Windows NT/2000本機API參考手冊

定　價：￥49.00

作　者：	（美）Gary Nebbett著；齊舒創(chuàng)作室譯
出版社：	機械工業(yè)出版社
叢編項：
標　簽：	Windows

ISBN：	9787111088349	出版時間：	2001-01-01	包裝：
開本：	26cm	頁數(shù)：	485頁	字數(shù)：

內(nèi)容簡介

　　本書詳細地介紹了Windows NT/2000本機API，清楚地給出了每個API的說明、成員（參數(shù)）、相關(guān)的Win32函數(shù)和返回值，可供從事Windows NT/2000應(yīng)用程序編程的人員參考，以快速提高編程效率。本手冊詳細地介紹了Windows NT/2000本機應(yīng)用程序編程接口，清楚地給出了每個應(yīng)用程序編程接口的說明、成員（參數(shù)）、相關(guān)的Win32函數(shù)和返回值，并進行了必要的備注。通過查閱本手冊，讀者可以深入地了解Windows NT和Windows 2000所提供的系統(tǒng)服務(wù)，從而可以深入地挖掘系統(tǒng)的潛力，為開發(fā)應(yīng)用程序提供良好的基礎(chǔ)，以便快速提高編程效率。作為軟件開發(fā)人員的一個獨特的工具，本手冊包括：Native API中包含的200多個程序；不能直接由Win32 API訪問的程序及大量附加功能的程序的詳細描述；演示特殊程序功能實現(xiàn)的程序?qū)嵗蛻?yīng)用；支持開發(fā)用戶模式應(yīng)用程序的核心結(jié)構(gòu)。對于編制應(yīng)用程序和系統(tǒng)程序的程序員，本手冊可幫您：開發(fā)諸如故障調(diào)試程序和分析工具等的關(guān)鍵工具和技術(shù)；確定那些似乎丟失的或只是未用文字表示出來的功能；了解隨著Windows 2000出現(xiàn)后API的相應(yīng)改變；加深對Windows NT核心內(nèi)容的理解。

