Module FileSystem
Modules§
Structs§
- ACE_
HEADER - ATOMIC_
CREATE_ ECP_ CONTEXT - BASE_
MCB - BOOT_
AREA_ INFO - BOOT_
AREA_ INFO_ 0 - CACHE_
MANAGER_ CALLBACKS - CACHE_
MANAGER_ CALLBACKS_ EX - CACHE_
MANAGER_ CALLBACK_ FUNCTIONS - CACHE_
UNINITIALIZE_ EVENT - CC_
ASYNC_ READ_ CONTEXT - CC_
ERROR_ CALLBACK_ CONTEXT - CC_
FILE_ SIZES - COMPRESSED_
DATA_ INFO - CONTAINER_
ROOT_ INFO_ INPUT - CONTAINER_
ROOT_ INFO_ OUTPUT - CONTAINER_
VOLUME_ STATE - COPY_
INFORMATION - CPTABLEINFO
- CREATE_
REDIRECTION_ ECP_ CONTEXT - CREATE_
USN_ JOURNAL_ DATA - CSV_
DOWN_ LEVEL_ OPEN_ ECP_ CONTEXT - CSV_
QUERY_ FILE_ REVISION_ ECP_ CONTEXT - CSV_
QUERY_ FILE_ REVISION_ ECP_ CONTEXT_ FILE_ ID_ 128 - CSV_
SET_ HANDLE_ PROPERTIES_ ECP_ CONTEXT - DUAL_
OPLOCK_ KEY_ ECP_ CONTEXT - DUPLICATE_
CLUSTER_ DATA - ECP_
OPEN_ PARAMETERS - EOF_
WAIT_ BLOCK - EXTENT_
READ_ CACHE_ INFO_ BUFFER - FILE_
ACCESS_ INFORMATION - FILE_
ALIGNMENT_ INFORMATION - FILE_
ALLOCATION_ INFORMATION - FILE_
ALL_ INFORMATION - FILE_
BASIC_ INFORMATION - FILE_
BOTH_ DIR_ INFORMATION - FILE_
CASE_ SENSITIVE_ INFORMATION - FILE_
COMPLETION_ INFORMATION - FILE_
COMPRESSION_ INFORMATION - FILE_
DIRECTORY_ INFORMATION - FILE_
DISPOSITION_ INFORMATION - FILE_
DISPOSITION_ INFORMATION_ EX - FILE_
EA_ INFORMATION - FILE_
END_ OF_ FILE_ INFORMATION_ EX - FILE_
FS_ ATTRIBUTE_ INFORMATION - FILE_
FS_ CONTROL_ INFORMATION - FILE_
FS_ DATA_ COPY_ INFORMATION - FILE_
FS_ DRIVER_ PATH_ INFORMATION - FILE_
FS_ SECTOR_ SIZE_ INFORMATION - FILE_
FS_ VOLUME_ FLAGS_ INFORMATION - FILE_
FULL_ DIR_ INFORMATION - FILE_
FULL_ EA_ INFORMATION - FILE_
GET_ EA_ INFORMATION - FILE_
GET_ QUOTA_ INFORMATION - FILE_
ID_ BOTH_ DIR_ INFORMATION - FILE_
ID_ EXTD_ BOTH_ DIR_ INFORMATION - FILE_
ID_ EXTD_ DIR_ INFORMATION - FILE_
ID_ FULL_ DIR_ INFORMATION - FILE_
ID_ GLOBAL_ TX_ DIR_ INFORMATION - FILE_
ID_ INFORMATION - FILE_
INFORMATION_ DEFINITION - FILE_
INTERNAL_ INFORMATION - FILE_
KNOWN_ FOLDER_ INFORMATION - FILE_
LINKS_ FULL_ ID_ INFORMATION - FILE_
LINKS_ INFORMATION - FILE_
LINK_ ENTRY_ FULL_ ID_ INFORMATION - FILE_
LINK_ ENTRY_ INFORMATION - FILE_
LINK_ INFORMATION - FILE_
LOCK - FILE_
LOCK_ INFO - FILE_
MAILSLOT_ QUERY_ INFORMATION - FILE_
MAILSLOT_ SET_ INFORMATION - FILE_
MODE_ INFORMATION - FILE_
MOVE_ CLUSTER_ INFORMATION - FILE_
NAMES_ INFORMATION - FILE_
NAME_ INFORMATION - FILE_
NETWORK_ OPEN_ INFORMATION - FILE_
NETWORK_ PHYSICAL_ NAME_ INFORMATION - FILE_
OBJECTID_ INFORMATION - FILE_
OBJECTID_ INFORMATION_ 0_ 0 - FILE_
PIPE_ ASSIGN_ EVENT_ BUFFER - FILE_
PIPE_ CLIENT_ PROCESS_ BUFFER - FILE_
PIPE_ CLIENT_ PROCESS_ BUFFER_ EX - FILE_
PIPE_ CLIENT_ PROCESS_ BUFFER_ V2 - FILE_
PIPE_ CREATE_ SYMLINK_ INPUT - FILE_
PIPE_ DELETE_ SYMLINK_ INPUT - FILE_
PIPE_ EVENT_ BUFFER - FILE_
PIPE_ INFORMATION - FILE_
PIPE_ LOCAL_ INFORMATION - FILE_
PIPE_ PEEK_ BUFFER - FILE_
PIPE_ REMOTE_ INFORMATION - FILE_
PIPE_ SILO_ ARRIVAL_ INPUT - FILE_
PIPE_ WAIT_ FOR_ BUFFER - FILE_
POSITION_ INFORMATION - FILE_
QUOTA_ INFORMATION - FILE_
REMOTE_ PROTOCOL_ INFORMATION - FILE_
REMOTE_ PROTOCOL_ INFORMATION_ 0 - FILE_
REMOTE_ PROTOCOL_ INFORMATION_ 1_ 0 - FILE_
REMOTE_ PROTOCOL_ INFORMATION_ 1_ 0_ 0 - FILE_
REMOTE_ PROTOCOL_ INFORMATION_ 1_ 0_ 1 - FILE_
RENAME_ INFORMATION - FILE_
REPARSE_ POINT_ INFORMATION - FILE_
STANDARD_ INFORMATION - FILE_
STANDARD_ LINK_ INFORMATION - FILE_
STAT_ INFORMATION - FILE_
STAT_ LX_ INFORMATION - FILE_
STORAGE_ RESERVE_ ID_ INFORMATION - FILE_
STREAM_ INFORMATION - FILE_
TIMESTAMPS - FILE_
TRACKING_ INFORMATION - FILE_
VOLUME_ NAME_ INFORMATION - FSCTL_
GHOST_ FILE_ EXTENTS_ INPUT_ BUFFER - FSCTL_
QUERY_ GHOSTED_ FILE_ EXTENTS_ INPUT_ RANGE - FSCTL_
QUERY_ GHOSTED_ FILE_ EXTENTS_ OUTPUT - FSCTL_
QUERY_ VOLUME_ NUMA_ INFO_ OUTPUT - FSCTL_
UNMAP_ SPACE_ INPUT_ BUFFER - FSCTL_
UNMAP_ SPACE_ OUTPUT - FSRTL_
ADVANCED_ FCB_ HEADER - FSRTL_
AUXILIARY_ BUFFER - FSRTL_
COMMON_ FCB_ HEADER - FSRTL_
MUP_ PROVIDER_ INFO_ LEVEL_ 1 - FSRTL_
MUP_ PROVIDER_ INFO_ LEVEL_ 2 - FSRTL_
PER_ FILEOBJECT_ CONTEXT - FSRTL_
PER_ FILE_ CONTEXT - FSRTL_
PER_ STREAM_ CONTEXT - FSRTL_
UNC_ PROVIDER_ REGISTRATION - FSRTL_
UNC_ PROVIDER_ REGISTRATION_ 0_ 0 - FSRTL_
UNC_ PROVIDER_ REGISTRATION_ 1_ 0 - FS_
BPIO_ INFO - FS_
BPIO_ INPUT - FS_
FILTER_ CALLBACKS - FS_
FILTER_ CALLBACK_ DATA - FS_
FILTER_ PARAMETERS_ 0 - FS_
FILTER_ PARAMETERS_ 1 - FS_
FILTER_ PARAMETERS_ 2 - FS_
FILTER_ PARAMETERS_ 3 - FS_
FILTER_ PARAMETERS_ 4 - FS_
FILTER_ SECTION_ SYNC_ OUTPUT - GENERATE_
NAME_ CONTEXT - GHOSTED_
FILE_ EXTENT - IO_
CREATE_ STREAM_ FILE_ OPTIONS - IO_
DEVICE_ HINT_ ECP_ CONTEXT - IO_
PRIORITY_ INFO - IO_
STOP_ ON_ SYMLINK_ FILTER_ ECP_ v0 - IO_
STOP_ ON_ SYMLINK_ FILTER_ ECP_ v0_ 0 - KAPC_
STATE - KAPC_
STATE_ 0_ 0 - KAPC_
STATE_ 1_ 0 - LARGE_
MCB - LCN_
WEAK_ REFERENCE_ BUFFER - LCN_
WEAK_ REFERENCE_ CREATE_ INPUT_ BUFFER - LINK_
TRACKING_ INFORMATION - MCB
- MEMORY_
RANGE_ ENTRY - MFT_
ENUM_ DATA - MM_
PREFETCH_ FLAGS_ 0 - MSV1_
0_ ENUMUSERS_ REQUEST - MSV1_
0_ ENUMUSERS_ RESPONSE - MSV1_
0_ GETCHALLENRESP_ REQUEST - MSV1_
0_ GETCHALLENRESP_ REQUEST_ V1 - MSV1_
0_ GETCHALLENRESP_ RESPONSE - MSV1_
0_ GETUSERINFO_ REQUEST - MSV1_
0_ GETUSERINFO_ RESPONSE - MSV1_
0_ LM20_ CHALLENGE_ REQUEST - MSV1_
0_ LM20_ CHALLENGE_ RESPONSE - NETWORK_
APP_ INSTANCE_ ECP_ CONTEXT - NETWORK_
APP_ INSTANCE_ VERSION_ ECP_ CONTEXT - NETWORK_
OPEN_ ECP_ CONTEXT - NETWORK_
OPEN_ ECP_ CONTEXT_ 0 - NETWORK_
OPEN_ ECP_ CONTEXT_ 0_ 0 - NETWORK_
OPEN_ ECP_ CONTEXT_ 0_ 1 - NETWORK_
OPEN_ ECP_ CONTEXT_ V0 - NETWORK_
OPEN_ ECP_ CONTEXT_ V0_ 0 - NETWORK_
OPEN_ ECP_ CONTEXT_ V0_ 0_ 0 - NETWORK_
OPEN_ ECP_ CONTEXT_ V0_ 0_ 1 - NFS_
OPEN_ ECP_ CONTEXT - NLSTABLEINFO
- OPEN_
REPARSE_ LIST - OPEN_
REPARSE_ LIST_ ENTRY - OPLOCK_
KEY_ CONTEXT - OPLOCK_
KEY_ ECP_ CONTEXT - OPLOCK_
NOTIFY_ PARAMS - PHYSICAL_
EXTENTS_ DESCRIPTOR - PHYSICAL_
MEMORY_ DESCRIPTOR - PHYSICAL_
MEMORY_ RUN - PREFETCH_
OPEN_ ECP_ CONTEXT - PREFIX_
TABLE - PREFIX_
TABLE_ ENTRY - PUBLIC_
BCB - QUERY_
BAD_ RANGES_ INPUT - QUERY_
DIRECT_ ACCESS_ EXTENTS - QUERY_
ON_ CREATE_ EA_ INFORMATION - QUERY_
ON_ CREATE_ ECP_ CONTEXT - QUERY_
ON_ CREATE_ FILE_ LX_ INFORMATION - QUERY_
ON_ CREATE_ FILE_ STAT_ INFORMATION - QUERY_
PATH_ REQUEST - QUERY_
PATH_ REQUEST_ EX - QUERY_
PATH_ RESPONSE - READ_
AHEAD_ PARAMETERS - READ_
LIST - READ_
USN_ JOURNAL_ DATA - REFS_
DEALLOCATE_ RANGES_ INPUT_ BUFFER - REFS_
DEALLOCATE_ RANGES_ INPUT_ BUFFER_ EX - REFS_
DEALLOCATE_ RANGES_ RANGE - REFS_
QUERY_ VOLUME_ COMPRESSION_ INFO_ OUTPUT_ BUFFER - REFS_
QUERY_ VOLUME_ DEDUP_ INFO_ OUTPUT_ BUFFER - REFS_
REMOVE_ HARDLINK_ BACKPOINTER - REFS_
SET_ VOLUME_ COMPRESSION_ INFO_ INPUT_ BUFFER - REFS_
SET_ VOLUME_ DEDUP_ INFO_ INPUT_ BUFFER - REFS_
STREAM_ EXTENT - REFS_
STREAM_ SNAPSHOT_ LIST_ OUTPUT_ BUFFER - REFS_
STREAM_ SNAPSHOT_ LIST_ OUTPUT_ BUFFER_ ENTRY - REFS_
STREAM_ SNAPSHOT_ MANAGEMENT_ INPUT_ BUFFER - REFS_
STREAM_ SNAPSHOT_ QUERY_ DELTAS_ INPUT_ BUFFER - REFS_
STREAM_ SNAPSHOT_ QUERY_ DELTAS_ OUTPUT_ BUFFER - REFS_
VOLUME_ COUNTER_ INFO_ INPUT_ BUFFER - REFS_
VOLUME_ DATA_ BUFFER - REMOTE_
LINK_ TRACKING_ INFORMATION - REPARSE_
DATA_ BUFFER - REPARSE_
DATA_ BUFFER_ 0_ 0 - REPARSE_
DATA_ BUFFER_ 0_ 1 - REPARSE_
DATA_ BUFFER_ 0_ 2 - REPARSE_
DATA_ BUFFER_ EX - REPARSE_
INDEX_ KEY - RETRIEVAL_
POINTERS_ AND_ REFCOUNT_ BUFFER - RETRIEVAL_
POINTERS_ AND_ REFCOUNT_ BUFFER_ 0 - RKF_
BYPASS_ ECP_ CONTEXT - RTL_
HEAP_ MEMORY_ LIMIT_ DATA - RTL_
HEAP_ MEMORY_ LIMIT_ INFO - RTL_
HEAP_ PARAMETERS - RTL_
NLS_ STATE - RTL_
SEGMENT_ HEAP_ MEMORY_ SOURCE - RTL_
SEGMENT_ HEAP_ PARAMETERS - RTL_
SEGMENT_ HEAP_ VA_ CALLBACKS - SECURITY_
CLIENT_ CONTEXT - SEC_
APPLICATION_ PROTOCOLS - SEC_
DTLS_ MTU - SEC_
FLAGS - SEC_
NEGOTIATION_ INFO - SEC_
PRESHAREDKEY - SEC_
SRTP_ MASTER_ KEY_ IDENTIFIER - SET_
CACHED_ RUNS_ STATE_ INPUT_ BUFFER - SE_
