mirror of https://github.com/tongzx/nt5src
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
571 lines
12 KiB
571 lines
12 KiB
KiIdleLoop
|
|
MmZeroPageThread
|
|
KiSwapThread
|
|
ExReleaseResourceLite
|
|
ExAcquireResourceExclusiveLite
|
|
ExInterlockedPopEntrySList
|
|
ExAllocatePoolWithTag
|
|
IopParseDevice
|
|
KeWaitForSingleObject
|
|
ExFreePoolWithTag
|
|
IofCompleteRequest
|
|
KiDispatchInterrupt
|
|
CcMapData
|
|
Exfi386InterlockedDecrementLong
|
|
ExInterlockedPushEntrySList
|
|
KefAcquireSpinLockAtDpcLevel
|
|
InterlockedDecrement
|
|
IoAllocateIrp
|
|
memmove
|
|
ExfInterlockedAddUlong
|
|
CcGetVirtualAddress
|
|
CcFastCopyRead
|
|
RtlFindClearBits
|
|
ExfInterlockedPushEntryList
|
|
ExAcquireResourceSharedLite
|
|
RtlSplay
|
|
CcPinFileData
|
|
KeRemoveQueue
|
|
MmCopyToCachedPage
|
|
ObpCaptureObjectCreateInformation
|
|
CcFindBcb
|
|
IopAllocateIrp
|
|
RtlCompareMemory
|
|
CcFastCopyWrite
|
|
KeSynchronizeExecution
|
|
FsRtlDissectName
|
|
ObReferenceObjectByHandle
|
|
FsRtlIsNameInExpressionPrivate
|
|
MiZeroPhysicalPage
|
|
InterlockedIncrement
|
|
PsImpersonateClient
|
|
RtlCompareUnicodeString
|
|
RtlUpcaseUnicodeToOemN
|
|
IoGetRelatedDeviceObject
|
|
ObOpenObjectByName
|
|
MiFlushSectionInternal
|
|
ExpFindCurrentThread
|
|
IoFreeIrp
|
|
RtlTimeToTimeFields
|
|
CcSetDirtyPinnedData
|
|
FsRtlLookupLargeMcbEntry
|
|
ObfDereferenceObject
|
|
CcCanIWrite
|
|
CcFreeVirtualAddress
|
|
IopDeleteFile
|
|
SeCreateAccessState
|
|
KefReleaseSpinLockFromDpcLevel
|
|
CcMapAndCopy
|
|
ExInterlockedCompareExchange64
|
|
RtlCopyUnicodeString
|
|
ExAcquireHandleTableShared
|
|
KeInsertQueueDpc
|
|
MmProbeAndLockPages
|
|
ObpLookupObjectName
|
|
CcMapAndRead
|
|
IopCompleteRequest
|
|
MiRemovePageByColor
|
|
KeFlushSingleTb
|
|
IoCreateFile
|
|
CcUnpinFileData
|
|
ObpCaptureObjectName
|
|
KeInsertQueue
|
|
MmCheckCachedPageState
|
|
CcInitializeCacheMap
|
|
ExInterlockedAddLargeStatistic
|
|
RtlEqualUnicodeString
|
|
ObpAllocateObject
|
|
FsRtlIsFatDbcsLegal
|
|
CcFlushCache
|
|
ExAcquireFastMutexUnsafe
|
|
RtlFillMemoryUlong
|
|
IopCheckDeviceAndDriver
|
|
MmSetAddressRangeModified
|
|
CcPinMappedData
|
|
KeLeaveCriticalRegion
|
|
CcUninitializeCacheMap
|
|
MiCleanSection
|
|
MmUnmapViewInSystemCache
|
|
CcPrepareMdlWrite
|
|
PsReferenceImpersonationToken
|
|
MiInsertPageInList
|
|
CcWriteBehind
|
|
ExAllocatePool
|
|
FsRtlFindLargeIndex
|
|
IoFastQueryNetworkAttributes
|
|
