmSaveMergedKeys(), CmSetLastWriteTimeKey(), CmSetValueKey(), CmUnloadKey(), EhCreateChild(), EhGetKeySecurity(), EhOpenChildByName(), EhOpenChildByNumber(), EhOpenHive(), EhpAttachSecurity(), HvCheckBin(), HvCheckHive(), HvFreeCell(), HvFreeHive(), HvFreeHivePartial(), HvInitializeHive(), HvIsBinDirty(), HvIsCellAllocated(), HvLoadHive(), HvMarkCellDirty(), HvMarkClean(), HvMarkDirty(), HvpAddBin(), HvpAllocateMap(), HvpBuildMap(), HvpBuildMapAndCopy(), HvpCleanMap(), HvpCoalesceDiscardedBins(), HvpDiscardBins(), HvpDoWriteHive(), HvpEnlistBinInMap(), HvpEnlistFreeCells(), HvpFindNextDirtyBlock(), HvpFreeAllocatedBins(), HvpFreeMap(), HvpGetCellPaged(), HvpGetHiveHeader(), HvpGetLogHeader(), HvpGrowLog1(), HvpGrowLog2(), HvpInitMap(), HvpReadFileImageAndBuildMap(), HvpRecoverData(), HvpTruncateBins(), HvpWriteLog(), HvRefreshHive(), HvSyncHive(), HvWriteHive(), NtQueryOpenSubKeys(), and NtUnloadKey().

ULONG Index

Definition at line 95 of file cmchek.c. Referenced by __C_specific_handler(), AlFindNextMatchComponent(), AllocatePoolInternal(), AlMatchArcNamToken(), Calc323Dim_Data8To8_Lut16(), Calc324Dim_Data8To8_Lut16(), Calc423Dim_Data8To8_Lut16(), Calc424Dim_Data8To8_Lut16(), CalcNDim_Data8To8_Lut16(), CcCalculateVacbLevelLockCount(), CcGetBcbListHeadLargeOffset(), CcInitializeCacheManager(), CcSetVacbLargeOffset(), CheckHandleFlag(), CmEnumerateKey(), CmEnumerateValueKey(), CmGetSystemControlValues(), CmpAddDriverToList(), CmpAddInfoAfterParseFailure(), CmpAddSubKey(), CmpCheckRegistry2(), CmpCompareInIndex(), CmpDoFindSubKeyByNumber(), CmpFindControlSet(), CmpFindDrivers(), CmpFindNLSData(), CmpFindSubKeyByNumber(), CmpFindSubKeyInLeaf(), CmpFindSubKeyInRoot(), CmpFindValueByNameFromCache(), CmpGetNameControlBlock(), CmpGetSymbolicLink(), CmpGetValueKeyFromCache(), CmpInitializeHiveList(), CmpInsertKeyHash(), CmpIsLoadType(), CmpMarkIndexDirty(), CmpParseKey(), CmpRemoveKeyHash(), CmpSelectLeaf(), CmpSortDriverList(), CmpWalkPath(), CmQueryValueKey(), Convert2Ascii(), CreateColorantArray(), CreateColSpArray(), CreateColSpProc(), CreateFloatString(), CreateHostLutCRD(), CreateLutCRD(), CreateMonoCRD(), DereferenceIoHandle(), DisplayModeTransition(), DoPartitionDelete(), EhCreateChild(), EhEnumerateKey(), EhEnumerateValueKey(), EhOpenChildByName(), EhOpenChildByNumber(), EnableAllPrivileges(), ExAllocatePool(), ExAllocatePoolWithTag(), ExFreePoolWithTag(), ExInitializeCallData(), ExIsResourceAcquiredSharedLite(), ExpDetectWorkerThreadDeadlock(), ExpGetLookasideInformation(), ExpInitializePoolDescriptor(), ExpInsertPoolTracker(), ExpRemovePoolTracker(), ExpResourceInitialization(), ExpWaitForResource(), ExpWorkerInitialization(), ExQueryPoolUsage(), ExReinitializeResourceLite(), ExReleaseResourceForThreadLite(), ExReleaseResourceLite(), ExSetResourceOwnerPointer(), FillPattern(), FindAttrIndex(), FsgVgaInitializeHWFlags(), FsgWriteToScreen(), FsgWriteToScreenCommonLVB(), FsRtlAddLargeMcbEntry(), FsRtlAreNamesEqual(), FsRtlFindLargeIndex(), FsRtlIsFatDbcsLegal(), FsRtlIsHpfsDbcsLegal(), FsRtlLookupLargeMcbEntry(), FsRtlLookupLastLargeMcbEntryAndIndex(), FsRtlLookupMcbEntry(), FsRtlRemoveMcbEntryPrivate(), FsRtlSplitLargeMcb(), FsRtlTruncateLargeMcb(), FtCreateKey(), GetCPElement(), GetCPElementData(), GetCPElementDataSize(), GetCPElementDataType(), GetCPElementInfo(), GetCPElementSize(), GetCPElementType(), GetCPMediaWhitePoint(), GetCPTagSig(), GetCRDInputOutputArraySize(), GetCSAFromProfile(), GetHostColorRenderingDictionary(), GetHostCSA(), GetHostCSA_Intent(), GetPS2ColorRenderingDictionary(), GetPS2ColorRenderingIntent(), GetPS2CSA_DEFG(), GetPS2CSA_DEFG_Intent(), GetPS2CSA_MONO_A(), GetPS2CSA_MONO_ABC(), GetServerIMEKeyboardLayout(), ImeUIGuideLine(), InitializeFullScreen(), InitializePool(), IoInitSystem(), IopCopyBootLogRegistryToFile(), IopLookupBusStringFromID(), IopQueryConflictFillConflicts(), JzDeleteVariableSegment(), KdInitSystem(), KdpAddBreakpoint(), KdpDeleteBreakpoint(), KdpDeleteBreakpointRange(), KdpLowRestoreBreakpoint(), KdpLowWriteContent(), KdpReceivePacketLeader(), KdpRestoreAllBreakpoints(), KdpSearchHammingDistance(), KdpSearchPhysicalPage(), KdpSuspendBreakpoint(), KdSetOwedBreakpoints(), KeAddSystemServiceTable(), KeCheckForTimer(), KeDumpMachineState(), KeFlushMultipleTb(), KeFlushMultipleTb64(), KeInitializeInterrupt(), KeInitializeThread(), KeInsertQueueDpc(), KeSetSystemTime(), KeWaitForMultipleObjects(), Ki386VdmDispatchStringIo(), KiCompleteEffectiveRangeChange(), KiDispatchException(), KiEmulateFloating(), KiFlushMultipleTbTarget(), KiFlushMultipleTbTarget64(), KiFlushTargetMultipleTb(), KiInitializeKernel(), KiInitializeMTRR(), KiInitMachineDependent(), KiInitSystem(), KiInsertTimerTable(), KiLoadMTRR(), KiLoadPAT(), KiSaveProcessorControlState(), KiScanBugCheckCallbackList(), KiScanReadyQueues(), KiSwapIDT(), KiTimerExpiration(), KiTimerListExpire(), LdrpDphDetectSnapRoutines(), LocalCompareMemory(), LocalCompareMemoryUlong(), LocalFillMemory(), LocalFillMemoryUlong(), LocalMoveMemory(), LocalZeroMemory(), main(), MiAddSystemPtes(), MiAllocatePoolPages(), MiCheckAddress(), MiCheckPdeForSessionSpace(), MiDereferenceSession(), MiFeedSysPtePool(), MiFindContiguousMemory(), MiFreePoolPages(), MiFreeSessionSpaceMap(), MiGetImageProtection(), MiGetPageProtection(), MiGetSystemPteAvailability(), MiGetSystemPteListCount(), MiInitializeNonPagedPool(), MiInitializeSessionPool(), MiInsertWsle(), MiReleaseSystemPtes(), MiReserveSystemPtes(), MiSessionCommitPageTables(), MiSessionInitializeWorkingSetList(), MiSetProtectionOnSection(), MiUpdateWsle(), MmLocateUnloadedDriver(), MmSetKernelDumpRange(), NewParsePrologueRegionPhase0(), NewParsePrologueRegionPhase1(), NtEnumerateKey(), NtEnumerateValueKey(), NtFilterToken(), NtQueryInformationToken(), NtSetInformationToken(), ObInitSystem(), ProcessCommandListInput(), ProcessInterruptRegion(), PspGetContext(), PspSetContext(), ResetAllPrivileges(), RetrieveNthCommand(), RtlAnsiStringToUnicodeString(), RtlCopyLuidAndAttributesArray(), RtlCopySidAndAttributesArray(), RtlDispatchException(), RtlDowncaseUnicodeString(), RtlEqualPrefixSid(), RtlIsNameLegalDOS8Dot3(), RtlLargeIntegerDivide(), RtlNtStatusToDosErrorNoTeb(), RtlOemStringToCountedUnicodeString(), RtlOemStringToUnicodeString(), RtlpAnsiPszToUnicodePsz(), RtlpDphShouldAllocateInPageHeap(), RtlpNtEnumerateSubKey(), RtlpValidOwnerSubjectContext(), RtlRemoteCall(), RtlUnicodeStringToAnsiString(), RtlUnicodeStringToCountedOemString(), RtlUnicodeStringToOemString(), RtlUpcaseUnicodeString(), RtlUpcaseUnicodeStringToAnsiString(), RtlUpcaseUnicodeStringToCountedOemString(), RtlUpcaseUnicodeStringToOemString(), RtlWalkFrameChain(), SeFilterToken(), SepAccessCheck(), SepAddAccessTypeList(), SepAuditTypeList(), SepDuplicateToken(), SepExamineSaclEx(), SepFilterToken(), SepIdAssignableAsGroup(), SepIdAssignableAsOwner(), SepMakeTokenEffectiveOnly(), SepMaximumAccessCheck(), SepNormalAccessCheck(), SepObjectInTypeList(), SepRemoveDisabledGroupsAndPrivileges(), SepUpdateParentTypeList(), SepValidOwnerSubjectContext(), SeQueryInformationToken(), SetCurrentCommandLine(), SetHandleFlag(), SrvSetConsoleHardwareState(), UdfCandidateShortName(), UdfEquivalentPcb(), UdfVerifyVolume(), UdfVmcbLookupMcbEntry(), UnregisterVDM(), ValidateCPElement(), VdmpInitialize(), VerifierFreeTrackedPool(), ViInsertPoolAllocation(), and WndProc().

PCELL_DATA List

Definition at line 94 of file cmchek.c. Referenced by ArbAddOrdering(), ArbDumpArbiterRange(), ArbFreeOrderingList(), ArbInitializeOrderingList(), CcPostWorkQueue(), CcWorkerThread(), CmpAddToLeaf(), CmpCheckValueList(), CmpFindNameInList(), CmpFindValueByNameFromCache(), CmpGetValueKeyFromCache(), CmpGetValueListFromCache(), CmpSplitLeaf(), ExpWorkerThread(), FsRtlLookupFilterContextInternal(), FsRtlRemoveFilterContext(), FsRtlWorkerThread(), HvpCoalesceDiscardedBins(), HvpDiscardBins(), HvRefreshHive(), IopAddRelationToList(), IopCompressRelationList(), IopCreateCmResourceList(), IopDetermineResourceListSize(), IopEnumerateRelations(), IopFreeRelationList(), IopGetRelationsCount(), IopGetRelationsTaggedCount(), IopIsRelationInList(), IopMergeCmResourceLists(), IopMergeFilteredResourceRequirementsList(), IopProcessSetInterfaceState(), IopQueuePendingSurpriseRemoval(), IopRemoveIndirectRelationsFromList(), IopRemoveRelationFromList(), IopSetAllRelationsTags(), IopSetRelationsTag(), IsInLinkedList(), KdDeregisterDebuggerDataBlock(), KdRegisterDebuggerDataBlock(), MiAllocatePoolPages(), MiCheckSecuredVad(), MiFindContiguousMemory(), MiRemoveVad(), MmDeleteTeb(), MmSetKernelDumpRange(), MmUnsecureVirtualMemory(), PrintTimerQueue(), RtlDebugPrintTimes(), RtlpDeleteTimerQueue(), RtlpDphSearchBlockInList(), RtlpFireTimersAndReorder(), RtlpGetQueueRelativeTime(), RtlpInsertInDeltaList(), RtlpInsertTimersIntoDeltaList(), RtlpQueueIOWorkerRequest(), RtlpRemoveFromDeltaList(), RtlpServiceTimer(), RtlShutdownLpcServer(), and RtlThreadPoolCleanup().

PVOID RootPoint

Definition at line 87 of file cmchek.c.