AUDIT_ INFO - SE_
EXPORTS - SRV_
OPEN_ ECP_ CONTEXT - SYSTEM_
PROCESS_ TRUST_ LABEL_ ACE - SecBuffer
- SecBuffer
Desc - SecHandle
- TUNNEL
- UNICODE_
PREFIX_ TABLE - UNICODE_
PREFIX_ TABLE_ ENTRY - USN_
JOURNAL_ DATA - USN_
RECORD - VCN_
RANGE_ INPUT_ BUFFER - VOLUME_
REFS_ INFO_ BUFFER
Constants§
- ATOMIC_
CREATE_ ECP_ IN_ FLAG_ BEST_ EFFORT - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ EOF_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ FILE_ ATTRIBUTES_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ GEN_ FLAGS_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ MARK_ USN_ SOURCE_ INFO - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ OPERATION_ MASK - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ OP_ FLAGS_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ REPARSE_ POINT_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ SPARSE_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ SUPPRESS_ DIR_ CHANGE_ NOTIFY - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ SUPPRESS_ FILE_ ATTRIBUTE_ INHERITANCE - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ SUPPRESS_ PARENT_ TIMESTAMPS_ UPDATE - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ TIMESTAMPS_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ VDL_ SPECIFIED - ATOMIC_
CREATE_ ECP_ IN_ FLAG_ WRITE_ USN_ CLOSE_ RECORD - ATOMIC_
CREATE_ ECP_ IN_ OP_ FLAG_ CASE_ SENSITIVE_ FLAGS_ SPECIFIED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ EOF_ SET - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ FILE_ ATTRIBUTES_ RETURNED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ FILE_ ATTRIBUTES_ SET - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ FILE_ ATTRIBUTE_ INHERITANCE_ SUPPRESSED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ OPERATION_ MASK - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ OP_ FLAGS_ HONORED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ REPARSE_ POINT_ SET - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ SPARSE_ SET - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ TIMESTAMPS_ RETURNED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ TIMESTAMPS_ SET - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ USN_ CLOSE_ RECORD_ WRITTEN - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ USN_ RETURNED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ USN_ SOURCE_ INFO_ MARKED - ATOMIC_
CREATE_ ECP_ OUT_ FLAG_ VDL_ SET - ATOMIC_
CREATE_ ECP_ OUT_ OP_ FLAG_ CASE_ SENSITIVE_ FLAGS_ SET - Audit
Access Check - Audit
Close NonObject - Audit
Close Object - Audit
Delete Object - Audit
Handle Creation - Audit
Object Reference - Audit
Open NonObject - Audit
Open Object - Audit
Open Object ForDelete - Audit
Open Object ForDelete With Transaction - Audit
Open Object With Transaction - Audit
Privilege Object - Audit
Privilege Service - CACHE_
MANAGER_ CALLBACKS_ EX_ V1 - CACHE_
USE_ DIRECT_ ACCESS_ MAPPING - CACHE_
VALID_ FLAGS - CC_
ACQUIRE_ DONT_ WAIT - CC_
ACQUIRE_ SUPPORTS_ ASYNC_ LAZYWRITE - CC_
AGGRESSIVE_ UNMAP_ BEHIND - CC_
DISABLE_ DIRTY_ PAGE_ TRACKING - CC_
DISABLE_ READ_ AHEAD - CC_
DISABLE_ UNMAP_ BEHIND - CC_
DISABLE_ WRITE_ BEHIND - CC_
ENABLE_ CPU_ CACHE - CC_
ENABLE_ DISK_ IO_ ACCOUNTING - CC_
FLUSH_ AND_ PURGE_ GATHER_ DIRTY_ BITS - CC_
FLUSH_ AND_ PURGE_ NO_ PURGE - CC_
FLUSH_ AND_ PURGE_ WRITEABLE_ VIEWS_ NOTSEEN - COMPRESSION_
ENGINE_ MASK - COMPRESSION_
ENGINE_ MAX - COMPRESSION_
FORMAT_ MASK - COMPRESSION_
FORMAT_ MAX - CREATE_
REDIRECTION_ FLAGS_ SERVICED_ FROM_ LAYER - CREATE_
REDIRECTION_ FLAGS_ SERVICED_ FROM_ REGISTERED_ LAYER - CREATE_
REDIRECTION_ FLAGS_ SERVICED_ FROM_ REMOTE_ LAYER - CREATE_
REDIRECTION_ FLAGS_ SERVICED_ FROM_ SCRATCH - CREATE_
REDIRECTION_ FLAGS_ SERVICED_ FROM_ USER_ MODE - CSV_
SET_ HANDLE_ PROPERTIES_ ECP_ CONTEXT_ FLAGS_ VALID_ ONLY_ IF_ CSV_ COORDINATOR - Change
Data Control Area - Change
Image Control Area - Change
Shared Cache Map - CsvCsv
FsInternal File Object - CsvDown
Level File Object - DD_
MUP_ DEVICE_ NAME - DEVICE_
RESET_ KEEP_ STACK - DEVICE_
RESET_ RESERVED_ 0 - DEVICE_
RESET_ RESERVED_ 1 - DO_
BOOT_ CRITICAL - DO_
BUFFERED_ IO - DO_
BUS_ ENUMERATED_ DEVICE - DO_
DAX_ VOLUME - DO_
DEVICE_ HAS_ NAME - DO_
DEVICE_ INITIALIZING - DO_
DEVICE_ IRP_ REQUIRES_ EXTENSION - DO_
DEVICE_ TO_ BE_ RESET - DO_
DIRECT_ IO - DO_
DISALLOW_ EXECUTE - DO_
EXCLUSIVE - DO_
FORCE_ NEITHER_ IO - DO_
LONG_ TERM_ REQUESTS - DO_
LOW_ PRIORITY_ FILESYSTEM - DO_
MAP_ IO_ BUFFER - DO_
NEVER_ LAST_ DEVICE - DO_
NOT_ PURGE_ DIRTY_ PAGES - DO_
NOT_ RETRY_ PURGE - DO_
POWER_ INRUSH - DO_
POWER_ PAGABLE - DO_
SHUTDOWN_ REGISTERED - DO_
SUPPORTS_ PERSISTENT_ ACLS - DO_
SUPPORTS_ TRANSACTIONS - DO_
SYSTEM_ BOOT_ PARTITION - DO_
SYSTEM_ CRITICAL_ PARTITION - DO_
SYSTEM_ SYSTEM_ PARTITION - DO_
VERIFY_ VOLUME - DO_
VOLUME_ DEVICE_ OBJECT - DfsLink
Tracking Information - EA_
NAME_ NETWORK_ OPEN_ ECP_ INTEGRITY - EA_
NAME_ NETWORK_ OPEN_ ECP_ INTEGRITY_ U - EA_
NAME_ NETWORK_ OPEN_ ECP_ PRIVACY - EA_
NAME_ NETWORK_ OPEN_ ECP_ PRIVACY_ U - ECP_
OPEN_ PARAMETERS_ FLAG_ FAIL_ ON_ CASE_ SENSITIVE_ DIR - ECP_
OPEN_ PARAMETERS_ FLAG_ IGNORE_ DIR_ CASE_ SENSITIVITY - ECP_
OPEN_ PARAMETERS_ FLAG_ OPEN_ FOR_ DELETE - ECP_
OPEN_ PARAMETERS_ FLAG_ OPEN_ FOR_ READ - ECP_
OPEN_ PARAMETERS_ FLAG_ OPEN_ FOR_ WRITE - ECP_
TYPE_ CLFS_ CREATE_ CONTAINER - ECP_
TYPE_ IO_ STOP_ ON_ SYMLINK_ FILTER_ GUID - ECP_
TYPE_ OPEN_ REPARSE_ GUID - EVENT_
INCREMENT - EqualTo
- FILE_
ACTION_ ADDED_ STREAM - FILE_
ACTION_ ID_ NOT_ TUNNELLED - FILE_
ACTION_ MODIFIED_ STREAM - FILE_
ACTION_ REMOVED_ BY_ DELETE - FILE_
ACTION_ REMOVED_ STREAM - FILE_
ACTION_ TUNNELLED_ ID_ COLLISION - FILE_
CLEANUP_ FILE_ DELETED - FILE_
CLEANUP_ FILE_ REMAINS - FILE_
CLEANUP_ LINK_ DELETED - FILE_
CLEANUP_ POSIX_ STYLE_ DELETE - FILE_
CLEANUP_ STREAM_ DELETED - FILE_
CLEANUP_ UNKNOWN - FILE_
CLEANUP_ WRONG_ DEVICE - FILE_
COMPLETE_ IF_ OPLOCKED - FILE_
CONTAINS_ EXTENDED_ CREATE_ INFORMATION - FILE_
CREATE - FILE_
CREATE_ TREE_ CONNECTION - FILE_
DELETE_ ON_ CLOSE - FILE_
DIRECTORY_ FILE - FILE_
DISALLOW_ EXCLUSIVE - FILE_
DISPOSITION_ DELETE - FILE_
DISPOSITION_ DO_ NOT_ DELETE - FILE_
DISPOSITION_ FORCE_ IMAGE_ SECTION_ CHECK - FILE_
DISPOSITION_ IGNORE_ READONLY_ ATTRIBUTE - FILE_
DISPOSITION_ ON_ CLOSE - FILE_
DISPOSITION_ POSIX_ SEMANTICS - FILE_
EA_ TYPE_ ASCII - FILE_
EA_ TYPE_ ASN1 - FILE_
EA_ TYPE_ BINARY - FILE_
EA_ TYPE_ BITMAP - FILE_
EA_ TYPE_ EA - FILE_
EA_ TYPE_ FAMILY_ IDS - FILE_
EA_ TYPE_ ICON - FILE_
EA_ TYPE_ METAFILE - FILE_
EA_ TYPE_ MVMT - FILE_
EA_ TYPE_ MVST - FILE_
ID_ GLOBAL_ TX_ DIR_ INFO_ FLAG_ VISIBLE_ OUTSIDE_ TX - FILE_
ID_ GLOBAL_ TX_ DIR_ INFO_ FLAG_ VISIBLE_ TO_ TX - FILE_
ID_ GLOBAL_ TX_ DIR_ INFO_ FLAG_ WRITELOCKED - FILE_
LINK_ FORCE_ RESIZE_ SOURCE_ SR - FILE_
LINK_ FORCE_ RESIZE_ SR - FILE_
LINK_ FORCE_ RESIZE_ TARGET_ SR - FILE_
LINK_ IGNORE_ READONLY_ ATTRIBUTE - FILE_
LINK_ NO_ DECREASE_ AVAILABLE_ SPACE - FILE_
LINK_ NO_ INCREASE_ AVAILABLE_ SPACE - FILE_
LINK_ POSIX_ SEMANTICS - FILE_
LINK_ PRESERVE_ AVAILABLE_ SPACE - FILE_
LINK_ REPLACE_ IF_ EXISTS - FILE_
LINK_ SUPPRESS_ STORAGE_ RESERVE_ INHERITANCE - FILE_
NEED_ EA - FILE_
NON_ DIRECTORY_ FILE - FILE_
NOTIFY_ CHANGE_ EA - FILE_
NOTIFY_ CHANGE_ NAME - FILE_
NOTIFY_ CHANGE_ STREAM_ NAME - FILE_
NOTIFY_ CHANGE_ STREAM_ SIZE - FILE_
NOTIFY_ CHANGE_ STREAM_ WRITE - FILE_
NOTIFY_ VALID_ MASK - FILE_
NO_ COMPRESSION - FILE_
NO_ EA_ KNOWLEDGE - FILE_
NO_ INTERMEDIATE_ BUFFERING - FILE_
OPBATCH_ BREAK_ UNDERWAY - FILE_
OPEN - FILE_
OPEN_ BY_ FILE_ ID - FILE_
OPEN_ FOR_ BACKUP_ INTENT - FILE_
OPEN_ FOR_ FREE_ SPACE_ QUERY - FILE_
OPEN_ IF - FILE_
OPEN_ NO_ RECALL - FILE_
OPEN_ REPARSE_ POINT - FILE_
OPEN_ REQUIRING_ OPLOCK - FILE_
OPLOCK_ BROKEN_ TO_ LEVEL_ 2 - FILE_
OPLOCK_ BROKEN_ TO_ NONE - FILE_