CcSetDirtyInMask
|
|
KeSetEventBoostPriority
|
|
IofCallDriver
|
|
RtlpCaptureContext
|
|
ObpAllocateObjectNameBuffer
|
|
CcLazyWriteScan
|
|
MiLocateAndReserveWsle
|
|
RtlIsNameLegalDOS8Dot3
|
|
ExCreateHandle
|
|
ExFreePool
|
|
ElapsedDaysToYears
|
|
ObpIncrementHandleCount
|
|
FsRtlAddToTunnelCache
|
|
IoFreeController
|
|
CcAcquireByteRangeForWrite
|
|
FsRtlCheckOplock
|
|
CcPreparePinWrite
|
|
IoAllocateMdl
|
|
KiSetCR0Bits
|
|
ObReferenceObjectByPointer
|
|
CcMdlRead
|
|
ExQueueWorkItem
|
|
IopCloseFile
|
|
FsRtlFindInTunnelCache
|
|
ObCreateObject
|
|
PsReferencePrimaryToken
|
|
CcAllocateInitializeBcb
|
|
ExTryToAcquireResourceExclusiveLite
|
|
ExReleaseHandleTableShared
|
|
RtlExtendedMagicDivide
|
|
CcPinRead
|
|
Exfi386InterlockedExchangeUlong
|
|
CcCopyRead
|
|
NtSetInformationFile
|
|
ObpFreeObjectNameBuffer
|
|
ExInterlockedExchangeAddLargeInteger
|
|
NtClose
|
|
KeEnterCriticalRegion
|
|
MiDecrementShareCount2
|
|
ExReleaseHandleTableExclusive
|
|
ObpCreateHandle
|
|
KiDeliverApc
|
|
IopCompletePageWrite
|
|
RtlUpcaseUnicodeChar
|
|
KeQuerySystemTime
|
|
CcGetFileObjectFromBcb
|
|
RtlNtStatusToDosErrorNoTeb
|
|
ExIsResourceAcquiredExclusiveLite
|
|
IopParseFile
|
|
MiWaitForInPageComplete
|
|
_NLG_Return2
|
|
CcGetVirtualAddressIfMapped
|
|
MiCheckProtoPtePageState
|
|
MmCreateSection
|
|
MiLocateWsle
|
|
MmUnlockPages
|
|
KiInterruptDispatch
|
|
RtlUnicodeToOemN
|
|
IoGetRequestorProcess
|
|
MiReserveSystemPtes
|
|
IoBuildSynchronousFsdRequest
|
|
MiReleaseSystemPtes
|
|
ObpDecrementHandleCount
|
|
ObpFreeObject
|
|
CcSetFileSizes
|
|
FsRtlDoesNameContainWildCards
|
|
FsRtlOplockFsctrl
|
|
IoSetThreadHardErrorMode
|
|
MiDecrementReferenceCount
|
|
CcUnpinData
|
|
ExAcquireSharedStarveExclusive
|
|
CcWorkerThread
|
|
IoFreeMdl
|
|
ExAllocateFromPagedLookasideList
|
|
MiAllocatePoolPages
|
|
MmMapViewInSystemCache
|
|
RtlMapGenericMask
|
|
ExInitializeResourceLite
|
|
FsRtlOplockCleanup
|
|
MiFreePoolPages
|
|
ExAcquireHandleTableExclusive
|
|
PsAssignImpersonationToken
|
|
MmAccessFault
|
|
SeDeleteAccessState
|
|
IoCheckFunctionAccess
|
|
MmPurgeSection
|
|
RtlInsertElementGenericTable
|
|
ExpAcquireResourceExclusiveLite
|
|
ExGetSharedWaiterCount
|
|
IopCheckBackupRestorePrivilege
|
|
MiUpdateWsle
|
|
MmMapLockedPages
|
|
ExpWaitForResource
|
|
FsRtlOplockBreakToII
|
|
MiCreateDataFileMap
|
|
MmFlushSection
|
|
SeAssignSecurity
|
|
IoAllocateErrorLogEntry
|
|
KeReadStateQueue