NTSTATUS Status

Definition at line 135 of file cttoken.c. Referenced by __ClientLoadOLE(), __declspec(), _BuildNameList(), _BuildPropList(), _EndTask(), _ExitWindowsEx(), _GetUserObjectInformation(), _ImpersonateDdeClientWindow(), _OpenWindowStation(), _SetUserObjectInformation(), _UserTestForWinStaAccess(), _UserTestTokenForInteractive(), AccessCheckObject(), AlAddSystemPartition(), AlFindNextMatchComponent(), AlFreeEnvVarComponents(), AllocateConsole(), AllocateConsoleHandle(), AllocateIoHandle(), AllocCallbackMessage(), AllocConsole(), AllocConsoleInternal(), ApiPreamble(), AssociateInputContextEx(), bar(), bar1(), bCheckAndDeleteTTF(), bCleanConvertedTTFs(), bLoadableFontDrivers(), BrokenConnection(), BuildHimcList(), BuildHwndList(), CallUserpRegisterLogonProcess(), CcCopyRead(), CcCopyWrite(), CcFastCopyRead(), CcFastCopyWrite(), CcFlushCache(), CcGetVacbMiss(), CcInitializeCacheMap(), CcMapAndCopy(), CcSetFileSizes(), CcSetValidData(), CcWriteBehind(), CcZeroData(), CharHandlerFromConsole(), CheckAllowForeground(), CheckClipboardAccess(), CheckDesktopPolicy(), CheckRestricted(), CheckTlpcMsg(), CleanupSessionObjectDirectories(), ClientThread(), ClientThreadSetup(), CliGetImeHotKeysFromRegistry(), CliReadRegistryValue(), CliSetSingleHotKey(), CloseDevice(), CloseOutputHandle(), CmBootLastKnownGood(), CmDeleteKeyRecursive(), CmGetSystemDriverList(), CmLoadKey(), CmpAddDriverToList(), CmpAddToHiveFileList(), CmpCheckNotifyAccess(), CmpCloneControlSet(), CmpCreateControlSet(), CmpCreateLinkNode(), CmpCreateObjectTypes(), CmpCreatePerfKeys(), CmpCreatePredefined(), CmpCreateRegistryRoot(), CmpCreateTemporaryHive(), CmpDestroyHive(), CmpDiskFullWarningWorker(), CmpDoCreateChild(), CmpDoFileSetSize(), CmpDoFlushAll(), CmpFileWrite(), CmpFindControlSet(), CmpFindMatchingDescriptorCell(), CmpFindNLSData(), CmpFindTagIndex(), CmpGetSymbolicLink(), CmpHiveRootSecurityDescriptor(), CmpInitHiveFromFile(), CmpInitializeHardwareConfiguration(), CmpInitializeHive(), CmpInitializeHiveList(), CmpInitializeMachineDependentConfiguration(), CmpInitializeRegistryNode(), CmpInitializeSystemHive(), CmpIsLastKnownGoodBoot(), CmpIsLoadType(), CmpLinkHiveToMaster(), CmpLinkKeyToHive(), CmpLoadHiveVolatile(), CmpLockRegistryExclusive(), CmpNameFromAttributes(), CmpOpenFileWithExtremePrejudice(), CmpPostNotify(), CmpQuerySecurityDescriptorInfo(), CmpQuotaWarningWorker(), CmpRemoveFromHiveFileList(), CmpSaveBootControlSet(), CmpSecurityMethod(), CmpSetSecurityDescriptorInfo(), CmpSetupConfigurationTree(), CmpSortDriverList(), CmpValidateAlternate(), CmpWorker(), CmQueryMultipleValueKey(), CmReplaceKey(), CommandNumberPopup(), CommitReadOnlyMemory(), CommonCreateWindowStation(), CommonOpenWindowStation(), ConDllInitialize(), ConnectConsoleInternal(), ConnectToEmulator(), ConnectToTerminalServer(), ConServerDllInitialization(), ConsoleAddProcessRoutine(), ConsoleClientConnectRoutine(), ConsoleClientShutdown(), ConsoleInputThread(), ConsoleWindowProc(), ConvertInputToUnicode(), ConvertOutputToOem(), ConvertOutputToUnicode(), ConvertToFullScreen(), ConvertToOem(), ConvertToWindowed(), CookedRead(), CookedReadWaitRoutine(), Copy(), CopyFromCharPopup(), CopyRestrictedFile(), CopyStream(), CopyToCharPopup(), CreateBSMEventSD(), CreateConsoleBitmap(), CreateCtrlThread(), CreateDAclToken(), CreateDesktopA(), CreateDesktopHeap(), CreateDirectories(), CreateGlobalAtomTable(), CreateInputBuffer(), CreateLocalMemHandle(), CreateScreenBuffer(), CreateSecurityDescriptor(), CreateSystemThread(), CsrClientCallServer(), CsrClientConnectToServer(), CsrIdentifyAlertableThread(), CsrOneTimeInitialize(), CsrpConnectToServer(), CsrSetPriorityClass(), CtLnpQos(), CtLpcQos(), DbgkCreateThread(), DbgkpSectionHandleToFileHandle(), DbgPrint(), DeviceClassCDROMNotify(), DirectReadWaitRoutine(), DisableAllPrivileges(), DisplayModeTransition(), DisplaySecurityContext(), DoCreateScreenBuffer(), DoEventTest(), DoExceptionTest(), DoInfoTest(), DoLuidTest(), DoMutantTest(), DoPartyTest(), DoSemaphoreTest(), DoTimerTest(), DrChangeDisplaySettings(), DrGetDeviceName(), DrSetDevMode(), DumpKeys(), DumpObjectDirs(), DumpSecurity(), DumpValues(), EhCreateChild(), EhOpenHive(), EhpAttachSecurity(), EnableAllPrivileges(), EnumDisplayDevices(), eret(), ExamineKey(), ExamineValueEntries(), ExceptionTest(), ExCreateCallback(), ExInterlockedExtendZone(), ExitWindowsWorker(), ExpAllocateUuids(), ExpCreateWorkerThread(), ExpDetectWorkerThreadDeadlock(), ExpEventInitialization(), ExpEventPairInitialization(), ExpGetCurrentUserUILanguage(), ExpGetHandleInformation(), ExpGetLockInformation(), ExpGetLookasideInformation(), ExpGetObjectInformation(), ExpGetPoolInformation(), ExpGetUILanguagePolicy(), ExpInitializeCallbacks(), ExpMutantInitialization(), ExpProfileInitialization(), ExpQueryLegacyDriverInformation(), ExpQueryModuleInformation(), ExpRaiseException(), ExpRaiseHardError(), ExpRaiseStatus(), ExpSemaphoreInitialization(), ExpSetCurrentUserUILanguage(), ExpSystemErrorHandler(), ExpTimerInitialization(), ExpUuidGetValues(), ExpUuidInitialization(), ExpUuidLoadSequenceNumber(), ExpUuidSaveSequenceNumber(), ExpUuidSaveSequenceNumberIf(), ExpValidateLocale(), ExpWaitForResource(), ExpWaitForResourceDdk(), ExpWin32Initialization(), ExpWorkerInitialization(), ExpWorkerThreadBalanceManager(), ExQuerySystemLockInformation(), ExRaiseHardError(), ExRegisterCallback(), ExSnapShotHandleTables(), ExUuidCreate(), FalseUnicodeToRealUnicode(), FastGetProfileDwordW(), FastGetProfileKeysW(), FastGetProfileStringW(), FastGetProfileValue(), FastWriteProfileStringW(), FastWriteProfileValue(), FE_WriteRegionToScreenHW(), FileExists(), FindActiveScreenBufferHandle(), FlushAllButKeys(), foo(), foo1(), FreeDesktop(), FreeIoHandle(), FreeView(), FsgWriteToFrameBuffer(), FsRtlAcknowledgeOplockBreak(), FsRtlAcquireFileForCcFlush(), FsRtlAcquireFileForModWrite(), FsRtlAreNamesEqual(), FsRtlBalanceReads(), FsRtlCheckNoExclusiveConflict(), FsRtlCheckOplock(), FsRtlCompleteLockIrpReal(), FsRtlCopyRead(), FsRtlCopyWrite(), FsRtlFastCheckLockForRead(), FsRtlFastCheckLockForWrite(), FsRtlFastUnlockSingle(), FsRtlFindInTunnelCache(), FsRtlGetCompatibilityModeValue(), FsRtlGetFileSize(), FsRtlGetTunnelParameterValue(), FsRtlIsNameInExpression(), FsRtlIsTotalDeviceFailure(), FsRtlMdlReadDev(), FsRtlNotifyCompleteIrp(), FsRtlNotifyCompleteIrpList(), FsRtlNotifyVolumeEvent(), FsRtlOpBatchBreakClosePending(), FsRtlOplockBreakNotify(), FsRtlOplockBreakToII(), FsRtlOplockBreakToNone(), FsRtlOplockFsctrl(), FsRtlPrepareMdlWriteDev(), FsRtlPrivateCheckForSharedLockAccess(), FsRtlPrivateRemoveLock(), FsRtlProcessFileLock(), FsRtlReleaseFileForCcFlush(), FsRtlReleaseFileForModWrite(), FsRtlRequestExclusiveOplock(), FsRtlRequestOplockII(), FsRtlSetFileSize(), FsRtlSyncVolumes(), FsRtlWaitOnIrp(), GenerateDescriptor(), GetBadAppCmdLine(), GetChar(), GetConsoleInputExeNameA(), GetConsoleLangId(), GetErrorMode(), GetHardErrorText(), GetMySid(), GetProcessLuid(), GetRealDllFileNameWorker(), GetRegIntFromID(), GetRegistryValues(), GetServerIMEKeyboardLayout(), GetSiteSidFromToken(), GetTaskName(), GetThreadConsoleDesktop(), GetTimeouts(), GetUserObjectSecurity(), GetVersionInfo(), HandleMediaChangeEvent(), HighBeep(), HMGrowHandleTable(), HMInitHandleTable(), HvInitializeHive(), HvpBuildMap(), HvpBuildMapAndCopy(), HvpEnlistBinInMap(), HvpInitMap(), HvpReadFileImageAndBuildMap(), ImmAssociateContext(), ImmAssociateContextEx(), ImmLoadLayout(), InheritIoHandleTable(), InitCreateObjectDirectory(), InitCreateSharedSection(), InitializeConsoleHandleTable(), InitializeInputHandle(), InitializeIoHandleTable(), InitializePowerRequestList(), InitializeRestrictedStuff(), InitializeScrollBuffer(), InitiateShutdown(), InitiateWin32kCleanup(), InitMapSharedSection(), InitSystemThread(), InitTask(), InitWindowsStuff(), InputExceptionFilter(), InternalCreateCallbackThread(), InternalEnumObjects(), InternalEnumProps(), IoFreeDumpStack(), IoGetLegacyVetoList(), IoInitializeDumpStack(), IopAllocateResources(), IopApplyFunctionToServiceInstances(), IopApplyFunctionToSubKeys(), IopBootLog(), IopBootLogToFile(), IopCacheNetbiosNameForIpAddress(), IopCaptureObjectName(), IopCompleteDumpInitialization(), IopCopyBootLogRegistryToFile(), IopDeleteSessionSymLinks(), IopGetDumpStack(), IopGetResourceRequirementsForAssignTable(), IopInitializeBootLogging(), IopInitializeDeviceKey(), IopLoadDumpDriver(), IopPnPCompleteRequest(), IopPowerDispatch(), IopProcessAssignResources(), IopSendMessageToTrackService(), IopSetDefaultGateway(), IopWritePageToDisk(), IopWriteSummaryDump(), IopWriteSummaryHeader(), IopWriteTriageDump(), IoReuseIrp(), IoSetCrashDumpState(), IoSetIoCompletion(), IovpAssertIsValidIrpStatus(), IsInterestingPath(), IsPrivileged(), IsTokenRestricted(), KbdLayerRealDllFileForWBT(), KdPollBreakIn(), KdpPollBreakInWithPortLock(), KdpReportExceptionStateChange(), KdpReportLoadSymbolsStateChange(), KdpSendWaitContinue(), KdpSwitchProcessor(), Ke386CallBios(), KeBalanceSetManager(), KeI386GetLid(), KeI386ReleaseLid(), KeI386VdmInitialize(), KeQueryIntervalProfile(), KeSetup80387OrEmulate(), KeSwapProcessOrStack(), KeSweepCacheRangeWithDrain(), KeUserModeCallback(), KeyClick(), KiAmdK6MtrrSetMemoryType(), KiContinue(), KiEmulateFloat(), KiFloatingException(), KiFreezeTargetExecution(), KiI386PentiumLockErrataFixup(), KiInitializeMTRR(), KiInitMachineDependent(), KiIpiGenericCall(), KiMemoryFault(), KiMoveRegTree(), KiSyncMC_Drain(), KiSyncMC_DrainTarget(), KiSyncPrefetchVisible(), KiSyncPrefetchVisibleTarget(), LdrAlternateResourcesEnabled(), LdrEnumResources(), LdrLoadAlternateResourceModule(), LdrpAccessResourceData(), LdrpCheckForKnownDll(), LdrpGetFileVersion(), LdrpRunInitializeRoutines(), LdrpSearchResourceSection_U(), LdrpVerifyAlternateResourceModule(), LdrQueryImageFileExecutionOptions(), LdrQueryProcessModuleInformation(), LdrVerifyImageMatchesChecksum(), LfsCloseLogFile(), LfsFindLastLsn(), LfsFlushLfcb(), LfsFlushToLsn(), LfsForceWrite(), LfsInitializeLogFile(), LfsOpenLogFile(), LfsPinOrMapData(), LfsReadLogRecord(), LfsReadNextLogRecord(), LfsReadRestart(), LfsReadRestartArea(), LfsSetBaseLsn(), LfsWrite(), LfsWriteRestartArea(), LoadAppDlls(), LoadOLEOnce(), LockProcessByClientId(), LockThreadByClientId(), LowBeep(), LpcInitSystem(), LpcpAllocateFromPortZone(), LpcpCopyRequestData(), LpcpCreatePort(), LpcpExtendPortZone(), LpcpGetCreatorName(), LpcpInitializePortZone(), LpcRequestWaitReplyPort(), main(), MakeCursorVisible(), MapDesktop(), MapViewOfSection(), MatchandCopyAlias(), MESSAGECALL(), MiCallDllUnloadAndUnloadDll(), MiCheckForCrashDump(), MiCheckSecuredVad(), MiCleanSection(), MiCreateDataFileMap(), MiCreateImageFileMap(), MiDereferenceSegmentThread(), MiEmptyWorkingSet(), MiEnsureAvailablePageOrWait(), MiFlushSectionInternal(), MiGatherMappedPages(), MiGatherPagefilePages(), MiGetWritablePagesInSection(), MiLoadImageSection(), MiLoadSystemImage(), MiMakeOutswappedPageResident(), MiMapCacheExceptionFilter(), MiMappedPageWriter(), MiMapViewOfImageSection(), MiProtectVirtualMemory(), MiReloadBootLoadedDrivers(), MiRemoveImageSessionWide(), MiRemoveUnusedSegments(), MiSectionInitialization(), MiSegmentDelete(), MiSessionCommitImagePages(), MiSessionCreateInternal(), MiSessionUnloadAllImages(), MiSessionWideReserveImageAddress(), MiShareSessionImage(), MiSnapThunk(), MmAssignProcessToJob(), MmCheckSystemImage(), MmCopyVirtualMemory(), MmCreatePeb(), MmCreateSection(), MmDeleteTeb(), MmExtendSection(), MmFlushVirtualMemory(), MmGetCrashDumpInformation(), MmGetFileNameForSection(), MmGetSectionRange(), MmGetSystemRoutineAddress(), MmGetVerifierInformation(), MmInitializeProcessAddressSpace(), MmMapIoSpace(), MmMapUserAddressesToPage(), MmProbeAndLockProcessPages(), MmRemovePhysicalMemory(), MmSessionCreate(), MmSetBankedSection(), MmSetVerifierInformation(), MmShutdownSystem(), MmUnloadSystemImage(), MmZeroPageThread(), MyCmpInitHiveFromFile(), MyRegQueryValue(), NapCreateDataSection(), NativeDosCharLength(), NotificationThread(), NtAcceptConnectPort(), NtAddAtom(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtAllocateLocallyUniqueId(), NtAllocateUserPhysicalPages(), NtAllocateUuids(), NtAllocateVirtualMemory(), NtAreMappedFilesTheSame(), NtAssignProcessToJobObject(), NtCancelTimer(), NtClearEvent(), NtClose(), NtCloseObjectAuditAlarm(), NtCompleteConnectPort(), NtCreateChannel(), NtCreateDirectoryObject(), NtCreateEvent(), NtCreateEventPair(), NtCreateFile(), NtCreateIoCompletion(), NtCreateJobObject(), NtCreateMutant(), NtCreatePagingFile(), NtCreatePort(), NtCreateProfile(), NtCreateSection(), NtCreateSemaphore(), NtCreateSuperSection(), NtCreateSymbolicLinkObject(), NtCreateTimer(), NtCreateToken(), NtCreateWaitablePort(), NtDelayExecution(), NtDeleteAtom(), NtDeleteFile(), NtDeleteObjectAuditAlarm(), NtDuplicateObject(), NtDuplicateToken(), NtExtendSection(), NTFastDOSIO(), NtFilterToken(), NtFindAtom(), NtFlushInstructionCache(), NtFlushVirtualMemory(), NtFreeUserPhysicalPages(), NtFreeVirtualMemory(), NtGetContextThread(), NtImpersonateAnonymousToken(), NtImpersonateClientOfPort(), NtImpersonateThread(), NtListenChannel(), NtListenPort(), NtLoadKey2(), NtLockVirtualMemory(), NtMakeTemporaryObject(), NtMapUserPhysicalPages(), NtMapUserPhysicalPagesScatter(), NtMapViewOfSection(), NtMapViewOfSuperSection(), NtOpenChannel(), NtOpenDirectoryObject(), NtOpenEvent(), NtOpenEventPair(), NtOpenFile(), NtOpenIoCompletion(), NtOpenJobObject(), NtOpenMutant(), NtOpenObjectAuditAlarm(), NtOpenProcess(), NtOpenProcessToken(), NtOpenSection(), NtOpenSemaphore(), NtOpenSuperSection(), NtOpenSymbolicLinkObject(), NtOpenThread(), NtOpenThreadToken(), NtOpenTimer(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtPrivilegeObjectAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryAttributesFile(), NtQueryDefaultLocale(), NtQueryDefaultUILanguage(), NtQueryDirectoryObject(), NtQueryEvent(), NtQueryInformationAtom(), NtQueryInformationPort(), NtQueryInformationToken(), NtQueryInstallUILanguage(), NtQueryIoCompletion(), NtQueryMultipleValueKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQuerySystemInformation(), NtQueryTimer(), NtQueryVirtualMemory(), NtRaiseHardError(), NtReadVirtualMemory(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtReplaceKey(), NtReplyPort(), NtReplyWaitReceivePort(), NtReplyWaitReceivePortEx(), NtReplyWaitReplyPort(), NtReplyWaitSendChannel(), NtRequestPort(), NtRequestWaitReplyPort(), NtResetEvent(), NtSecureConnectPort(), NtSendWaitReplyChannel(), NtSetContextChannel(), NtSetContextThread(), NtSetDefaultHardErrorPort(), NtSetDefaultLocale(), NtSetDefaultUILanguage(), NtSetEvent(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationFile(), NtSetInformationObject(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLdtEntries(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetSystemInformation(), NtSetTimer(), NtSetUuidSeed(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtUnloadKey(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserCloseWindowStation(), NtUserCreateWindowStation(), NtUserGetGuiResources(), NtUserInitialize(), NtUserLockWindowStation(), NtUserOpenInputDesktop(), NtUserOpenWindowStation(), NtUserProcessConnect(), NtUserSetThreadDesktop(), NtUserSetWindowStationUser(), NtUserSwitchDesktop(), NtUserUnlockWindowStation(), NtUserUserHandleGrantAccess(), NtVdmControl(), NtW32Call(), NtWaitForMultipleObjects(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteVirtualMemory(), NtYieldExecution(), ObAssignObjectSecurityDescriptor(), ObAssignSecurity(), ObCheckCreateObjectAccess(), ObCheckObjectAccess(), ObCreateObject(), ObCreateObjectType(), ObDupHandleProcedure(), ObEnumerateObjectsByType(), ObGetHandleInformation(), ObGetObjectInformation(), ObGetObjectSecurity(), ObInitSystem(), ObInsertObject(), ObOpenObjectByName(), ObOpenObjectByPointer(), ObpAllocateObject(), ObpCaptureHandleInformation(), ObpCaptureObjectCreateInformation(), ObpCaptureObjectName(), ObpCheckObjectReference(), ObpCheckTraverseAccess(), ObpCreateDosDevicesDirectory(), ObpCreateHandle(), ObpCreateUnnamedHandle(), ObpFreeDosDevicesProtection(), ObpGetDosDevicesProtection(), ObpHashSecurityDescriptor(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), ObpInitSecurityDescriptorCache(), ObpLookupObjectName(), ObpParseSymbolicLink(), ObpProcessDosDeviceSymbolicLink(), ObpRemoveObjectRoutine(), ObQueryDeviceMapInformation(), ObQueryNameString(), ObQueryObjectAuditingByHandle(), ObQuerySecurityDescriptorInfo(), ObQueryTypeInfo(), ObReferenceObjectByHandle(), ObReferenceObjectByName(), ObSetDeviceMap(), ObSetSecurityDescriptorInfo(), ObSetSecurityObjectByPointer(), obtest(), ObWaitForSingleObject(), OpenAppropriateToken(), OpenCacheKeyEx(), OpenDesktopCompletion(), OpenDevice(), OpenEffectiveToken(), OpenKeyboardLayoutFile(), ParseDesktop(), PrependInputBuffer(), processargs(), ProcessCommandLine(), ProcessCommandListInput(), ProcessCommandNumberInput(), ProcessCookedReadInput(), ProcessCopyFromCharInput(), ProcessCopyToCharInput(), ProcessCreateConsoleWindow(), ProcessCtrlEvents(), ProcessDeviceChanges(), ProcessHardErrorRequest(), PropertiesDlgShow(), PropertiesUpdate(), PropRoutine(), ProtectHandle(), PsAssignImpersonationToken(), PsConvertToGuiThread(), PsImpersonateClient(), PsLockProcess(), PsLookupProcessByProcessId(), PsLookupProcessThreadByCid(), PsLookupThreadByThreadId(), PsOpenTokenOfJobObject(), PsOpenTokenOfProcess(), PsOpenTokenOfThread(), Psp386CreateVdmIoListHead(), Psp386InstallIoHandler(), PspAddProcessToJob(), PspApplyJobLimitsToProcess(), PspAssignPrimaryToken(), PspCaptureTokenFilter(), PspInitializeProcessSecurity(), PspLookupKernelUserEntryPoints(), PspQueryDescriptorThread(), PspQueryLdtInformation(), PspSetLdtInformation(), PspSetLdtSize(), PspSetProcessIoHandlers(), PspTerminateAllProcessesInJob(), PspTerminateProcess(), PsSetCreateThreadNotifyRoutine(), PsSetLoadImageNotifyRoutine(), PsWatchWorkingSet(), QueryDeviceInfo(), QueuePowerRequest(), RawInputThread(), RawReadWaitRoutine(), ReadChars(), ReadConsoleInternal(), ReadInputBuffer(), ReadLayoutFile(), RealUnicodeToFalseUnicode(), RedrawCommandLine(), ReferenceWindowStation(), RegGetKeyValue(), RegisterDeviceNotificationWorker(), RegisterForDeviceChangeNotifications(), RegLoadAsciiFileAsUnicode(), RegReadApcProcedure(), RegReadBinaryFile(), RegReadMultiSzFile(), RemoteConnect(), RemoteDisableScreen(), RemoteDoMessage(), RemoteLogoff(), RemoteMessageThread(), RemoteOpenCacheKeyEx(), RemoteShadowCleanup(), RemoteShadowStart(), RemoveConsole(), ReplyMessageToTerminalServer(), ResetAllPrivileges(), RevalidateConsole(), RiInitializeRegistryFromAsciiFile(), RtlAcquireResourceExclusive(), RtlAcquireResourceShared(), RtlAddActionToRXact(), RtlAddAtomToAtomTable(), RtlAdjustPrivilege(), RtlAllocateHandle(), RtlAllocateHeap(), RtlAllocateHeapSlowly(), RtlApplyRXact(), RtlApplyRXactNoFlush(), RtlCallbackLpcClient(), RtlCheckForOrphanedCriticalSections(), RtlCheckRegistryKey(), RtlConvertExclusiveToShared(), RtlConvertSharedToExclusive(), RtlConvertSidToUnicodeString(), RtlCreateAtomTable(), RtlCreateEnvironment(), RtlCreateHeap(), RtlCreateLpcServer(), RtlCreateProcessParameters(), RtlCreateQueryDebugBuffer(), RtlCreateRegistryKey(), RtlCreateTimer(), RtlCreateTimerQueue(), RtlCreateUnicodeStringFromAsciiz(), RtlCreateUserProcess(), RtlCreateUserThread(), RtlDebugCreateHeap(), RtlDebugUsageHeap(), RtlDebugZeroHeap(), RtlDefaultNpAcl(), RtlDeleteAtomFromAtomTable(), RtlDeleteCriticalSection(), RtlDeleteFunctionTable(), RtlDeleteRegistryValue(), RtlDeleteTimer(), RtlDeleteTimerQueueEx(), RtlDeregisterWaitEx(), RtlDestroyAtomTable(), RtlDestroyEnvironment(), RtlDestroyHandleTable(), RtlDestroyProcessParameters(), RtlDestroyQueryDebugBuffer(), RtlDnsHostNameToComputerName(), RtlDoesFileExists_UEx(), RtlEmptyAtomTable(), RtlEnumProcessHeaps(), RtlEqualDomainName(), RtlExpandEnvironmentStrings_U(), RtlExtendHeap(), RtlFindMessage(), RtlFormatCurrentUserKeyPath(), RtlFreeHeap(), RtlFreeHeapSlowly(), RtlFreeUserThreadStack(), RtlGetFullPathName_Ustr(), RtlGetNtProductType(), RtlImpersonateSelf(), RtlInitializeCriticalSectionAndSpinCount(), RtlInitializeResource(), RtlInitializeRXact(), RtlInt64ToUnicodeString(), RtlIntegerToUnicodeString(), RtlLoadStringOrError(), RtlLocalTimeToSystemTime(), RtlLookupAtomInAtomTable(), RtlMBMessageWParamCharToWCS(), RtlNewInstanceSecurityObject(), RtlNewSecurityGrantedAccess(), RtlNtStatusToDosError(), RtlNtStatusToDosErrorNoTeb(), RtlOpenCurrentUser(), RtlpAllocateHeapUsageEntry(), RtlpAllocateTags(), RtlpAllocDeallocQueryBuffer(), RtlpCallQueryRegistryRoutine(), RtlpChangeQueryDebugBufferTarget(), RtlpCheckRelativeDrive(), RtlpCommitQueryDebugInfo(), RtlpCompareKnownAces(), RtlpCompareKnownObjectAces(), RtlpComputeMergedAcl(), RtlpComputeMergedAcl2(), RtlpConvertAclToAutoInherit(), RtlpConvertToAutoInheritSecurityObject(), RtlpCopyAces(), RtlpCreateCriticalSectionSem(), RtlpCreateServerAcl(), RtlpCreateStack(), RtlpCreateUnCommittedRange(), RtlpDebugPageHeapAllocateVM(), RtlpDebugPageHeapCommitVM(), RtlpDebugPageHeapCreate(), RtlpDebugPageHeapDecommitVM(), RtlpDebugPageHeapRobustProtectVM(), RtlpDeCommitFreeBlock(), RtlpDeregisterWait(), RtlpDestroyTags(), RtlpDphShouldAllocateInPageHeap(), RtlpExitThread(), RtlpExtendHeap(), RtlpFindAndCommitPages(), RtlpFindWaitThread(), RtlpFireTimers(), RtlpFreeStack(), RtlpGenerateInheritAcl(), RtlpGetDefaultsSubjectContext(), RtlpGetIntegerAtom(), RtlpGetRegistryHandle(), RtlpGetTimeRemaining(), RtlpGetWaitEvent(), RtlPinAtomInAtomTable(), RtlpInheritAcl(), RtlpInheritAcl2(), RtlpInitializeEventCache(), RtlpInitializeHeapSegment(), RtlpInitializeTimerThreadPool(), RtlpInitializeWaitThreadPool(), RtlpInitializeWorkerThreadPool(), RtlpIOWorkerThread(), RtlpIsDuplicateAce(), RtlpLpcServerCallback(), RtlpLpcWorkerThread(), RtlpNewSecurityObject(), RtlpNtEnumerateSubKey(), RtlpNtQueryValueKey(), RtlpOpenImageFile(), RtlpProcessWaitCompletion(), RtlpQueryProcessDebugInformationRemote(), RtlpQueueIOWorkerRequest(), RtlpQueueWorkerRequest(), RtlpRaiseException(), RtlpRaiseStatus(), RtlProtectHeap(), RtlpSerializeHeap(), RtlpSetSecurityObject(), RtlpStartIOWorkerThread(), RtlpStartThread(), RtlpStartWorkerThread(), RtlpValidateHeap(), RtlpValidateHeapHeaders(), RtlpValidOwnerSubjectContext(), RtlpWaitForEvent(), RtlpWaitThread(), RtlpWorkerThread(), RtlpWorkerThreadInitializeTimers(), RtlpWorkerThreadTimerCallback(), RtlQueryAtomInAtomTable(), RtlQueryAtomsInAtomTable(), RtlQueryEnvironmentVariable_U(), RtlQueryInformationAcl(), RtlQueryProcessBackTraceInformation(), RtlQueryProcessDebugInformation(), RtlQueryProcessHeapInformation(), RtlQueryProcessLockInformation(), RtlQueryProcessModuleInformation(), RtlQueryRegistryValues(), RtlQueryTimeZoneInformation(), RtlQueueWorkItem(), RtlRaiseStatus(), RtlReAllocateHeap(), RtlRegisterWait(), RtlReleaseResource(), RtlRemoteCall(), RtlRunEncodeUnicodeString(), RtlSetActiveTimeBias(), RtlSetCurrentDirectory_U(), RtlSetCurrentEnvironment(), RtlSetEnvironmentVariable(), RtlSetIoCompletionCallback(), RtlSetTimeZoneInformation(), RtlShutdownLpcServer(), RtlSystemTimeToLocalTime(), RtlUpdateTimer(), RtlUsageHeap(), RtlValidateProcessHeaps(), RtlVerifyVersionInfo(), RtlWalkHeap(), RtlWCSMessageWParamCharToMB(), RtlWriteRegistryValue(), RtlZeroHeap(), RXactpCommit(), RXactpOpenTargetKey(), ScrollRegion(), SeAccessCheckByType(), SeAssignPrimaryToken(), SeAssignSecurity(), SeAssignSecurityEx(), SeAssignWorldSecurityDescriptor(), SeAuditProcessCreation(), SeCaptureObjectTypeList(), SeCaptureSecurityQos(), SeCloseObjectAuditAlarm(), SeCopyClientToken(), SeCreateClientSecurity(), SeCreateClientSecurityFromSubjectContext(), SeDeleteObjectAuditAlarm(), SeExchangePrimaryToken(), SeFilterToken(), SeImpersonateClientEx(), SeIsChildToken(), SeIsChildTokenByPointer(), SeMakeAnonymousLogonToken(), SeMakeSystemToken(), SendRequest(), SepAccessCheck(), SepAccessCheckAndAuditAlarm(), SepAdtCopyToLsaSharedMemory(), SepAdtInitializeAuditingOptions(), SepAdtInitializeBounds(), SepAdtInitializeCrashOnFail(), SepAdtInitializePrivilegeAuditing(), SepAdtLogAuditRecord(), SepAuditFailed(), SepClientDropConnection(), SepClientInitialize(), SepClientOpenPipe(), SepCreateClientSecurity(), SepCreateImpersonationTokenDacl(), SepCreateToken(), SepDuplicateToken(), SepFilterToken(), SepInheritAcl(), SepInitializationPhase1(), SepInitSystemDacls(), SepOpenTokenOfThread(), SepProbeAndCaptureQosData(), SepProbeAndCaptureString_U(), SepQueryNameString(), SepQueryTypeString(), SepReadPipe(), SePrivilegeCheck(), SepRmCallLsa(), SepRmCommandServerThread(), SepRmCommandServerThreadInit(), SepRmCreateLogonSessionWrkr(), SepRmDbInitialization(), SepRmDeleteLogonSessionWrkr(), SepServerCreatePipe(), SepServerDisconnectPipe(), SepServerImpersonateClient(), SepServerImpersonatePipe(), SepServerInitialize(), SepServerListenPipe(), SepServerSpawnClientProcess(), SepServerTestAnonymous(), SepServerTestIdentification(), SepServerTestImpersonation(), SepServerWaitForNextConnect(), SepTokenInitialization(), SepTransceivePipe(), SepWritePipe(), SeQueryAuthenticationIdSubjectContext(), SeQueryInformationToken(), SeRmInitPhase1(), ServerHandleConnectionRequest(), ServerThread(), ServiceMessageBox(), SeSubProcessToken(), SetConsoleCP(), SetConsoleDisplayMode(), SetConsoleInputExeNameA(), SetConsoleOutputCP(), SetConsolePalette(), SetConsolePaletteInternal(), SetCurrentCommandLine(), SetEnvironment(), SetFont(), SetInformationProcess(), SetInputBufferSize(), SetRAMFont(), SetRAMFontCodePage(), SetScreenBufferFont(), SetUpConsole(), SetUserObjectSecurity(), SeUnregisterLogonSessionTerminatedRoutine(), ShadowHotkey(), ShowHandleOrStatus(), ShowStatus(), SrvActivateDebugger(), SrvAddConsoleAlias(), SrvAllocConsole(), SrvCloseHandle(), SrvConsoleMenuControl(), SrvConsoleNotifyLastClose(), SrvCreateConsoleScreenBuffer(), SrvDeviceEvent(), SrvDuplicateHandle(), SrvExitWindowsEx(), SrvExpungeConsoleCommandHistory(), SrvFillConsoleOutput(), SrvFlushConsoleInputBuffer(), SrvFreeConsole(), SrvGenerateConsoleCtrlEvent(), SrvGetConsoleAlias(), SrvGetConsoleAliases(), SrvGetConsoleAliasesLength(), SrvGetConsoleAliasExes(), SrvGetConsoleAliasExesLength(), SrvGetConsoleCommandHistory(), SrvGetConsoleCommandHistoryLength(), SrvGetConsoleCP(), SrvGetConsoleCurrentFont(), SrvGetConsoleCursorInfo(), SrvGetConsoleDisplayMode(), SrvGetConsoleFontInfo(), SrvGetConsoleFontSize(), SrvGetConsoleHardwareState(), SrvGetConsoleInput(), SrvGetConsoleKeyboardLayoutName(), SrvGetConsoleLangId(), SrvGetConsoleMode(), SrvGetConsoleMouseInfo(), SrvGetConsoleNumberOfFonts(), SrvGetConsoleNumberOfInputEvents(), SrvGetConsoleScreenBufferInfo(), SrvGetConsoleTitle(), SrvGetConsoleWindow(), SrvGetHandleInformation(), SrvGetLargestConsoleWindowSize(), SrvInvalidateBitMapRect(), SrvLogon(), SrvOpenConsole(), SrvReadConsole(), SrvReadConsoleOutput(), SrvReadConsoleOutputString(), SrvRegisterConsoleVDM(), SrvScrollConsoleScreenBuffer(), SrvSetConsoleActiveScreenBuffer(), SrvSetConsoleCommandHistoryMode(), SrvSetConsoleCP(), SrvSetConsoleCursor(), SrvSetConsoleCursorInfo(), SrvSetConsoleCursorPosition(), SrvSetConsoleDisplayMode(), SrvSetConsoleFont(), SrvSetConsoleHardwareState(), SrvSetConsoleIcon(), SrvSetConsoleKeyShortcuts(), SrvSetConsoleMenuClose(), SrvSetConsoleMode(), SrvSetConsoleNumberOfCommands(), SrvSetConsolePalette(), SrvSetConsoleScreenBufferSize(), SrvSetConsoleTextAttribute(), SrvSetConsoleTitle(), SrvSetConsoleWindowInfo(), SrvSetHandleInformation(), SrvShowConsoleCursor(), SrvVDMConsoleOperation(), SrvVerifyConsoleIoHandle(), SrvWriteConsole(), SrvWriteConsoleInput(), SrvWriteConsoleOutput(), SrvWriteConsoleOutputString(), SubstituteDeviceName(), SynchronousNtFsControlFile(), TerminalServerRequestThread(), TerminateConsole(), TestAccessCheck(), TestAddAce(), TestAssignSecurity(), TestCaptureSecurityDescriptor(), TestChild(), TestCreateAcl(), TestDefaultObjectMethod(), TestDeleteAce(), TestGetAce(), TestParent(), TestpCompareDuplicateToken(), TestQueryInformationAcl(), TestSeAccess(), TestSeAclRtl(), TestSeInitialize(), TestSeNamedCreate(), TestSeSecurityDescriptor(), TestSeSid(), TestSetInformationAcl(), TestSeUnnamedCreate(), TestTokenAdjustGroups(), TestTokenAdjustPrivileges(), TestTokenAssignPrimary(), TestTokenCopy(), TestTokenCreate(), TestTokenDuplicate(), TestTokenFilter(), TestTokenImpersonation(), TestTokenInitialize(), TestTokenOpenPrimary(), TestTokenQuery(), TestTokenSet(), UdfCommonCreate(), UdfCommonDevControl(), UdfCommonDirControl(), UdfCommonFsControl(), UdfCommonLockControl(), UdfCommonPnp(), UdfCommonQueryInfo(), UdfCommonQueryVolInfo(), UdfCommonRead(), UdfCommonSetInfo(), UdfCompleteFcbOpen(), UdfCompletePcb(), UdfCompleteRequest(), UdfCreateUserMdl(), UdfDetermineVolumeBounding(), UdfDismountVolume(), UdfDvdReadStructure(), UdfDvdTransferKey(), UdfFindAnchorVolumeDescriptor(), UdfFindFileSetDescriptor(), UdfFindVolumeDescriptors(), UdfFsdDispatch(), UdfFspDispatch(), UdfInitializeEnumeration(), UdfInitializePcb(), UdfInvalidateVolumes(), UdfLoadSparingTables(), UdfLockVolume(), UdfLockVolumeInternal(), UdfMountVolume(), UdfNonCachedRead(), UdfNormalizeAndRaiseStatus(), UdfOpenExistingFcb(), UdfOpenObjectByFileId(), UdfOpenObjectFromDirContext(), UdfOplockRequest(), UdfPerformDevIoCtrl(), UdfPerformVerify(), UdfPnpCancelRemove(), UdfPnpQueryRemove(), UdfPnpRemove(), UdfPnpSurpriseRemove(), UdfPurgeVolume(), UdfQueryAlternateNameInfo(), UdfQueryDirectory(), UdfQueryFsAttributeInfo(), UdfQueryFsVolumeInfo(), UdfQueryNameInfo(), UdfRaiseStatus(), UdfReadSectors(), UdfRecognizeVolume(), UdfUnlockVolume(), UdfUnlockVolumeInternal(), UdfUpcaseName(), UdfUserFsctl(), UdfVerifyFcbOperation(), UdfVerifyVcb(), UdfVerifyVolume(), UnlockConsole(), UnregisterForDeviceChangeNotifications(), UserAddAtom(), UserBeep(), UserClientShutdown(), UserCommitDesktopMemory(), UserCommitSharedMemory(), UserCreateHeap(), UserDeleteAtom(), UserFindAtom(), UserGetAtomName(), UserInitialize(), UserJobCallout(), UserRtlCreateAtomTable(), UserRtlRaiseStatus(), UserServerDllInitialization(), UserSetConsoleProcessWindowStation(), UserThreadCallout(), ValidateHdesk(), ValidateHwinsta(), vCleanConvertedTTFs(), VdmCallStringIoHandler(), VdmDispatchInterrupts(), VdmDispatchIoToHandler(), VdmDispatchIRQ13(), VdmDispatchPageFault(), VdmDispatchStringIoToHandler(), VdmFlushPrinterWriteData(), VdmpDelayInterrupt(), VdmpInitialize(), VdmpIsThreadTerminating(), VdmpPrinterDirectIoClose(), VdmpPrinterInitialize(), VdmpQueueIntApcRoutine(), VdmpQueueInterrupt(), VdmpQueueIntNormalRoutine(), VdmPrinterStatus(), VdmPrinterWriteData(), VdmpStartExecution(), VdmTraceEvent(), VideoPortCallout(), vProcessFontEntry(), vSweepFonts(), W32WinStationBroadcastSystemMessage(), W32WinStationDoConnect(), W32WinStationDoDisconnect(), W32WinStationDoMessage(), W32WinStationDoReconnect(), W32WinStationExitWindows(), W32WinStationNtSecurity(), W32WinStationPassthruDisable(), W32WinStationPassthruEnable(), W32WinStationSendWindowMessage(), W32WinStationShadowCleanup(), W32WinStationShadowSetup(), W32WinStationShadowStart(), W32WinStationShadowStop(), W32WinStationTerminate(), W32WinStationThinwireStats(), WaitOnPseudoEvent(), Win32CommandChannelThread(), Win32KDriverUnload(), Win32UserInitialize(), WinHelpW(), WinStationAPIInit(), WndProc(), WowExitTask(), WriteBuffer(), WriteConsoleWaitRoutine(), WWSB_AdjustCursorPosition(), WWSB_DoSrvWriteConsole(), WWSB_DoWriteConsole(), WWSB_WriteChars(), xProtectHandle(), xxxActivateDebugger(), xxxAllowSetForegroundWindow(), xxxClientLoadOLE(), xxxCloseDesktop(), xxxConnectService(), xxxConsoleControl(), xxxCreateDesktop(), xxxCreateDesktop2(), xxxCreateDisconnectDesktop(), xxxCreateThreadInfo(), xxxCreateWindowStation(), xxxGetThreadDesktop(), xxxHardErrorControl(), xxxHkCallHook(), xxxInitInput(), xxxInitProcessInfo(), xxxInitTerminal(), xxxMinMaximize(), xxxMsgWaitForMultipleObjects(), xxxOpenDesktop(), xxxPollAndWaitForSingleObject(), xxxQueryInformationThread(), xxxRegisterForDeviceClassNotifications(), xxxRemoteDisconnect(), xxxRemoteReconnect(), xxxRemoteShadowSetup(), xxxRemoteShadowStop(), xxxRemoteStopScreenUpdates(), xxxResolveDesktop(), xxxResolveDesktopForWOW(), xxxRestoreCsrssThreadDesktop(), xxxSendMessageEx(), xxxSetCsrssThreadDesktop(), xxxSetInformationThread(), xxxSetProcessInitState(), xxxSetProcessWindowStation(), xxxSleepTask(), xxxSwitchDesktop(), xxxUserDuplicateObject(), xxxUserNotifyConsoleApplication(), xxxUserNotifyProcessCreate(), xxxUserPowerEventCalloutWorker(), xxxUserPowerStateCalloutWorker(), xxxUserProcessCallout(), and xxxWaitForInputIdle().

---