OVERWRITE - FILE_
OVERWRITE_ IF - FILE_
PIPE_ ACCEPT_ REMOTE_ CLIENTS - FILE_
PIPE_ BYTE_ STREAM_ MODE - FILE_
PIPE_ BYTE_ STREAM_ TYPE - FILE_
PIPE_ CLIENT_ END - FILE_
PIPE_ CLOSING_ STATE - FILE_
PIPE_ COMPLETE_ OPERATION - FILE_
PIPE_ COMPUTER_ NAME_ LENGTH - FILE_
PIPE_ CONNECTED_ STATE - FILE_
PIPE_ DISCONNECTED_ STATE - FILE_
PIPE_ FULL_ DUPLEX - FILE_
PIPE_ INBOUND - FILE_
PIPE_ LISTENING_ STATE - FILE_
PIPE_ MESSAGE_ MODE - FILE_
PIPE_ MESSAGE_ TYPE - FILE_
PIPE_ OUTBOUND - FILE_
PIPE_ QUEUE_ OPERATION - FILE_
PIPE_ READ_ DATA - FILE_
PIPE_ REJECT_ REMOTE_ CLIENTS - FILE_
PIPE_ SERVER_ END - FILE_
PIPE_ SYMLINK_ FLAG_ GLOBAL - FILE_
PIPE_ SYMLINK_ FLAG_ RELATIVE - FILE_
PIPE_ TYPE_ VALID_ MASK - FILE_
PIPE_ WRITE_ SPACE - FILE_
RANDOM_ ACCESS - FILE_
RENAME_ FORCE_ RESIZE_ SOURCE_ SR - FILE_
RENAME_ FORCE_ RESIZE_ SR - FILE_
RENAME_ FORCE_ RESIZE_ TARGET_ SR - FILE_
RENAME_ IGNORE_ READONLY_ ATTRIBUTE - FILE_
RENAME_ NO_ DECREASE_ AVAILABLE_ SPACE - FILE_
RENAME_ NO_ INCREASE_ AVAILABLE_ SPACE - FILE_
RENAME_ POSIX_ SEMANTICS - FILE_
RENAME_ PRESERVE_ AVAILABLE_ SPACE - FILE_
RENAME_ REPLACE_ IF_ EXISTS - FILE_
RENAME_ SUPPRESS_ PIN_ STATE_ INHERITANCE - FILE_
RENAME_ SUPPRESS_ STORAGE_ RESERVE_ INHERITANCE - FILE_
RESERVE_ OPFILTER - FILE_
SEQUENTIAL_ ONLY - FILE_
SESSION_ AWARE - FILE_
SUPERSEDE - FILE_
SYNCHRONOUS_ IO_ ALERT - FILE_
SYNCHRONOUS_ IO_ NONALERT - FILE_
VC_ CONTENT_ INDEX_ DISABLED - FILE_
VC_ LOG_ QUOTA_ LIMIT - FILE_
VC_ LOG_ QUOTA_ THRESHOLD - FILE_
VC_ LOG_ VOLUME_ LIMIT - FILE_
VC_ LOG_ VOLUME_ THRESHOLD - FILE_
VC_ QUOTAS_ INCOMPLETE - FILE_
VC_ QUOTAS_ REBUILDING - FILE_
VC_ QUOTA_ ENFORCE - FILE_
VC_ QUOTA_ MASK - FILE_
VC_ QUOTA_ NONE - FILE_
VC_ QUOTA_ TRACK - FILE_
VC_ VALID_ MASK - FILE_
WRITE_ THROUGH - FLAGS_
DELAY_ REASONS_ BITMAP_ SCANNED - FLAGS_
DELAY_ REASONS_ LOG_ FILE_ FULL - FLAGS_
END_ OF_ FILE_ INFO_ EX_ EXTEND_ PAGING - FLAGS_
END_ OF_ FILE_ INFO_ EX_ NO_ EXTRA_ PAGING_ EXTEND - FLAGS_
END_ OF_ FILE_ INFO_ EX_ TIME_ CONSTRAINED - FSCTL_
LMR_ GET_ LINK_ TRACKING_ INFORMATION - FSCTL_
LMR_ SET_ LINK_ TRACKING_ INFORMATION - FSCTL_
MAILSLOT_ PEEK - FSCTL_
PIPE_ ASSIGN_ EVENT - FSCTL_
PIPE_ CREATE_ SYMLINK - FSCTL_
PIPE_ DELETE_ SYMLINK - FSCTL_
PIPE_ DISABLE_ IMPERSONATE - FSCTL_
PIPE_ DISCONNECT - FSCTL_
PIPE_ FLUSH - FSCTL_
PIPE_ GET_ CONNECTION_ ATTRIBUTE - FSCTL_
PIPE_ GET_ HANDLE_ ATTRIBUTE - FSCTL_
PIPE_ GET_ PIPE_ ATTRIBUTE - FSCTL_
PIPE_ IMPERSONATE - FSCTL_
PIPE_ INTERNAL_ READ - FSCTL_
PIPE_ INTERNAL_ READ_ OVFLOW - FSCTL_
PIPE_ INTERNAL_ TRANSCEIVE - FSCTL_
PIPE_ INTERNAL_ WRITE - FSCTL_
PIPE_ LISTEN - FSCTL_
PIPE_ PEEK - FSCTL_
PIPE_ QUERY_ CLIENT_ PROCESS - FSCTL_
PIPE_ QUERY_ CLIENT_ PROCESS_ V2 - FSCTL_
PIPE_ QUERY_ EVENT - FSCTL_
PIPE_ SET_ CLIENT_ PROCESS - FSCTL_
PIPE_ SET_ CONNECTION_ ATTRIBUTE - FSCTL_
PIPE_ SET_ HANDLE_ ATTRIBUTE - FSCTL_
PIPE_ SET_ PIPE_ ATTRIBUTE - FSCTL_
PIPE_ SILO_ ARRIVAL - FSCTL_
PIPE_ TRANSCEIVE - FSCTL_
PIPE_ WAIT - FSRTL_
ADD_ TC_ CASE_ SENSITIVE - FSRTL_
ADD_ TC_ KEY_ BY_ SHORT_ NAME - FSRTL_
ALLOCATE_ ECPLIST_ FLAG_ CHARGE_ QUOTA - FSRTL_
ALLOCATE_ ECP_ FLAG_ CHARGE_ QUOTA - FSRTL_
ALLOCATE_ ECP_ FLAG_ NONPAGED_ POOL - FSRTL_
AUXILIARY_ FLAG_ DEALLOCATE - FSRTL_
CC_ FLUSH_ ERROR_ FLAG_ NO_ HARD_ ERROR - FSRTL_
CC_ FLUSH_ ERROR_ FLAG_ NO_ LOG_ ENTRY - FSRTL_
DRIVER_ BACKING_ FLAG_ USE_ PAGE_ FILE - FSRTL_
ECP_ LOOKASIDE_ FLAG_ NONPAGED_ POOL - FSRTL_
FAT_ LEGAL - FSRTL_
FCB_ HEADER_ V0 - FSRTL_
FCB_ HEADER_ V1 - FSRTL_
FCB_ HEADER_ V2 - FSRTL_
FCB_ HEADER_ V3 - FSRTL_
FCB_ HEADER_ V4 - FSRTL_
FIND_ TC_ CASE_ SENSITIVE - FSRTL_
FLAG2_ BYPASSIO_ STREAM_ PAUSED - FSRTL_
FLAG2_ DO_ MODIFIED_ WRITE - FSRTL_
FLAG2_ IS_ PAGING_ FILE - FSRTL_
FLAG2_ PURGE_ WHEN_ MAPPED - FSRTL_
FLAG2_ SUPPORTS_ FILTER_ CONTEXTS - FSRTL_
FLAG2_ WRITABLE_ USER_ MAPPED_ FILE - FSRTL_
FLAG_ ACQUIRE_ MAIN_ RSRC_ EX - FSRTL_
FLAG_ ACQUIRE_ MAIN_ RSRC_ SH - FSRTL_
FLAG_ ADVANCED_ HEADER - FSRTL_
FLAG_ EOF_ ADVANCE_ ACTIVE - FSRTL_
FLAG_ FILE_ LENGTH_ CHANGED - FSRTL_
FLAG_ FILE_ MODIFIED - FSRTL_
FLAG_ LIMIT_ MODIFIED_ PAGES - FSRTL_
FLAG_ USER_ MAPPED_ FILE - FSRTL_
HPFS_ LEGAL - FSRTL_
NTFS_ LEGAL - FSRTL_
OLE_ LEGAL - FSRTL_
UNC_ HARDENING_ CAPABILITIES_ INTEGRITY - FSRTL_
UNC_ HARDENING_ CAPABILITIES_ MUTUAL_ AUTH - FSRTL_
UNC_ HARDENING_ CAPABILITIES_ PRIVACY - FSRTL_
UNC_ PROVIDER_ FLAGS_ CONTAINER_ AWARE - FSRTL_
UNC_ PROVIDER_ FLAGS_ CSC_ ENABLED - FSRTL_
UNC_ PROVIDER_ FLAGS_ DOMAIN_ SVC_ AWARE - FSRTL_
UNC_ PROVIDER_ FLAGS_ MAILSLOTS_ SUPPORTED - FSRTL_
UNC_ REGISTRATION_ CURRENT_ VERSION - FSRTL_
UNC_ REGISTRATION_ VERSION_ 0200 - FSRTL_
UNC_ REGISTRATION_ VERSION_ 0201 - FSRTL_
VIRTDISK_ FULLY_ ALLOCATED - FSRTL_
VIRTDISK_ NO_ DRIVE_ LETTER - FSRTL_
VOLUME_ BACKGROUND_ FORMAT - FSRTL_
VOLUME_ CHANGE_ SIZE - FSRTL_
VOLUME_ DISMOUNT - FSRTL_
VOLUME_ DISMOUNT_ FAILED - FSRTL_
VOLUME_ FORCED_ CLOSED - FSRTL_
VOLUME_ INFO_ MAKE_ COMPAT - FSRTL_
VOLUME_ LOCK - FSRTL_
VOLUME_ LOCK_ FAILED - FSRTL_
VOLUME_ MOUNT - FSRTL_
VOLUME_ NEEDS_ CHKDSK - FSRTL_
VOLUME_ PREPARING_ EJECT - FSRTL_
VOLUME_ UNLOCK - FSRTL_
VOLUME_ WEARING_ OUT - FSRTL_
VOLUME_ WORM_ NEAR_ FULL - FSRTL_
WILD_ CHARACTER - FS_
FILTER_ ACQUIRE_ FOR_ CC_ FLUSH - FS_
FILTER_ ACQUIRE_ FOR_ MOD_ WRITE - FS_
FILTER_ ACQUIRE_ FOR_ SECTION_ SYNCHRONIZATION - FS_
FILTER_ QUERY_ OPEN - FS_
FILTER_ RELEASE_ FOR_ CC_ FLUSH - FS_
FILTER_ RELEASE_ FOR_ MOD_ WRITE - FS_
FILTER_ RELEASE_ FOR_ SECTION_ SYNCHRONIZATION - FS_
FILTER_ SECTION_ SYNC_ IMAGE_ EXTENTS_ ARE_ NOT_ RVA - FS_
FILTER_ SECTION_ SYNC_ IN_ FLAG_ DONT_ UPDATE_ LAST_ ACCESS - FS_
FILTER_ SECTION_ SYNC_ IN_ FLAG_ DONT_ UPDATE_ LAST_ WRITE - FS_
FILTER_ SECTION_ SYNC_ SUPPORTS_ ASYNC_ PARALLEL_ IO - FS_
FILTER_ SECTION_ SYNC_ SUPPORTS_ DIRECT_ MAP_ DATA - FS_
FILTER_ SECTION_ SYNC_ SUPPORTS_ DIRECT_ MAP_ IMAGE - Fast
IoIs NotPossible - Fast
IoIs Possible - Fast
IoIs Questionable - File
Access Information - File
Alignment Information - File
AllInformation - File
Allocation Information - File
Alternate Name Information - File
Attribute TagInformation - File
Basic Information - File
Both Directory Information - File
Case Sensitive Information - File
Case Sensitive Information Force Access Check - File
Completion Information - File
Compression Information - File
Desired Storage Class Information - File
Directory Information - File
Disposition Information - File
Disposition Information Ex - File
EaInformation - File
EndOf File Information - File
FsAttribute Information - File
FsControl Information - File
FsData Copy Information - File
FsDevice Information - File
FsDriver Path Information - File
FsFull Size Information - File
FsFull Size Information Ex - File
FsLabel Information - File
FsMaximum Information - File
FsMetadata Size Information - File
FsObject IdInformation - File
FsSector Size Information - File
FsSize Information - File
FsVolume Flags Information - File
FsVolume Information - File
Full Directory Information - File
Full EaInformation - File
Hard Link Full IdInformation - File
Hard Link Information - File
IdBoth Directory Information - File
IdExtd Both Directory Information - File
IdExtd Directory Information - File
IdFull Directory Information - File
IdGlobal TxDirectory Information - File
IdInformation - File
Internal Information - File
IoCompletion Notification Information - File
IoPriority Hint Information - File
IoStatus Block Range Information - File
IsRemote Device Information - File
Known Folder Information - File
Link Information - File
Link Information Bypass Access Check - File
Link Information Ex - File
Link Information ExBypass Access Check - File
Mailslot Query Information - File
Mailslot SetInformation - File
Maximum Information - File
Memory Partition Information - File
Mode Information - File
Move Cluster Information - File