|
|
IoBuildPartialMdl
|
|
_abnormal_termination
|
|
CcMdlWriteComplete2
|
|
ExDestroyHandle
|
|
FsRtlRemoveMcbEntryPrivate
|
|
KeFlushMultipleTb
|
|
KeSetEvent
|
|
KiRetireDpcList
|
|
KiTrap0E
|
|
ObpRemoveObjectRoutine
|
|
FsRtlGetNextLargeMcbEntry
|
|
IopErrorLogRequeueEntry
|
|
SeCaptureSubjectContext
|
|
IoCancelIrp
|
|
IopDereferenceVpbAndFree
|
|
FsRtlFastCheckLockForRead
|
|
FsRtlRequestExclusiveOplock
|
|
ExFreeToPagedLookasideList
|
|
IoIsOperationSynchronous
|
|
MiRemoveMappedPtes
|
|
RtlUpcaseUnicodeString
|
|
SepFilterPrivilegeAudits
|
|
DebugService
|
|
KeSetTimer
|
|
RtlCompressChunks
|
|
RtlpDidUnicodeToOemWork
|
|
RtlUpcaseUnicodeStringToOemString
|
|
SeSetAccessStateGenericMapping
|
|
SeTokenType
|
|
CcFreeActiveVacb
|
|
ExfInterlockedInsertTailList
|
|
ExMapHandleToPointer
|
|
KeGetCurrentPrcb
|
|
MiUnlinkPageFromList
|
|
RtlOemStringToUnicodeString
|
|
ExReleaseFastMutexUnsafe
|
|
FsRtlTruncateLargeMcb
|
|
KeWaitForMultipleObjects
|
|
RtlUnicodeStringToOemString
|
|
CcDeleteSharedCacheMap
|
|
CcGetVacbMiss
|
|
IopReportResourceUsage
|
|
KiAcquireSpinLock
|
|
RtlAreAnyAccessesGranted
|
|
SeUnlockSubjectContext
|
|
CcGetDirtyPages
|
|
IoSetShareAccess
|
|
MiRemoveAnyPage
|
|
ExSystemTimeToLocalTime
|
|
FsRtlAreNamesEqual
|
|
ObGetObjectPointerCount
|
|
ObpIncrementUnnamedHandleCount
|
|
ObWaitForSingleObject
|
|
RtlOemToUnicodeN
|
|
RtlUpcaseUnicodeStringToCountedOemString
|
|
CcUnpinRepinnedBcb
|
|
FsRtlIsNameInExpression
|
|
KiTimerListExpire
|
|
ObSetSecurityDescriptorInfo
|
|
FsRtlFastCheckLockForWrite
|
|
KeResetEvent
|
|
MiSetDirtyBit
|
|
PsChargeSharedPoolQuota
|
|
PsOpenTokenOfProcess
|
|
RtlTimeToSecondsSince1970
|
|
ExDeleteResourceLite
|
|
FsRtlRemoveLargeMcbEntry
|
|
IoSynchronousPageWrite
|
|
MiDispatchFault
|
|
MmIsAddressValid
|
|
IopIsDeviceInstanceEnabled
|
|
KeInitializeDpc
|
|
PsReturnSharedPoolQuota
|
|
RtlExtendedLargeIntegerDivide
|
|
RtlpGetStackLimits
|
|
SeComputeQuotaInformationSize
|
|
SeValidSecurityDescriptor
|
|
ExpWorkerThread
|
|
FsRtlAddLargeMcbEntry
|
|
ObpDeleteNameCheck
|
|
ExDisableResourceBoostLite
|
|
FsRtlPruneTunnelCache
|
|
FsRtlRemoveAndCompleteWaitIrp
|
|
MiGetInPageSupportBlock
|
|
MiRemoveZeroPage
|
|
PspDeleteThreadSecurity
|
|
RtlpGenerateInheritedAce
|
|
VdmpDelayIntApcRoutine
|
|
CcPerformReadAhead
|
|
CcPostWorkQueue
|
|
ExReinitializeResourceLite
|
|
FsRtlUninitializeOplock
|
|
IoSetTopLevelIrp
|
|
MiCheckControlArea