Name Information - File
Names Information - File
Network Open Information - File
Network Physical Name Information - File
Normalized Name Information - File
Numa Node Information - File
Object IdInformation - File
Pipe Information - File
Pipe Local Information - File
Pipe Remote Information - File
Position Information - File
Process IdsUsing File Information - File
Quota Information - File
Remote Protocol Information - File
Rename Information - File
Rename Information Bypass Access Check - File
Rename Information Ex - File
Rename Information ExBypass Access Check - File
Reparse Point Information - File
Replace Completion Information - File
Sfio Reserve Information - File
Sfio Volume Information - File
Short Name Information - File
Standard Information - File
Standard Link Information - File
Stat Information - File
Stat LxInformation - File
Storage Reserve IdInformation - File
Stream Information - File
Tracking Information - File
Unused Information - File
Valid Data Length Information - File
Volume Name Information - GCR_
ALLOW_ LM - GCR_
ALLOW_ NO_ TARGET - GCR_
ALLOW_ NTLM - GCR_
MACHINE_ CREDENTIAL - GCR_
NTLM3_ PARMS - GCR_
TARGET_ INFO - GCR_
USE_ OEM_ SET - GCR_
USE_ OWF_ PASSWORD - GCR_
VSM_ PROTECTED_ PASSWORD - GENERATE_
CLIENT_ CHALLENGE - GUID_
ECP_ ATOMIC_ CREATE - GUID_
ECP_ CLOUDFILES_ ATTRIBUTION - GUID_
ECP_ CREATE_ REDIRECTION - GUID_
ECP_ CSV_ DOWN_ LEVEL_ OPEN - GUID_
ECP_ CSV_ QUERY_ FILE_ REVISION - GUID_
ECP_ CSV_ QUERY_ FILE_ REVISION_ FILE_ ID_ 128 - GUID_
ECP_ CSV_ SET_ HANDLE_ PROPERTIES - GUID_
ECP_ DUAL_ OPLOCK_ KEY - GUID_
ECP_ IO_ DEVICE_ HINT - GUID_
ECP_ NETWORK_ APP_ INSTANCE - GUID_
ECP_ NETWORK_ APP_ INSTANCE_ VERSION - GUID_
ECP_ NETWORK_ OPEN_ CONTEXT - GUID_
ECP_ NFS_ OPEN - GUID_
ECP_ OPEN_ PARAMETERS - GUID_
ECP_ OPLOCK_ KEY - GUID_
ECP_ PREFETCH_ OPEN - GUID_
ECP_ QUERY_ ON_ CREATE - GUID_
ECP_ RKF_ BYPASS - GUID_
ECP_ SRV_ OPEN - Greater
Than - HEAP_
CLASS_ 0 - HEAP_
CLASS_ 1 - HEAP_
CLASS_ 2 - HEAP_
CLASS_ 3 - HEAP_
CLASS_ 4 - HEAP_
CLASS_ 5 - HEAP_
CLASS_ 6 - HEAP_
CLASS_ 7 - HEAP_
CLASS_ 8 - HEAP_
CLASS_ MASK - HEAP_
CREATE_ ALIGN_ 16 - HEAP_
CREATE_ ENABLE_ EXECUTE - HEAP_
CREATE_ ENABLE_ TRACING - HEAP_
CREATE_ HARDENED - HEAP_
CREATE_ SEGMENT_ HEAP - HEAP_
DISABLE_ COALESCE_ ON_ FREE - HEAP_
FREE_ CHECKING_ ENABLED - HEAP_
GENERATE_ EXCEPTIONS - HEAP_
GLOBAL_ TAG - HEAP_
GROWABLE - HEAP_
MAXIMUM_ TAG - HEAP_
NO_ SERIALIZE - HEAP_
PSEUDO_ TAG_ FLAG - HEAP_
REALLOC_ IN_ PLACE_ ONLY - HEAP_
SETTABLE_ USER_ FLAG1 - HEAP_
SETTABLE_ USER_ FLAG2 - HEAP_
SETTABLE_ USER_ FLAG3 - HEAP_
SETTABLE_ USER_ FLAGS - HEAP_
SETTABLE_ USER_ VALUE - HEAP_
TAG_ SHIFT - HEAP_
TAIL_ CHECKING_ ENABLED - HEAP_
ZERO_ MEMORY - Heap
Memory Basic Information - INVALID_
PROCESSOR_ INDEX - IOCTL_
LMR_ ARE_ FILE_ OBJECTS_ ON_ SAME_ SERVER - IOCTL_
REDIR_ QUERY_ PATH - IOCTL_
REDIR_ QUERY_ PATH_ EX - IOCTL_
VOLSNAP_ FLUSH_ AND_ HOLD_ WRITES - IO_
CD_ ROM_ INCREMENT - IO_
CREATE_ STREAM_ FILE_ LITE - IO_
CREATE_ STREAM_ FILE_ RAISE_ ON_ ERROR - IO_
DISK_ INCREMENT - IO_
FILE_ OBJECT_ NON_ PAGED_ POOL_ CHARGE - IO_
FILE_ OBJECT_ PAGED_ POOL_ CHARGE - IO_
IGNORE_ READONLY_ ATTRIBUTE - IO_
MAILSLOT_ INCREMENT - IO_
MM_ PAGING_ FILE - IO_
NAMED_ PIPE_ INCREMENT - IO_
NETWORK_ INCREMENT - IO_
NO_ INCREMENT - IO_
OPEN_ PAGING_ FILE - IO_
OPEN_ TARGET_ DIRECTORY - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 0 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 1 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 2 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 3 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 4 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 5 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 6 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 7 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 8 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ 9 - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ A - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ B - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ C - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ D - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ E - IO_
REPARSE_ TAG_ ACRONIS_ HSM_ F - IO_
REPARSE_ TAG_ ACTIVISION_ HSM - IO_
REPARSE_ TAG_ ADA_ HSM - IO_
REPARSE_ TAG_ ADOBE_ HSM - IO_
REPARSE_ TAG_ ALERTBOOT - IO_
REPARSE_ TAG_ ALTIRIS_ HSM - IO_
REPARSE_ TAG_ APPXSTRM - IO_
REPARSE_ TAG_ ARCO_ BACKUP - IO_
REPARSE_ TAG_ ARKIVIO - IO_
REPARSE_ TAG_ AURISTOR_ FS - IO_
REPARSE_ TAG_ AUTN_ HSM - IO_
REPARSE_ TAG_ BRIDGEHEAD_ HSM - IO_
REPARSE_ TAG_ C2CSYSTEMS_ HSM - IO_
REPARSE_ TAG_ CARINGO_ HSM - IO_
REPARSE_ TAG_ CARROLL_ HSM - IO_
REPARSE_ TAG_ CITRIX_ PM - IO_
REPARSE_ TAG_ COMMVAULT - IO_
REPARSE_ TAG_ COMMVAULT_ HSM - IO_
REPARSE_ TAG_ COMTRADE_ HSM - IO_
REPARSE_ TAG_ CTERA_ HSM - IO_
REPARSE_ TAG_ DATAFIRST_ HSM - IO_
REPARSE_ TAG_ DATAGLOBAL_ HSM - IO_
REPARSE_ TAG_ DATASTOR_ SIS - IO_
REPARSE_ TAG_ DFM - IO_
REPARSE_ TAG_ DOR_ HSM - IO_
REPARSE_ TAG_ DOUBLE_ TAKE_ HSM - IO_
REPARSE_ TAG_ DOUBLE_ TAKE_ SIS - IO_
REPARSE_ TAG_ DRIVE_ EXTENDER - IO_
REPARSE_ TAG_ DROPBOX_ HSM - IO_
REPARSE_ TAG_ EASEFILTER_ HSM - IO_
REPARSE_ TAG_ EASEVAULT_ HSM - IO_
REPARSE_ TAG_ EDSI_ HSM - IO_
REPARSE_ TAG_ ELTAN_ HSM - IO_
REPARSE_ TAG_ EMC_ HSM - IO_
REPARSE_ TAG_ ENIGMA_ HSM - IO_
REPARSE_ TAG_ FILTER_ MANAGER - IO_
REPARSE_ TAG_ GLOBA L360_ HSM - IO_
REPARSE_ TAG_ GOOGLE_ HSM - IO_
REPARSE_ TAG_ GRAU_ DATASTORAGE_ HSM - IO_
REPARSE_ TAG_ HDS_ HCP_ HSM - IO_
REPARSE_ TAG_ HDS_ HSM - IO_
REPARSE_ TAG_ HERMES_ HSM - IO_
REPARSE_ TAG_ HP_ BACKUP - IO_
REPARSE_ TAG_ HP_ DATA_ PROTECT - IO_
REPARSE_ TAG_ HP_ HSM - IO_
REPARSE_ TAG_ HSAG_ HSM - IO_
REPARSE_ TAG_ HUBSTOR_ HSM - IO_
REPARSE_ TAG_ IFSTEST_ CONGRUENT - IO_
REPARSE_ TAG_ IIS_ CACHE - IO_
REPARSE_ TAG_ IMANAGE_ HSM - IO_
REPARSE_ TAG_ INTERCOPE_ HSM - IO_
REPARSE_ TAG_ ITSTATION - IO_
REPARSE_ TAG_ KOM_ NETWORKS_ HSM - IO_
REPARSE_ TAG_ LX_ BLK - IO_
REPARSE_ TAG_ LX_ CHR - IO_
REPARSE_ TAG_ LX_ FIFO - IO_
REPARSE_ TAG_ LX_ SYMLINK - IO_
REPARSE_ TAG_ MAGINATICS_ RDR - IO_
REPARSE_ TAG_ MAXISCALE_ HSM - IO_
REPARSE_ TAG_ MEMORY_ TECH_ HSM - IO_
REPARSE_ TAG_ MIMOSA_ HSM - IO_
REPARSE_ TAG_ MOONWALK_ HSM - IO_
REPARSE_ TAG_ MTALOS - IO_
REPARSE_ TAG_ NEUSHIELD - IO_
REPARSE_ TAG_ NEXSAN_ HSM - IO_
REPARSE_ TAG_ NIPPON_ HSM - IO_
REPARSE_ TAG_ NVIDIA_ UNIONFS - IO_
REPARSE_ TAG_ OPENAFS_ DFS - IO_
REPARSE_ TAG_ OSR_ SAMPLE - IO_
REPARSE_ TAG_ OVERTONE - IO_
REPARSE_ TAG_ POINTSOFT_ HSM - IO_
REPARSE_ TAG_ QI_ TECH_ HSM - IO_
REPARSE_ TAG_ QUADDRA_ HSM - IO_
REPARSE_ TAG_ QUEST_ HSM - IO_
REPARSE_ TAG_ REDSTOR_ HSM - IO_
REPARSE_ TAG_ RIVERBED_ HSM - IO_
REPARSE_ TAG_ SER_ HSM - IO_
REPARSE_ TAG_ SHX_ BACKUP - IO_
REPARSE_ TAG_ SOLUTIONSOFT - IO_
REPARSE_ TAG_ SONY_ HSM - IO_
REPARSE_ TAG_ SPHARSOFT - IO_
REPARSE_ TAG_ SYMANTEC_ HSM - IO_
REPARSE_ TAG_ SYMANTEC_ HSM2 - IO_
REPARSE_ TAG_ TSINGHUA_ UNIVERSITY_ RESEARCH - IO_
REPARSE_ TAG_ UTIXO_ HSM - IO_
REPARSE_ TAG_ VALID_ VALUES - IO_
REPARSE_ TAG_ VMWARE_ PM - IO_
REPARSE_ TAG_ WATERFORD - IO_
REPARSE_ TAG_ WISDATA_ HSM - IO_
REPARSE_ TAG_ ZLTI_ HSM - IO_
STOP_ ON_ SYMLINK - Known
Folder Desktop - Known
Folder Documents - Known
Folder Downloads - Known
Folder Max - Known
Folder Music - Known
Folder None - Known
Folder Other - Known
Folder Pictures - Known
Folder Videos - LCN_
CHECKSUM_ VALID - LCN_
WEAK_ REFERENCE_ VALID - LX_
FILE_ CASE_ SENSITIVE_ DIR - LX_
FILE_ METADATA_ DEVICE_ ID_ EA_ NAME - LX_
FILE_ METADATA_ GID_ EA_ NAME - LX_
FILE_ METADATA_ HAS_ DEVICE_ ID - LX_
FILE_ METADATA_ HAS_ GID - LX_
FILE_ METADATA_ HAS_ MODE - LX_
FILE_ METADATA_ HAS_ UID - LX_
FILE_ METADATA_ MODE_ EA_ NAME - LX_
FILE_ METADATA_ UID_ EA_ NAME - Less
Than - MAP_
DISABLE_ PAGEFAULT_ CLUSTERING - MAP_
HIGH_ PRIORITY - MAP_
NO_ READ - MAP_
WAIT - MAXIMUM_
LEADBYTES - MAX_
UNICODE_ STACK_ BUFFER_ LENGTH - MCB_
FLAG_ RAISE_ ON_ ALLOCATION_ FAILURE - MM_
FORCE_ CLOSED_ DATA - MM_
FORCE_ CLOSED_ IMAGE - MM_
FORCE_ CLOSED_ LATER_ OK - MM_
IS_ FILE_ SECTION_ ACTIVE_ DATA - MM_
IS_ FILE_ SECTION_ ACTIVE_ IMAGE - MM_
IS_ FILE_ SECTION_ ACTIVE_ USER - Memory
Basic Information - Memory
Type64K Page - Memory
Type Custom - Memory
Type Huge Page - Memory
Type Large Page - Memory
Type Max - Memory
Type NonPaged - Memory
Type Paged - MmFlush
ForDelete - MmFlush
ForWrite - MsvAv
Channel Bindings - MsvAv
DnsComputer Name - MsvAv
DnsDomain Name - MsvAv
DnsTree Name - MsvAvEOL
- MsvAv
Flags - MsvAv
NbComputer Name - MsvAv
NbDomain Name - MsvAv
Restrictions - MsvAv
Target Name - MsvAv
Timestamp - NETWORK_
OPEN_ ECP_ IN_ FLAG_ DISABLE_ HANDLE_ COLLAPSING - NETWORK_
OPEN_ ECP_ IN_ FLAG_ DISABLE_ HANDLE_ DURABILITY - NETWORK_
OPEN_ ECP_ IN_ FLAG_ DISABLE_ OPLOCKS - NETWORK_
OPEN_ ECP_ IN_ FLAG_ FORCE_ BUFFERED_ SYNCHRONOUS_ IO_ HACK - NETWORK_
OPEN_ ECP_ IN_ FLAG_ FORCE_ MAX_ EOF_ HACK - NETWORK_
OPEN_ ECP_ IN_ FLAG_ REQ_ MUTUAL_ AUTH - NETWORK_
OPEN_ ECP_ OUT_ FLAG_ RET_ MUTUAL_ AUTH - NO_
8DOT3_ NAME_ PRESENT - Network
Open Integrity Any - Network
Open Integrity Encrypted - Network
Open Integrity Maximum - Network
Open Integrity None - Network
Open Integrity Signed - Network
Open Location Any - Network
Open Location Loopback - Network
Open Location Remote - Notify
Type Create - Notify
Type Retired - Ntfs
Link Tracking Information - OPEN_
REPARSE_ POINT_ OVERRIDE_ CREATE_ OPTION - OPEN_
REPARSE_ POINT_ REPARSE_ ALWAYS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ CHILD_ EXISTS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ CHILD_ NOT_ EXISTS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ DIRECTORY_ FINAL_ COMPONENT - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ DIRECTORY_ FINAL_ COMPONENT_ ALWAYS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ FINAL_ COMPONENT - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ FINAL_ COMPONENT_ ALWAYS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ NON_ DIRECTORY_ FINAL_ COMPONENT - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ NON_ DIRECTORY_ FINAL_ COMPONENT_ ALWAYS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ NON_ DIRECTORY_ NON_ FINAL_ COMPONENT - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ NON_ DIRECTORY_ NON_ FINAL_ COMPONENT_ ALWAYS - OPEN_
REPARSE_ POINT_ REPARSE_ IF_ NON_ FINAL_ COMPONENT - OPEN_
REPARSE_ POINT_ RETURN_ REPARSE_ DATA_ BUFFER - OPEN_
REPARSE_ POINT_ TAG_ ENCOUNTERED - OPEN_
REPARSE_ POINT_ VERSION_ EX - OPLOCK_
FLAG_ BACK_ OUT_ ATOMIC_ OPLOCK - OPLOCK_
FLAG_ BREAKING_ FOR_ SHARING_ VIOLATION - OPLOCK_
FLAG_ CLOSING_ DELETE_ ON_ CLOSE - OPLOCK_
FLAG_ COMPLETE_ IF_ OPLOCKED - OPLOCK_
FLAG_ IGNORE_ OPLOCK_ KEYS - OPLOCK_
FLAG_ OPLOCK_ KEY_ CHECK_ ONLY - OPLOCK_
FLAG_ PARENT_ OBJECT - OPLOCK_
FLAG_ REMOVING_ FILE_ OR_ LINK - OPLOCK_
FSCTRL_ FLAG_ ALL_ KEYS_ MATCH - OPLOCK_
NOTIFY_ BREAK_ WAIT_ INTERIM_ TIMEOUT - OPLOCK_
NOTIFY_ BREAK_ WAIT_ TERMINATED - OPLOCK_
UPPER_ FLAG_ CHECK_ NO_ BREAK - OPLOCK_
UPPER_ FLAG_ NOTIFY_ REFRESH_ READ - PIN_
CALLER_ TRACKS_ DIRTY_ DATA - PIN_
EXCLUSIVE - PIN_
HIGH_ PRIORITY - PIN_
IF_ BCB - PIN_
NO_ READ - PIN_
VERIFY_ REQUIRED - PIN_
WAIT - POLICY_
AUDIT_ SUBCATEGORY_ COUNT - PO_
CB_ AC_ STATUS - PO_
CB_ BUTTON_ COLLISION - PO_
CB_ LID_ SWITCH_ STATE - PO_
CB_ PROCESSOR_ POWER_ POLICY - PO_
CB_ SYSTEM_ POWER_ POLICY - PO_
CB_ SYSTEM_ STATE_ LOCK - PSMP_
MAXIMUM_ SYSAPP_ CLAIM_ VALUES - PSMP_
MINIMUM_ SYSAPP_ CLAIM_ VALUES - PURGE_
WITH_ ACTIVE_ VIEWS - QUERY_
DIRECT_ ACCESS_ DATA_ EXTENTS - QUERY_
DIRECT_ ACCESS_ IMAGE_ EXTENTS - QoCFile
EaInformation - QoCFile
LxInformation - QoCFile
Stat Information - REFS_
COMPRESSION_ FORMAT_ LZ4 - REFS_
COMPRESSION_ FORMAT_ MAX - REFS_
COMPRESSION_ FORMAT_ UNCOMPRESSED - REFS_
COMPRESSION_ FORMAT_ ZSTD - REFS_
DEALLOCATE_ RANGES_ ALLOCATOR_ CAA - REFS_
DEALLOCATE_ RANGES_ ALLOCATOR_ MAA - REFS_
DEALLOCATE_ RANGES_ ALLOCATOR_ NONE - REFS_
DEALLOCATE_ RANGES_ ALLOCATOR_ SAA - REFS_
SET_ VOLUME_ COMPRESSION_ INFO_ FLAG_ COMPRESS_ SYNC - REFS_
SET_ VOLUME_ COMPRESSION_ INFO_ FLAG_ MAX - REFS_
STREAM_ EXTENT_ PROPERTY_ CRC32 - REFS_
STREAM_ EXTENT_ PROPERTY_ CRC64 - REFS_
STREAM_ EXTENT_ PROPERTY_ GHOSTED - REFS_
STREAM_ EXTENT_ PROPERTY_ READONLY - REFS_
STREAM_ EXTENT_ PROPERTY_ SPARSE - REFS_
STREAM_ EXTENT_ PROPERTY_ STREAM_ RESERVED - REFS_
STREAM_ EXTENT_ PROPERTY_ VALID - REFS_
STREAM_ SNAPSHOT_ OPERATION_ CLEAR_ SHADOW_ BTREE - REFS_
STREAM_ SNAPSHOT_ OPERATION_ CREATE - REFS_
STREAM_ SNAPSHOT_ OPERATION_ INVALID - REFS_
STREAM_ SNAPSHOT_ OPERATION_ LIST - REFS_
STREAM_ SNAPSHOT_ OPERATION_ MAX - REFS_
STREAM_ SNAPSHOT_ OPERATION_ QUERY_ DELTAS - REFS_
STREAM_ SNAPSHOT_ OPERATION_ REVERT - REFS_
STREAM_ SNAPSHOT_ OPERATION_ SET_ SHADOW_ BTREE - REMOTE_
PROTOCOL_ FLAG_ INTEGRITY - REMOTE_
PROTOCOL_ FLAG_ LOOPBACK - REMOTE_
PROTOCOL_ FLAG_ MUTUAL_ AUTH - REMOTE_
PROTOCOL_ FLAG_ OFFLINE - REMOTE_
PROTOCOL_ FLAG_ PERSISTENT_ HANDLE - REMOTE_
PROTOCOL_ FLAG_ PRIVACY - REMOVED_
8DOT3_ NAME - REPARSE_
DATA_ EX_ FLAG_ GIVEN_ TAG_ OR_ NONE - RETURN_
NON_ NT_ USER_ SESSION_ KEY - RETURN_
PRIMARY_ LOGON_ DOMAINNAME - RETURN_
PRIMARY_ USERNAME - RETURN_
RESERVED_ PARAMETER - RPI_
SMB2_ SERVERCAP_ DFS - RPI_
SMB2_ SERVERCAP_ DIRECTORY_ LEASING - RPI_
SMB2_ SERVERCAP_ ENCRYPTION_ AWARE - RPI_
SMB2_ SERVERCAP_ LARGEMTU - RPI_
SMB2_ SERVERCAP_ LEASING - RPI_
SMB2_ SERVERCAP_ MULTICHANNEL - RPI_
SMB2_ SERVERCAP_ PERSISTENT_ HANDLES - RPI_
SMB2_ SHARECAP_ ACCESS_ BASED_ DIRECTORY_ ENUM - RPI_
SMB2_ SHARECAP_ ASYMMETRIC_ SCALEOUT - RPI_
SMB2_ SHARECAP_ CLUSTER - RPI_
SMB2_ SHARECAP_ CONTINUOUS_ AVAILABILITY - RPI_
SMB2_ SHARECAP_ DFS - RPI_
SMB2_ SHARECAP_ ENCRYPTED - RPI_
SMB2_ SHARECAP_ IDENTITY_ REMOTING - RPI_
SMB2_ SHARECAP_ SCALEOUT - RPI_
SMB2_ SHARECAP_ TIMEWARP - RPI_
SMB2_ SHARETYPE_ DISK - RPI_
SMB2_ SHARETYPE_ PIPE - RPI_
SMB2_ SHARETYPE_ PRINT - RTL_
DUPLICATE_ UNICODE_ STRING_ ALLOCATE_ NULL_ STRING - RTL_
DUPLICATE_ UNICODE_ STRING_ NULL_ TERMINATE - RTL_
HEAP_ MEMORY_ LIMIT_ CURRENT_ VERSION - RTL_
SYSTEM_ VOLUME_ INFORMATION_ FOLDER - SECURITY_
ANONYMOUS_ LOGON_ RID - SEGMENT_
HEAP_ FLG_ USE_ PAGE_ HEAP - SEGMENT_
HEAP_ PARAMETERS_ VERSION - SEGMENT_
HEAP_ PARAMS_ VALID_ FLAGS - SEMAPHORE_
INCREMENT - SET_
PURGE_ FAILURE_ MODE_ DISABLED - SE_
BACKUP_ PRIVILEGES_ CHECKED - SE_
DACL_ UNTRUSTED - SE_
SERVER_ SECURITY - SPECIAL_
ENCRYPTED_ OPEN - SRV_
OPEN_ ECP_ CONTEXT_ VERSION_ 2 - SUPPORTED_
FS_ FEATURES_ BYPASS_ IO - SUPPORTED_
FS_ FEATURES_ OFFLOAD_ READ - SUPPORTED_
FS_ FEATURES_ OFFLOAD_ WRITE - SUPPORTED_
FS_ FEATURES_ QUERY_ OPEN - SYMLINK_
DIRECTORY - SYMLINK_
FILE - SYMLINK_
FLAG_ RELATIVE - SYMLINK_
RESERVED_ MASK - SYSTEM_
PAGE_ PRIORITY_ BITS - Shared
Virtual DiskCDP Snapshots Supported - Shared
Virtual Disk Handle State File Shared - Shared
Virtual Disk Handle State Handle Shared - Shared
Virtual Disk Handle State None - Shared
Virtual Disk Snapshots Supported - Shared
Virtual Disks Supported - Shared
Virtual Disks Unsupported - SrvInstance
Type Csv - SrvInstance
Type Primary - SrvInstance
TypeSBL - SrvInstance
TypeSR - SrvInstance
Type Undefined - SrvInstance
TypeVSMB - Sync
Type Create Section - Sync
Type Other - TOKEN_
AUDIT_ NO_ CHILD_ PROCESS - TOKEN_
AUDIT_ REDIRECTION_ TRUST - TOKEN_
DO_ NOT_ USE_ GLOBAL_ ATTRIBS_ FOR_ QUERY - TOKEN_
ENFORCE_ REDIRECTION_ TRUST - TOKEN_
HAS_ BACKUP_ PRIVILEGE - TOKEN_
HAS_ IMPERSONATE_ PRIVILEGE - TOKEN_
HAS_ OWN_ CLAIM_ ATTRIBUTES - TOKEN_
HAS_ RESTORE_ PRIVILEGE - TOKEN_
HAS_ TRAVERSE_ PRIVILEGE - TOKEN_
IS_ FILTERED - TOKEN_
IS_ RESTRICTED - TOKEN_
LEARNING_ MODE_ LOGGING - TOKEN_
LOWBOX - TOKEN_
NOT_ LOW - TOKEN_