|
|
MmUnmapLockedPages
|
|
SepGetDefaultsSubjectContext
|
|
ExNotifyCallback
|
|
FsRtlOplockIsFastIoPossible
|
|
FsRtlPrivateFastUnlockAll
|
|
FsRtlWaitOnIrp
|
|
IoGetTopLevelIrp
|
|
IoInitializeIrp
|
|
IoPageRead
|
|
IoStartPacket
|
|
MiGetEventCounter
|
|
MiInitializePfn
|
|
ObpChargeQuotaForObject
|
|
RtlDelete
|
|
SeAuditingFileEvents
|
|
SeFastTraverseCheck
|
|
FsRtlAcknowledgeOplockBreak
|
|
FsRtlPrivateLimitFreeLockList
|
|
IoCheckShareAccess
|
|
IoCreateStreamFileObject
|
|
MiReleaseWsle
|
|
MiRemoveWsle
|
|
MiResolveMappedFileFault
|
|
ObDereferenceObject
|
|
SeTokenImpersonationLevel
|
|
CcReleaseByteRangeFromWrite
|
|
FsRtlAcquireFileForCcFlush
|
|
FsRtlCurrentBatchOplock
|
|
FsRtlInitializeLargeMcb
|
|
FsRtlPrivateLock
|
|
IoBuildDeviceIoControlRequest
|
|
KeInsertByKeyDeviceQueue
|
|
MiEnsureAvailablePageOrWait
|
|
MiInsertFrontModifiedNoWrite
|
|
PsWatchWorkingSet
|
|
RawCheckForDismount
|
|
RtlDeleteElementGenericTable
|
|
RtlSetBits
|
|
SeReleaseSubjectContext
|
|
CcCopyWrite
|
|
FsRtlFindFirstOverlappingExclusiveNode
|
|
IoStartNextPacket
|
|
KeInitializeSpinLock
|
|
KeSetTimerEx
|
|
NtQueryVolumeInformationFile
|
|
ObpLookupDirectoryEntry
|
|
RtlxOemStringToUnicodeSize
|
|
_allmul
|
|
CcScheduleReadAhead
|
|
CcUnmapVacbArray
|
|
FsRtlUninitializeLargeMcb
|
|
IoCheckDesiredAccess
|
|
KeInitializeEventPair
|
|
MiMakeSystemAddressValidPfnWs
|
|
MiRemoveUnusedSegments
|
|
MiSegmentDelete
|
|
RtlNumberOfSetBits
|
|
RtlpLengthInheritedAce
|
|
RtlUnicodeStringToCountedOemString
|
|
_wcsicmp
|
|
ExEnumHandleTable
|
|
FsRtlLookupLastLargeMcbEntry
|
|
IoRemoveShareAccess
|
|
KeReleaseSemaphore
|
|
MiInitializeReadInProgressPfn
|
|
MiRemovePageFromList
|
|
MiResolveProtoPteFault
|
|
ObpIncrementHandleDataBase
|
|
SwapSplayLinks
|
|
CcDeallocateBcb
|
|
FsRtlPrivateResetLowestLockOffset
|
|
IopCheckVpbMounted
|
|
KeInsertDeviceQueue
|
|
KeRemoveDeviceQueue
|
|
MiAddValidPageToWorkingSet
|
|
MiCheckForControlAreaDeletion
|
|
MiCompleteProtoPteFault
|
|
MiRestoreTransitionPte
|
|
NtWaitForSingleObject
|
|
xHalGetConventionalCylinders
|
|
CcSetValidData
|
|
ExAcquireSharedWaitForExclusive
|
|
ExIsResourceAcquiredSharedLite
|
|
FsRtlAllocateOplock
|
|
FsRtlCheckNoExclusiveConflict
|
|
FsRtlDeregisterUncProvider
|
|
IopQueryName
|
|
IoRegisterShutdownNotification
|
|
LpcpClosePort
|
|
MiCheckControlAreaStatus
|
|
RtlAreBitsClear
|
|
RtlCreateSecurityDescriptor
|
|
SepAccessCheck