NO_ CHILD_ PROCESS - TOKEN_
NO_ CHILD_ PROCESS_ UNLESS_ SECURE - TOKEN_
PERMISSIVE_ LEARNING_ MODE - TOKEN_
PRIVATE_ NAMESPACE - TOKEN_
SANDBOX_ INERT - TOKEN_
SESSION_ NOT_ REFERENCED - TOKEN_
UIACCESS - TOKEN_
VIRTUALIZE_ ALLOWED - TOKEN_
VIRTUALIZE_ ENABLED - TOKEN_
WRITE_ RESTRICTED - UNINITIALIZE_
CACHE_ MAPS - USE_
PRIMARY_ PASSWORD - USN_
DELETE_ FLAG_ DELETE - VACB_
MAPPING_ GRANULARITY - VACB_
OFFSET_ SHIFT - VALID_
INHERIT_ FLAGS - VOLSNAPCONTROLTYPE
- VmPrefetch
Information - WCIFS_
REDIRECTION_ FLAGS_ CREATE_ SERVICED_ FROM_ LAYER - WCIFS_
REDIRECTION_ FLAGS_ CREATE_ SERVICED_ FROM_ REGISTERED_ LAYER - WCIFS_
REDIRECTION_ FLAGS_ CREATE_ SERVICED_ FROM_ REMOTE_ LAYER - WCIFS_
REDIRECTION_ FLAGS_ CREATE_ SERVICED_ FROM_ SCRATCH
Functions§
- Apply
Control ⚠Token - CcAsync
Copy ⚠Read - CcCanI
Write ⚠ - CcCoherency
Flush ⚠AndPurge Cache - CcCopy
Read ⚠ - CcCopy
Read ⚠Ex - CcCopy
Write ⚠ - CcCopy
Write ⚠Ex - CcCopy
Write ⚠Wont Flush - CcDefer
Write ⚠ - CcError
Callback ⚠Routine - CcFast
Copy ⚠Read - CcFast
Copy ⚠Write - CcFlush
Cache ⚠ - CcGet
Dirty ⚠Pages - CcGet
File ⚠Object From Bcb - CcGet
File ⚠Object From Section Ptrs - CcGet
File ⚠Object From Section Ptrs Ref - CcGet
Flushed ⚠Valid Data - CcInitialize
Cache ⚠Map - CcInitialize
Cache ⚠MapEx - CcIs
Cache ⚠Manager Callback Needed - CcIs
There ⚠Dirty Data - CcIs
There ⚠Dirty Data Ex - CcMap
Data ⚠ - CcMdl
Read ⚠ - CcMdl
Read ⚠Complete - CcMdl
Write ⚠Abort - CcMdl
Write ⚠Complete - CcPin
Mapped ⚠Data - CcPin
Read ⚠ - CcPrepare
MdlWrite ⚠ - CcPrepare
PinWrite ⚠ - CcPurge
Cache ⚠Section - CcRemap
Bcb ⚠ - CcRepin
Bcb ⚠ - CcSchedule
Read ⚠Ahead - CcSchedule
Read ⚠Ahead Ex - CcSet
Additional ⚠Cache Attributes - CcSet
Additional ⚠Cache Attributes Ex - CcSet
BcbOwner ⚠Pointer - CcSet
Dirty ⚠Page Threshold - CcSet
Dirty ⚠Pinned Data - CcSet
File ⚠Sizes - CcSet
File ⚠Sizes Ex - CcSet
LogHandle ⚠ForFile - CcSet
Parallel ⚠Flush File - CcSet
Read ⚠Ahead Granularity - CcUninitialize
Cache ⚠Map - CcUnpin
Data ⚠ - CcUnpin
Data ⚠ForThread - CcUnpin
Repinned ⚠Bcb - CcWait
ForCurrent ⚠Lazy Writer Activity - CcZero
Data ⚠ - Complete
Auth ⚠Token - ExDisable
Resource ⚠Boost Lite - ExQuery
Pool ⚠Block Size - Export
Security ⚠Context - FsRtl
Acknowledge ⚠Ecp - FsRtl
Acquire ⚠File Exclusive - FsRtl
AddBase ⚠McbEntry - FsRtl
AddBase ⚠McbEntry Ex - FsRtl
AddLarge ⚠McbEntry - FsRtl
AddMcb ⚠Entry - FsRtl
AddTo ⚠Tunnel Cache - FsRtl
AddTo ⚠Tunnel Cache Ex - FsRtl
Allocate ⚠AePush Lock - FsRtl
Allocate ⚠Extra Create Parameter - FsRtl
Allocate ⚠Extra Create Parameter From Lookaside List - FsRtl
Allocate ⚠Extra Create Parameter List - FsRtl
Allocate ⚠File Lock - FsRtl
Allocate ⚠Resource - FsRtl
AreNames ⚠Equal - FsRtl
AreThere ⚠Current OrIn Progress File Locks - FsRtl
AreThere ⚠Waiting File Locks - FsRtl
AreVolume ⚠Startup Applications Complete - FsRtl
Balance ⚠Reads - FsRtl
Cancellable ⚠Wait ForMultiple Objects - FsRtl
Cancellable ⚠Wait ForSingle Object - FsRtl
Change ⚠Backing File Object - FsRtl
Check ⚠Lock ForOplock Request - FsRtl
Check ⚠Lock ForRead Access - FsRtl
Check ⚠Lock ForWrite Access - FsRtl
Check ⚠Oplock - FsRtl
Check ⚠Oplock Ex - FsRtl
Check ⚠Oplock Ex2 - FsRtl
Check ⚠Upper Oplock - FsRtl
Copy ⚠Read - FsRtl
Copy ⚠Write - FsRtl
Create ⚠Section ForData Scan - FsRtl
Current ⚠Batch Oplock - FsRtl
Current ⚠Oplock - FsRtl
Current ⚠OplockH - FsRtl
Delete ⚠Extra Create Parameter Lookaside List - FsRtl
Delete ⚠KeyFrom Tunnel Cache - FsRtl
Delete ⚠Tunnel Cache - FsRtl
Deregister ⚠UncProvider - FsRtl
Dismount ⚠Complete - FsRtl
Dissect ⚠Dbcs - FsRtl
Dissect ⚠Name - FsRtl
Does ⚠Dbcs Contain Wild Cards - FsRtl
Does ⚠Name Contain Wild Cards - FsRtl
Fast ⚠Check Lock ForRead - FsRtl
Fast ⚠Check Lock ForWrite - FsRtl
Fast ⚠Unlock All - FsRtl
Fast ⚠Unlock AllBy Key - FsRtl
Fast ⚠Unlock Single - FsRtl
Find ⚠Extra Create Parameter - FsRtl
Find ⚠InTunnel Cache - FsRtl
Find ⚠InTunnel Cache Ex - FsRtl
Free ⚠AePush Lock - FsRtl
Free ⚠Extra Create Parameter - FsRtl
Free ⚠Extra Create Parameter List - FsRtl
Free ⚠File Lock - FsRtl
GetCurrent ⚠Process Loader List - FsRtl
GetEcp ⚠List From Irp - FsRtl
GetFile ⚠Size - FsRtl
GetNext ⚠Base McbEntry - FsRtl
GetNext ⚠Extra Create Parameter - FsRtl
GetNext ⚠File Lock - FsRtl
GetNext ⚠Large McbEntry - FsRtl
GetNext ⚠McbEntry - FsRtl
GetSector ⚠Size Information - FsRtl
GetSupported ⚠Features - FsRtl
GetVirtual ⚠Disk Nesting Level - FsRtl
Increment ⚠CcFast MdlRead Wait - FsRtl
Increment ⚠CcFast Read NoWait - FsRtl
Increment ⚠CcFast Read NotPossible - FsRtl
Increment ⚠CcFast Read Resource Miss - FsRtl
Increment ⚠CcFast Read Wait - FsRtl
Init ⚠Extra Create Parameter Lookaside List - FsRtl
Initialize ⚠Base Mcb - FsRtl
Initialize ⚠Base McbEx - FsRtl
Initialize ⚠Extra Create Parameter - FsRtl
Initialize ⚠Extra Create Parameter List - FsRtl
Initialize ⚠File Lock - FsRtl
Initialize ⚠Large Mcb - FsRtl
Initialize ⚠Mcb - FsRtl
Initialize ⚠Oplock - FsRtl
Initialize ⚠Tunnel Cache - FsRtl
Insert ⚠Extra Create Parameter - FsRtl
Insert ⚠PerFile Context - FsRtl
Insert ⚠PerFile Object Context - FsRtl
Insert ⚠PerStream Context - FsRtl
Is32 ⚠BitProcess - FsRtl
IsDax ⚠Volume - FsRtl
IsDbcs ⚠InExpression - FsRtl
IsEcp ⚠Acknowledged - FsRtl
IsEcp ⚠From User Mode - FsRtl
IsExtent ⚠Dangling - FsRtl
IsFat ⚠Dbcs Legal - FsRtl
IsHpfs ⚠Dbcs Legal - FsRtl
IsMobileOS ⚠ - FsRtl
IsName ⚠InExpression - FsRtl
IsName ⚠InUn Upcased Expression - FsRtl
IsNon ⚠Empty Directory Reparse Point Allowed - FsRtl
IsNtstatus ⚠Expected - FsRtl
IsPaging ⚠File - FsRtl
IsSystem ⚠Paging File - FsRtl
Issue ⚠Device IoControl - FsRtl
Kernel ⚠FsControl File - FsRtl
LogCc ⚠Flush Error - FsRtl
Lookup ⚠Base McbEntry - FsRtl
Lookup ⚠Large McbEntry - FsRtl
Lookup ⚠Last Base McbEntry - FsRtl
Lookup ⚠Last Base McbEntry AndIndex - FsRtl
Lookup ⚠Last Large McbEntry - FsRtl
Lookup ⚠Last Large McbEntry AndIndex - FsRtl
Lookup ⚠Last McbEntry - FsRtl
Lookup ⚠McbEntry - FsRtl
Lookup ⚠PerFile Context - FsRtl
Lookup ⚠PerFile Object Context - FsRtl
Lookup ⚠PerStream Context Internal - FsRtl
MdlRead ⚠Complete Dev - FsRtl
MdlRead ⚠Dev - FsRtl
MdlRead ⚠Ex - FsRtl
MdlWrite ⚠Complete Dev - FsRtl
MupGet ⚠Provider IdFrom Name - FsRtl
MupGet ⚠Provider Info From File Object - FsRtl
Normalize ⚠Ntstatus - FsRtl
Notify ⚠Cleanup - FsRtl
Notify ⚠Cleanup All - FsRtl
Notify ⚠Filter Change Directory - FsRtl
Notify ⚠Filter Report Change - FsRtl
Notify ⚠Full Change Directory - FsRtl
Notify ⚠Full Report Change - FsRtl
Notify ⚠Initialize Sync - FsRtl
Notify ⚠Uninitialize Sync - FsRtl
Notify ⚠Volume Event - FsRtl
Notify ⚠Volume Event Ex - FsRtl
Number ⚠OfRuns InBase Mcb - FsRtl
Number ⚠OfRuns InLarge Mcb - FsRtl
Number ⚠OfRuns InMcb - FsRtl
Oplock ⚠BreakH - FsRtl
Oplock ⚠Break H2 - FsRtl
Oplock ⚠Break ToNone - FsRtl
Oplock ⚠Break ToNone Ex - FsRtl
Oplock ⚠Fsctrl - FsRtl
Oplock ⚠Fsctrl Ex - FsRtl
Oplock ⚠GetAny Break Owner Process - FsRtl
Oplock ⚠IsFast IoPossible - FsRtl
Oplock ⚠IsShared Request - FsRtl
Oplock ⚠Keys Equal - FsRtl
Post ⚠Paging File Stack Overflow - FsRtl
Post ⚠Stack Overflow - FsRtl
Prepare ⚠MdlWrite Dev - FsRtl
Prepare ⚠MdlWrite Ex - FsRtl
Prepare ⚠ToReuse Ecp - FsRtl
Private ⚠Lock - FsRtl
Process ⚠File Lock - FsRtl
Query ⚠Cached Vdl - FsRtl
Query ⚠Information File - FsRtl
Query ⚠Kernel EaFile - FsRtl
Query ⚠Maximum Virtual Disk Nesting Level - FsRtl
Register ⚠File System Filter Callbacks - FsRtl
Register ⚠UncProvider - FsRtl
Register ⚠UncProvider Ex - FsRtl
Register ⚠UncProvider Ex2 - FsRtl
Release ⚠File - FsRtl
Remove ⚠Base McbEntry - FsRtl
Remove ⚠Dots From Path - FsRtl
Remove ⚠Extra Create Parameter - FsRtl
Remove ⚠Large McbEntry - FsRtl
Remove ⚠McbEntry - FsRtl
Remove ⚠PerFile Context - FsRtl
Remove ⚠PerFile Object Context - FsRtl
Remove ⚠PerStream Context - FsRtl
Reset ⚠Base Mcb - FsRtl
Reset ⚠Large Mcb - FsRtl
SetDriver ⚠Backing - FsRtl
SetEcp ⚠List Into Irp - FsRtl
SetKernel ⚠EaFile - FsRtl
Split ⚠Base Mcb - FsRtl
Split ⚠Large Mcb - FsRtl
Teardown ⚠PerFile Contexts - FsRtl
Teardown ⚠PerStream Contexts - FsRtl
Truncate ⚠Base Mcb - FsRtl
Truncate ⚠Large Mcb - FsRtl
Truncate ⚠Mcb - FsRtl
Uninitialize ⚠Base Mcb - FsRtl
Uninitialize ⚠File Lock - FsRtl
Uninitialize ⚠Large Mcb - FsRtl
Uninitialize ⚠Mcb - FsRtl
Uninitialize ⚠Oplock - FsRtl
Update ⚠Disk Counters - FsRtl
Upper ⚠Oplock Fsctrl - FsRtl
Validate ⚠Reparse Point Buffer - FsRtl
Volume ⚠Device ToCorrelation Id - GetSecurity
User ⚠Info - IoAcquire
VpbSpin ⚠Lock - IoApply
Priority ⚠Info Thread - IoCheck
Desired ⚠Access - IoCheck
EaBuffer ⚠Validity - IoCheck
Function ⚠Access - IoCheck
Query ⚠SetFile Information - IoCheck
Query ⚠SetVolume Information - IoCheck
Quota ⚠Buffer Validity - IoClear
FsTrack ⚠Offset State - IoCreate
Stream ⚠File Object - IoCreate
Stream ⚠File Object Ex - IoCreate
Stream ⚠File Object Ex2 - IoCreate
Stream ⚠File Object Lite - IoEnumerate
Device ⚠Object List - IoEnumerate
Registered ⚠Filters List - IoFast
Query ⚠Network Attributes - IoGet
Attached ⚠Device - IoGet
Base ⚠File System Device Object - IoGet
Device ⚠Attachment Base Ref - IoGet
Device ⚠ToVerify - IoGet
Disk ⚠Device Object - IoGet
FsTrack ⚠Offset State - IoGet
Lower ⚠Device Object - IoGet
Oplock ⚠KeyContext - IoGet
Oplock ⚠KeyContext Ex - IoGet
Requestor ⚠Process - IoGet
Requestor ⚠Process Id - IoGet
Requestor ⚠Session Id - IoIrp
HasFs ⚠Track Offset Extension Type - IoIs
Operation ⚠Synchronous - IoIs
System ⚠Thread - IoIs
Valid ⚠Name Grafting Buffer - IoPage
Read ⚠ - IoQuery
File ⚠DosDevice Name - IoQuery
File ⚠Information - IoQuery
Volume ⚠Information - IoQueue
Thread ⚠Irp - IoRegister
File ⚠System - IoRegister
FsRegistration ⚠Change - IoRegister
FsRegistration ⚠Change Mount Aware - IoRelease
VpbSpin ⚠Lock - IoReplace
File ⚠Object Name - IoRequest
Device ⚠Removal ForReset - IoRetrieve
Priority ⚠Info - IoSet
Device ⚠ToVerify - IoSet
FsTrack ⚠Offset State - IoSet
Information ⚠ - IoSynchronous
Page ⚠Write - IoThread
ToProcess ⚠ - IoUnregister
File ⚠System - IoUnregister
FsRegistration ⚠Change - IoVerify
Volume ⚠ - KeAcquire
Queued ⚠Spin Lock - KeAcquire
Spin ⚠Lock Raise ToSynch - KeAttach
Process ⚠ - KeDetach
Process ⚠ - KeInitialize
Mutant ⚠ - KeInitialize
Queue ⚠ - KeInsert
Head ⚠Queue - KeInsert
Queue ⚠ - KeRead
State ⚠Mutant - KeRead
State ⚠Queue - KeRelease
Mutant ⚠ - KeRelease
Queued ⚠Spin Lock - KeRemove
Queue ⚠ - KeRemove
Queue ⚠Ex - KeRundown
Queue ⚠ - KeSet
Ideal ⚠Processor Thread - KeSet
Kernel ⚠Stack Swap Enable - KeStack
Attach ⚠Process - KeTry
ToAcquire ⚠Queued Spin Lock - KeUnstack
Detach ⚠Process - Make
Signature ⚠ - MapSecurity
Error ⚠ - MmCan
File ⚠BeTruncated - MmDoes
File ⚠Have User Writable References - MmFlush
Image ⚠Section - MmForce
Section ⚠Closed - MmForce
Section ⚠Closed Ex - MmGet
Maximum ⚠File Section Size - MmIs
File ⚠Section Active - MmIs
Recursive ⚠IoFault - MmMdl
Pages ⚠AreZero - MmPrefetch
Pages ⚠ - MmSet
Address ⚠Range Modified - NtAccess
Check ⚠AndAudit Alarm - NtAccess
Check ⚠ByType AndAudit Alarm - NtAccess
Check ⚠ByType Result List AndAudit Alarm - NtAccess
Check ⚠ByType Result List AndAudit Alarm ByHandle - NtAdjust
Groups ⚠Token - NtAdjust
Privileges ⚠Token - NtAllocate
Virtual ⚠Memory - NtAllocate
Virtual ⚠Memory Ex - NtCancel
IoFile ⚠Ex - NtClose
Object ⚠Audit Alarm - NtCreate
Directory ⚠Object - NtCreate
Event ⚠ - NtCreate
File ⚠ - NtCreate
Section ⚠ - NtCreate
Section ⚠Ex - NtDelete
File ⚠ - NtDelete
Object ⚠Audit Alarm - NtDuplicate
Object ⚠ - NtDuplicate
Token ⚠ - NtFilter
Token ⚠ - NtFlush
Buffers ⚠File - NtFlush
Buffers ⚠File Ex - NtFlush
Virtual ⚠Memory - NtFree
Virtual ⚠Memory - NtFs
Control ⚠File - NtImpersonate
Anonymous ⚠Token - NtLock
File ⚠ - NtNotify
Change ⚠Key - NtOpen
Directory ⚠Object - NtOpen
File ⚠ - NtOpen
Object ⚠Audit Alarm - NtOpen
Process ⚠Token - NtOpen
Process ⚠Token Ex - NtOpen
Symbolic ⚠Link Object - NtOpen
Thread ⚠Token - NtOpen
Thread ⚠Token Ex - NtPrivilege
Check ⚠ - NtPrivilege
Object ⚠Audit Alarm - NtPrivileged
Service ⚠Audit Alarm - NtQuery
Directory ⚠File - NtQuery
Directory ⚠File Ex - NtQuery
Directory ⚠Object - NtQuery
EaFile ⚠ - NtQuery
Full ⚠Attributes File - NtQuery
Information ⚠ByName - NtQuery
Information ⚠File - NtQuery
Information ⚠Token - NtQuery
Quota ⚠Information File - NtQuery
Security ⚠Object - NtQuery
Symbolic ⚠Link Object - NtQuery
Virtual ⚠Memory - NtQuery
Volume ⚠Information File - NtRead
File ⚠ - NtSet
EaFile ⚠ - NtSet
Event ⚠ - NtSet
Information ⚠File - NtSet
Information ⚠Token - NtSet
Information ⚠Virtual Memory - NtSet
Quota ⚠Information File - NtSet
Security ⚠Object - NtSet
Volume ⚠Information File - NtUnlock
File ⚠ - NtWrite
File ⚠ - ObInsert
Object ⚠ - ObIs
Kernel ⚠Handle - ObMake
Temporary ⚠Object - ObOpen
Object ⚠ByPointer - ObOpen
Object ⚠ByPointer With Tag - ObQuery
Name ⚠String - ObQuery
Object ⚠Auditing ByHandle - PfxFind
Prefix ⚠ - PfxInitialize⚠
- PfxInsert
Prefix ⚠ - PfxRemove
Prefix ⚠ - PoQueue
Shutdown ⚠Work Item - PsAssign
Impersonation ⚠Token - PsCharge
Pool ⚠Quota - PsCharge
Process ⚠Pool Quota - PsDereference
Impersonation ⚠Token - PsDereference
Primary ⚠Token - PsDisable
Impersonation ⚠ - PsGet
Process ⚠Exit Time - PsGet
Thread ⚠Process - PsImpersonate
Client ⚠ - PsIs
Disk ⚠Counters Enabled - PsIs
System ⚠Thread - PsIs
Thread ⚠Terminating - PsLookup
Process ⚠ByProcess Id - PsLookup
Thread ⚠ByThread Id - PsReference
Impersonation ⚠Token - PsReference
Primary ⚠Token - PsRestore
Impersonation ⚠ - PsReturn
Pool ⚠Quota - PsRevert
ToSelf ⚠ - PsUpdate
Disk ⚠Counters - Query
Security ⚠Context Token - RtlAbsolute
ToSelf ⚠RelativeSD - RtlAdd
Access ⚠Allowed Ace - RtlAdd
Access ⚠Allowed AceEx - RtlAdd
Ace ⚠ - RtlAllocate
AndInitialize ⚠Sid - RtlAllocate
AndInitialize ⚠SidEx - RtlAllocate
Heap ⚠ - RtlAppend
String ⚠ToString - RtlCompare
Altitudes ⚠ - RtlCompare
Memory ⚠Ulong - RtlCompress
Buffer ⚠ - RtlCompress
Chunks ⚠ - RtlCopy
Luid ⚠ - RtlCopy
Sid ⚠ - RtlCreate
Acl ⚠ - RtlCreate
Heap ⚠ - RtlCreate
Service ⚠Sid - RtlCreate
System ⚠Volume Information Folder - RtlCreate
Unicode ⚠String - RtlCreate
Virtual ⚠Account Sid - RtlCustomCP
ToUnicodeN ⚠ - RtlDecompress
Buffer ⚠ - RtlDecompress
Buffer ⚠Ex - RtlDecompress
Buffer ⚠Ex2 - RtlDecompress
Chunks ⚠ - RtlDecompress
Fragment ⚠ - RtlDecompress
Fragment ⚠Ex - RtlDelete
Ace ⚠ - RtlDescribe
Chunk ⚠ - RtlDestroy
Heap ⚠ - RtlDowncase
Unicode ⚠String - RtlDuplicate
Unicode ⚠String - RtlEqual
Prefix ⚠Sid - RtlEqual
Sid ⚠ - RtlFind
Unicode ⚠Prefix - RtlFree
Heap ⚠ - RtlFree
Sid ⚠ - RtlGenerate8dot3
Name ⚠ - RtlGet
Ace ⚠ - RtlGet
Compression ⚠Work Space Size - RtlGet
Dacl ⚠Security Descriptor - RtlGet
Group ⚠Security Descriptor - RtlGet
Owner ⚠Security Descriptor - RtlGet
Sacl ⚠Security Descriptor - RtlIdentifier
Authority ⚠Sid - RtlIdn
ToAscii ⚠ - RtlIdn
ToNameprep ⚠Unicode - RtlIdn
ToUnicode ⚠ - RtlInit
Code ⚠Page Table - RtlInit
Unicode ⚠String Ex - RtlInitialize
Sid ⚠ - RtlInitialize
SidEx ⚠ - RtlInitialize
Unicode ⚠Prefix - RtlInsert
Unicode ⚠Prefix - RtlIs
Cloud ⚠Files Placeholder - RtlIs
NonEmpty ⚠Directory Reparse Point Allowed - RtlIs
Normalized ⚠String - RtlIs
Partial ⚠Placeholder - RtlIs
Partial ⚠Placeholder File Handle - RtlIs
Partial ⚠Placeholder File Info - RtlIs
Sandboxed ⚠Token - RtlIs
Valid ⚠OemCharacter - RtlLength
Required ⚠Sid - RtlLength
Sid ⚠ - RtlMulti
Byte ⚠ToUnicodeN - RtlMulti
Byte ⚠ToUnicode Size - RtlNext
Unicode ⚠Prefix - RtlNormalize
String ⚠ - RtlNt
Status ⚠ToDos Error NoTeb - RtlOem
String ⚠ToCounted Unicode String - RtlOem
String ⚠ToUnicode String - RtlOem
ToUnicodeN ⚠ - RtlPrefix
String ⚠ - RtlQuery
Package ⚠Identity - RtlQuery
Package ⚠Identity Ex - RtlQuery
Process ⚠Placeholder Compatibility Mode - RtlQuery
Thread ⚠Placeholder Compatibility Mode - RtlRandom⚠
- RtlRandom
Ex ⚠ - RtlRemove