|
|
SepInheritAcl
|
|
DaysAndFractionToTime
|
|
FsRtlFastUnlockSingle
|
|
FsRtlFastUnlockSingleExclusive
|
|
FsRtlReleaseFileForCcFlush
|
|
IoCancelThreadIo
|
|
KeInsertHeadQueue
|
|
KeRemoveByKeyDeviceQueue
|
|
KeTryToAcquireSpinLock
|
|
KiReleaseSpinLock
|
|
RtlpLengthInheritAcl
|
|
SeLockSubjectContext
|
|
SepSidInToken
|
|
CcMdlReadComplete
|
|
CcMdlReadComplete2
|
|
FsRtlCheckLockForReadAccess
|
|
FsRtlPrivateInsertLock
|
|
IoAcquireCancelSpinLock
|
|
IopOpenLinkOrRenameTarget
|
|
KeFlushQueueApc
|
|
KeInitializeApc
|
|
MiInitializeCopyOnWritePfn
|
|
MiMakeProtectionMask
|
|
MiMakeSystemAddressValidPfn
|
|
MiResolveDemandZeroFault
|
|
MiSectionDelete
|
|
MmCreateMdl
|
|
ObpCreateUnnamedHandle
|
|
ObReferenceObjectByName
|
|
RtlSubtreePredecessor
|
|
SepCheckAcl
|
|
CcGetLsnForFileObject
|
|
CcMdlWriteComplete
|
|
ExAllocatePoolWithQuotaTag
|
|
FsRtlCheckLockForWriteAccess
|
|
FsRtlNumberOfRunsInLargeMcb
|
|
FsRtlOplockBreakNotify
|
|
FsRtlPrivateCheckForExclusiveLockAccess
|
|
FsRtlPrivateRemoveLock
|
|
FsRtlReleaseFileForModWrite
|
|
IoAllocateAdapterChannel
|
|
IoGetCurrentProcess
|
|
IoQueueThreadIrp
|
|
IoRaiseInformationalHardError
|
|
IoStartNextPacketByKey
|
|
KeInitializeDeviceQueue
|
|
KeInsertQueueApc
|
|
KiQuantumEnd
|
|
KiSystemService
|
|
MiChargeCommitmentCantExpand
|
|
MiCheckPdeForPagedPool
|
|
MiDetermineUserGlobalPteMask
|
|
MiRemoveWsleFromFreeList
|
|
MiResolveTransitionFault
|
|
MiVerifyImageHeader
|
|
MmCanFileBeTruncatedInternal
|
|
NtDeleteFile
|
|
ObDeleteCapturedInsertInfo
|
|
ObInsertObject
|
|
RtlAllocateAndInitializeSid
|
|
RtlDeleteNoSplay
|
|
RtlEqualPrefixSid
|
|
RtlInitializeSid
|
|
RtlLookupElementGenericTable
|
|
RtlUpcaseUnicodeToMultiByteN
|
|
CcCreateVacbArray
|
|
FsRtlAllocateFirstMapping
|
|
FsRtlCancelExclusiveIrp
|
|
FsRtlPrivateCheckWaitingLocks
|
|
FsRtlPrivateInitializeFileLock
|
|
Ke386GetGdtEntryThread
|
|
KeInitializeEvent
|
|
KiExceptionExit
|
|
MiAccessCheck
|
|
MiBuildKernelMap
|
|
MiDeleteSystemPagableVm
|
|
MiFindActualFaultingPte
|
|
MiFreeInPageSupportBlock
|
|
MiGetSystemCacheSubsection
|
|
MiInsertWsle
|
|
MiMapPageToZeroInHyperSpace
|
|
MiReleasePageFileSpace
|
|
MiReserveSystemPtes2
|
|
MmBuildMdlForNonPagedPool
|
|
ObpValidateAccessMask
|
|
RtlClearBits
|
|
RtlConvertUlongToLargeInteger
|
|
RtlEnumerateGenericTable
|
|
RtlFirstFreeAce
|
|
RtlIsGenericTableEmpty
|
|
RtlLargeIntegerDivide
|
|
RtlLengthSecurityDescriptor