Unicode ⚠Prefix - RtlReplace
SidIn ⚠Sd - RtlReserve
Chunk ⚠ - RtlSeconds
Since1970 ⚠ToTime - RtlSeconds
Since1980 ⚠ToTime - RtlSelf
Relative ⚠ToAbsoluteSD - RtlSet
Group ⚠Security Descriptor - RtlSet
Owner ⚠Security Descriptor - RtlSet
Process ⚠Placeholder Compatibility Mode - RtlSet
Thread ⚠Placeholder Compatibility Mode - RtlSub
Authority ⚠Count Sid - RtlSub
Authority ⚠Sid - RtlTime
ToSeconds ⚠Since1980 - RtlUnicode
String ⚠ToCounted OemString - RtlUnicode
ToCustomCPN ⚠ - RtlUnicode
ToMulti ⚠ByteN - RtlUnicode
ToOemN ⚠ - RtlUpcase
Unicode ⚠String ToCounted OemString - RtlUpcase
Unicode ⚠String ToOem String - RtlUpcase
Unicode ⚠ToCustomCPN - RtlUpcase
Unicode ⚠ToMulti ByteN - RtlUpcase
Unicode ⚠ToOemN - RtlValid
Sid ⚠ - RtlValidate
Unicode ⚠String - Rtlx
OemString ⚠ToUnicode Size - Rtlx
Unicode ⚠String ToOem Size - SeAccess
Check ⚠From State - SeAccess
Check ⚠From State Ex - SeAdjust
Access ⚠State ForAccess Constraints - SeAdjust
Access ⚠State ForTrust Label - SeAdjust
Object ⚠Security - SeAppend
Privileges ⚠ - SeAudit
Fips ⚠Crypto Selftests - SeAudit
Hard ⚠Link Creation - SeAudit
Hard ⚠Link Creation With Transaction - SeAudit
Transaction ⚠State Change - SeAuditing
AnyFile ⚠Events With Context - SeAuditing
AnyFile ⚠Events With Context Ex - SeAuditing
File ⚠Events - SeAuditing
File ⚠Events With Context - SeAuditing
File ⚠Events With Context Ex - SeAuditing
File ⚠OrGlobal Events - SeAuditing
Hard ⚠Link Events - SeAuditing
Hard ⚠Link Events With Context - SeCapture
Subject ⚠Context Ex - SeCheck
ForCritical ⚠AceRemoval - SeCreate
Client ⚠Security - SeCreate
Client ⚠Security From Subject Context - SeDelete
Client ⚠Security - SeDelete
Object ⚠Audit Alarm - SeDelete
Object ⚠Audit Alarm With Transaction - SeExamine
Sacl ⚠ - SeFilter
Token ⚠ - SeFree
Privileges ⚠ - SeImpersonate
Client ⚠ - SeImpersonate
Client ⚠Ex - SeLocate
Process ⚠Image Name - SeMark
Logon ⚠Session ForTermination Notification - SeMark
Logon ⚠Session ForTermination Notification Ex - SeOpen
Object ⚠Audit Alarm - SeOpen
Object ⚠Audit Alarm With Transaction - SeOpen
Object ⚠ForDelete Audit Alarm - SeOpen
Object ⚠ForDelete Audit Alarm With Transaction - SePrivilege
Check ⚠ - SeQuery
Authentication ⚠IdToken - SeQuery
Information ⚠Token - SeQuery
Security ⚠Descriptor Info - SeQuery
Server ⚠Silo Token - SeQuery
Session ⚠IdToken - SeQuery
Session ⚠IdToken Ex - SeRegister
Logon ⚠Session Terminated Routine - SeRegister
Logon ⚠Session Terminated Routine Ex - SeReport
Security ⚠Event With SubCategory - SeSet
Access ⚠State Generic Mapping - SeSet
Security ⚠Descriptor Info - SeSet
Security ⚠Descriptor Info Ex - SeShould
Check ⚠ForAccess Rights From Parent - SeToken
From ⚠Access Information - SeToken
IsAdmin ⚠ - SeToken
IsRestricted ⚠ - SeToken
IsWrite ⚠Restricted - SeToken
Type ⚠ - SeUnregister
Logon ⚠Session Terminated Routine - SeUnregister
Logon ⚠Session Terminated Routine Ex - SecLookup
Account ⚠Name - SecLookup
Account ⚠Sid - SecLookup
Well ⚠Known Sid - SecMakeSPN⚠
- SecMakeSPN
Ex ⚠ - SecMakeSPN
Ex2 ⚠ - SetContext
AttributesW ⚠ - Sspi
Accept ⚠Security Context Async - Sspi
Acquire ⚠Credentials Handle AsyncA - Sspi
Acquire ⚠Credentials Handle AsyncW - Sspi
Create ⚠Async Context - Sspi
Delete ⚠Security Context Async - Sspi
Free ⚠Async Context - Sspi
Free ⚠Credentials Handle Async - Sspi
GetAsync ⚠Call Status - Sspi
Initialize ⚠Security Context AsyncA - Sspi
Initialize ⚠Security Context AsyncW - Sspi
Reinit ⚠Async Context - Sspi
SetAsync ⚠Notify Callback - Verify
Signature ⚠ - ZwAccess
Check ⚠AndAudit Alarm - ZwAccess
Check ⚠ByType AndAudit Alarm - ZwAccess
Check ⚠ByType Result List AndAudit Alarm - ZwAccess
Check ⚠ByType Result List AndAudit Alarm ByHandle - ZwAdjust
Groups ⚠Token - ZwAdjust
Privileges ⚠Token - ZwAllocate
Virtual ⚠Memory - ZwAllocate
Virtual ⚠Memory Ex - ZwCancel
IoFile ⚠Ex - ZwClose
Object ⚠Audit Alarm - ZwCreate
Directory ⚠Object - ZwCreate
Event ⚠ - ZwCreate
Section ⚠Ex - ZwDelete
File ⚠ - ZwDelete
Object ⚠Audit Alarm - ZwDuplicate
Object ⚠ - ZwDuplicate
Token ⚠ - ZwFilter
Token ⚠ - ZwFlush
Buffers ⚠File - ZwFlush
Buffers ⚠File Ex - ZwFlush
Virtual ⚠Memory - ZwFree
Virtual ⚠Memory - ZwFs
Control ⚠File - ZwImpersonate
Anonymous ⚠Token - ZwLock
File ⚠ - ZwNotify
Change ⚠Key - ZwOpen
Directory ⚠Object - ZwOpen
Object ⚠Audit Alarm - ZwOpen
Process ⚠Token - ZwOpen
Process ⚠Token Ex - ZwOpen
Thread ⚠Token - ZwOpen
Thread ⚠Token Ex - ZwPrivilege
Check ⚠ - ZwPrivilege
Object ⚠Audit Alarm - ZwPrivileged
Service ⚠Audit Alarm - ZwQuery
Directory ⚠File - ZwQuery
Directory ⚠File Ex - ZwQuery
Directory ⚠Object - ZwQuery
EaFile ⚠ - ZwQuery
Full ⚠Attributes File - ZwQuery
Information ⚠Token - ZwQuery
Object ⚠ - ZwQuery
Quota ⚠Information File - ZwQuery
Security ⚠Object - ZwQuery
Virtual ⚠Memory - ZwQuery
Volume ⚠Information File - ZwSet
EaFile ⚠ - ZwSet
Event ⚠ - ZwSet
Information ⚠Token - ZwSet
Information ⚠Virtual Memory - ZwSet
Quota ⚠Information File - ZwSet
Security ⚠Object - ZwSet
Volume ⚠Information File - ZwUnlock
File ⚠
Type Aliases§
- ALLOCATE_
VIRTUAL_ MEMORY_ EX_ CALLBACK - CSV_
DOWN_ LEVEL_ FILE_ TYPE - FAST_
IO_ POSSIBLE - FILE_
DISPOSITION_ INFORMATION_ EX_ FLAGS - FILE_
INFORMATION_ CLASS - FILE_
KNOWN_ FOLDER_ TYPE - FREE_
VIRTUAL_ MEMORY_ EX_ CALLBACK - FSRTL_
CHANGE_ BACKING_ TYPE - FSRTL_
COMPARISON_ RESULT - FS_
FILTER_ SECTION_ SYNC_ TYPE - FS_
FILTER_ STREAM_ FO_ NOTIFICATION_ TYPE - FS_
INFORMATION_ CLASS - HEAP_
MEMORY_ INFO_ CLASS - LINK_
TRACKING_ INFORMATION_ TYPE - MEMORY_
INFORMATION_ CLASS - MMFLUSH_
TYPE - MSV1_
0_ AVID - NETWORK_
OPEN_ INTEGRITY_ QUALIFIER - NETWORK_
OPEN_ LOCATION_ QUALIFIER - NTCREATEFILE_
CREATE_ DISPOSITION - NTCREATEFILE_
CREATE_ OPTIONS - OPLOCK_
NOTIFY_ REASON - PACQUIRE_
FOR_ LAZY_ WRITE - PACQUIRE_
FOR_ LAZY_ WRITE_ EX - PACQUIRE_
FOR_ READ_ AHEAD - PALLOCATE_
VIRTUAL_ MEMORY_ EX_ CALLBACK - PASYNC_
READ_ COMPLETION_ CALLBACK - PCC_
POST_ DEFERRED_ WRITE - PCHECK_
FOR_ TRAVERSE_ ACCESS - PCOMPLETE_
LOCK_ IRP_ ROUTINE - PDIRTY_
PAGE_ ROUTINE - PFILTER_
REPORT_ CHANGE - PFLUSH_
TO_ LSN - PFN_
FSRTLTEARDOWNPERSTREAMCONTEXTS - PFREE_
VIRTUAL_ MEMORY_ EX_ CALLBACK - PFSRTL_
EXTRA_ CREATE_ PARAMETER_ CLEANUP_ CALLBACK - PFSRTL_
STACK_ OVERFLOW_ ROUTINE - PFS_
FILTER_ CALLBACK - PFS_
FILTER_ COMPLETION_ CALLBACK - POPLOCK_
FS_ PREPOST_ IRP - POPLOCK_
NOTIFY_ ROUTINE - POPLOCK_
WAIT_ COMPLETE_ ROUTINE - PQUERY_
LOG_ USAGE - PQUERY_
VIRTUAL_ MEMORY_ CALLBACK - PRELEASE_
FROM_ LAZY_ WRITE - PRELEASE_
FROM_ READ_ AHEAD - PRTL_
ALLOCATE_ STRING_ ROUTINE - PRTL_
FREE_ STRING_ ROUTINE - PRTL_
HEAP_ COMMIT_ ROUTINE - PRTL_
REALLOCATE_ STRING_ ROUTINE - PSE_
LOGON_ SESSION_ TERMINATED_ ROUTINE - PSE_
LOGON_ SESSION_ TERMINATED_ ROUTINE_ EX - PUNLOCK_
ROUTINE - QUERY_
VIRTUAL_ MEMORY_ CALLBACK - REFS_
COMPRESSION_ FORMATS - REFS_
DEALLOCATE_ RANGES_ ALLOCATOR - REFS_
SET_ VOLUME_ COMPRESSION_ INFO_ FLAGS - REFS_
STREAM_ SNAPSHOT_ OPERATION - RTL_
ALLOCATE_ STRING_ ROUTINE - RTL_
FREE_ STRING_ ROUTINE - RTL_
HEAP_ COMMIT_ ROUTINE - RTL_
MEMORY_ TYPE - RTL_
REALLOCATE_ STRING_ ROUTINE - SE_
AUDIT_ OPERATION - SE_
LOGON_ SESSION_ TERMINATED_ ROUTINE - SE_
LOGON_ SESSION_ TERMINATED_ ROUTINE_ EX - SRV_
INSTANCE_ TYPE - Shared
Virtual Disk Handle State - Shared
Virtual Disk Support Type - Sspi
Async Notify Callback - VIRTUAL_
MEMORY_ INFORMATION_ CLASS - _LCN_
WEAK_ REFERENCE_ STATE - _REFS_
STREAM_ EXTENT_ PROPERTIES
Unions§
- FILE_
LINK_ INFORMATION_ 0 - FILE_
OBJECTID_ INFORMATION_ 0 - FILE_
REMOTE_ PROTOCOL_ INFORMATION_ 1 - FILE_
RENAME_ INFORMATION_ 0 - FSRTL_
ADVANCED_ FCB_ HEADER_ 0 - FSRTL_
UNC_ PROVIDER_ REGISTRATION_ 0 - FSRTL_
UNC_ PROVIDER_ REGISTRATION_ 1 - FS_
FILTER_ PARAMETERS - KAPC_
STATE_ 0 - KAPC_
STATE_ 1 - MM_
PREFETCH_ FLAGS - REPARSE_
DATA_ BUFFER_ 0 - REPARSE_
DATA_ BUFFER_ EX_ 0 - RTL_
SEGMENT_ HEAP_ MEMORY_ SOURCE_ 0