|
|
CcAllocateObcb
|
|
CcUnpinDataForThread
|
|
ExCreateHandleTable
|
|
ExecuteHandler
|
|
ExReleaseResourceForThreadLite
|
|
FsRtlCheckForMatchingFileObject
|
|
FsRtlDeleteTunnelCache
|
|
FsRtlInitializeFileLock
|
|
FsRtlMdlReadComplete
|
|
FsRtlMdlWriteCompleteDev
|
|
FsRtlPrivateCancelFileLockIrp
|
|
FsRtlPrivateInsertExclusiveLock
|
|
FsRtlSplitLargeMcb
|
|
FsRtlSyncVolumes
|
|
FsRtlUninitializeFileLock
|
|
IoGetFileObjectGenericMapping
|
|
IopSynchronousApiServiceTail
|
|
KeBoostCurrentThread
|
|
KeContextToKframes
|
|
KeReadStateSemaphore
|
|
KiContinue
|
|
MiFlushEventCounter
|
|
MiInitializeTransitionPfn
|
|
MiMapPageInHyperSpace
|
|
MiRemovePageFromWorkingSet
|
|
MmCanFileBeTruncated
|
|
MmGetFileNameForSection
|
|
RtlAreBitsSet
|
|
RtlFindClearBitsAndSet
|
|
RtlFindFirstRunSet
|
|
RtlFindSetBits
|
|
RtlInitializeBitMap
|
|
RtlSetAllBits
|
|
SeAccessCheck
|
|
CcExtendVacbArray
|
|
CcPurgeCacheSection
|
|
CcUnmapVacb
|
|
ExAllocatePoolWithQuota
|
|
ExLocalTimeToSystemTime
|
|
ExpAllocateHandleTableEntries
|
|
FsRtlAddLargeEntry
|
|
FsRtlFastUnlockAll
|
|
FsRtlFastUnlockSingleShared
|
|
FsRtlMdlReadCompleteDev
|
|
FsRtlPrivateInsertSharedLock
|
|
FsRtlRemoveAndCompleteIrp
|
|
IoAcquireVpbSpinLock
|
|
IopMountVolume
|
|
IopSynchronousServiceTail
|
|
IopTimerDispatch
|
|
IoUpdateShareAccess
|
|
KeFlushEntireTb
|
|
KeInitializeThread
|
|
KeSetKernelStackSwapEnable
|
|
KiComputeWaitInterval
|
|
KiEspToTrapFrame
|
|
KiScanReadyQueues
|
|
KiServiceExit2
|
|
KiTimerExpiration
|
|
KiUnwaitThread
|
|
main
|
|
MiAddMappedPtes
|
|
MiChargeCommitment
|
|
MiDeleteFreeVm
|
|
MiFindEmptyAddressRangeDownTree
|
|
MiFlushInPageSupportBlock
|
|
MiFlushPteList
|
|
MiLocateSubsection
|
|
MiReturnCommitment
|
|
MiUnlockPagedAddress
|
|
MiUnmapImageHeaderInHyperSpace
|
|
MiUpForkPageShareCount
|
|
MmFlushImageSection
|
|
MmGetPhysicalAddress
|
|
MmOutSwapProcess
|
|
MmUnlockCachedPage
|
|
MmWorkingSetManager
|
|
NtCancelIoFile
|
|
NtProtectVirtualMemory
|
|
NtStartProfile
|
|
ObpInsertHandleCount
|
|
PspSystemThreadStartup
|
|
RtlCreateAcl
|
|
RtlEqualSid
|
|
RtlExtendedIntegerMultiply
|
|
RtlInitUnicodeString
|
|
RtlOemStringToCountedUnicodeString
|
|
RtlSecondsSince1970ToTime
|
|
RtlSubAuthoritySid
|
|
RtlUnwind
|
|
RtlUpcaseUnicodeStringToAnsiString
|
|
RtlValidSecurityDescriptor
|
|
SeDeassignSecurity
|
|
SeFreeCapturedSecurityQos
|
|
SeFreePrivileges
|
|
SeQueryAuthenticationIdToken
|
|
|
|
|