作者簡介

暫缺《Windows NT/2000本機API參考手冊》作者簡介

圖書目錄

譯者序
引言
第1章系統(tǒng)信息和控制
ZwQuerySystemInformation
ZwSetSystemInformation
SYSTEM_INFORMATION_CLASS
SystemBasicInformation
SystemProcessorInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemProcessesAndThreadsInformation
SystemCallcounts
SystemConfigurationInformation
SystemProcessorTimes
SystemGlobalFlah
SystemModuleInformation
SystemLockInformation
SystemHandleInformation
SystemObjectInformation
SystemPagefileInformation
SystemInstructionEmulationCounts
SystemCacheInformation
SystemPoolTagInformation
SystemProcessorStatistics
SystemDpcInformation
SystemLoadImage
SystemUnloadImage
SystemTimeAdjustment
SystemCrashdumpInformation
SystemExceptionInformation
SystemCrashDumpStateInformation
SystemKernelDebuggerInformation
SystemContextSwitchInformation
SystemRegistryQuotaInformation
SystemLoadAndCallImage
SystemPrioritySeparation
SystemTimeZoneInformation
SystemLookasideInformation
SystemTimeSlipEvent
SystemSetTimeSlipEvent
SystemCreateSession
SystemDeleteSession
SystemRangeStartInformation
SystemVerifierInformation
SystemAddVerifier
SystemSessionProcessesInformation
SystemPoolBlocksInformation
SystemMemoryUsageInformation
例子1.1：一個不完整的ToolHelp庫的實現(xiàn)
例子1.2：列出一個打開進程的句柄
ZwQuerySystemEnvironmentValue
ZwSetSystemEnvironmentValue
ZwShutdownSystem
ZwSystemDebugControl
例子1.3：設(shè)置內(nèi)部斷點
例子1.4：得到跟蹤信息
第2章對象、對象目錄和符號鏈接
OBJECT_ATTRIBUTES
ZwQueryObject
ZwSetInformationoObject
OBJECT_INFORMATION_CLASS
ObjectBasicInformation
ObjectNameInformation
ObjecttypeInformation
ObjectAllTypesInformation
ObjectHandleInformation
ZwDuplicateObject
ZwMakeTemporaryObject
ZwClose
例子2.1；列出一個打開進程的句柄
ZwQuerySecurityObject
ZwSetSecurityObject
ZwCreateDirectoryObject
ZwOpenDirectoryObject
ZwQuerydirectoryObject
ZwCreateSymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
第3章虛擬內(nèi)存
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQueryVirtualMemory
MEMORY_INFORMATION_CLASS
MemoryBasicInformation
MemoryWorkingSetList
MemorySectionName
ZwLockVirtualMemory
ZwUnlockVirtualMemory
ZwReadVirtualMemory
ZwWriteVirtualMemory
ZwProtectVirtualMemory
ZwFlushVirtualMemory
ZwAllocateUserPhysicalPages
ZwFreePhysicalpages
ZwMapuserPhysicalpages
ZwMapuserPhysicalpagesScatter
ZwGetWriteWatch
ZwResetWriteWatch
第4章區(qū)\段
ZwCreateSection
ZwOpenSection
ZwQuerySection
SECTION_INFORMATION_CLASS
SectionBasicInformation
SectionImageInformation
ZwExtendSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwAreMappedFilesTheSame
第5章線程
ZwCreateThread
ZwOpenThread
ZwTerminateThread
ZwQueryInformationThread
ZwSetInformationThread
THREADINFOCLASS
ThreadBasicInformation
ThreadPriority
ThreadBasePriority
ThreadAffinityMask
ThreadImpersonationToken
ThreadEnableAlignmentFaultFixup
ThreadEventPair
ThreadQuerySetWin32StartAddress
ThreadZerotlsCell
ThreadPerfomanceCount
ThreadAmILastThread
ThreadIdealProcessor
ThreadPriorityBoost
ThreadSetTlsArrayAddress
ThreadIsIoPending
ThreadHideFromDebugger
ZwSuspendThread
ZwResumeThread
ZwGetContextThread
ZwSetContextThread
ZwQueueApcThread
ZwTestAlert
ZwAlertThread
ZwAlertResumeThread
ZwRegisterThreadterminatePort
ZwImpersonateThread
ZwImpersonateAnonymousToken
第6章進程
ZwCreateProcess
ZwOpenProcess
ZwTerminateProcess
ZwQueryInformationProcess
ZwSetInformationProcess
PROCESSINFOCLASS
ProcessBasicInformation
ProcessQuotaLimits
ProcessIoCounters
ProcessVmCounters
ProcessTimes
ProcessBasePriority
ProcessRaisePriority
ProcessDebugPort
ProcessExceptionPort
ProcessAccessToken
ProcessDefaultHardErrorMode
ProcessPooledUsageAndLimits
ProcessWorkingSetWatch
ProcessUserModeIOPL
ProcessEnableAlignmentFaultFixup
ProcessPriorityClass
ProcessWx86Information
ProcessHandleCount
ProcessAffinityMask
ProcessPriorityBoost
ProcessDeviceMap
ProcessSessionInformation
ProcessForegroundInformation
ProcessWow64Information
RtlCreateProcessParameters
RtlDestroyProcessParameters
PROCESS_PARAMETERS
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
DEBUG_BUFFER
DEBUG_MODULE_INFORMATION
DEBUG_HEAP_INFORMATION
DEBUG_LOCK_INFORMATION
例子6.1：分叉一個Win32進程
例子6.2：創(chuàng)建一個Win32進程
例子6.3：使用RtlQueryProcessDebugInformatioton實現(xiàn)拓展ToolHelp庫
第7章作業(yè)
ZwCreateJobObject
ZwOpenJobObject
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwQueryInformationJobObject
ZwSetInformationJobObject
JOBOBJECTINFOCLASS
JobObjectBasicAccountingInformation
JobObjectBasicLimitInformation
JobObjectBasicProcessIdList
JobObjectBasicUIRestrictions
JobObjectSecurityLimitInformation
JobObjectEndOfJobTimeInformation
JobObjectAssociateCompletionPortInformation
JobObjectBasicAndIoAccountingInformation
JobObjectExtendedLimitInformation
第8章標記（Token）
ZwCreateToken
ZwOpenProcessToken
ZwOpenthreadToken
ZwDuplicateToken
ZwFilterToken
ZwAdjustPrivilegesToken
ZwAdjustGroupsToken
ZwQueryInformationToken
ZwSetInformationToken
TOKEN_INFORMATION_CLASS
TokenUser
TokenGroups和TokenRestrictedSide
TokenPrivileges
TokenOwner
TokenPrimaryGroup
TokenDefaultDacl
TokenSource
TokenType
TokenImpersonationLevel
TokenStatistics
TokenSessionId
例子8.1：為SYSTEM用戶創(chuàng)建一個命令窗口
第9章同步
ZwWaitForSingleObject
ZwSignalAndWaitForSingleObject
ZwWaitForMultipleObject
ZwCreateTimer
ZwOpenTimer
ZwCancelTimer
ZwSetTimer
ZwQueryTimer
TIMER_INFORMATION_CLASS
TimeBasicInformation
ZwCreateEvent
ZwOpenEvent
ZwSetEvent
ZwPulseEvent
ZwResetEvent
ZwClearEvent
ZwQueryEvent
EVENT_INFORMATION_CLASS
EventBasicInformation
ZwCreateSemaphore
ZwOpenSemaphore
ZwReleaseSemaphore
ZwQuerySemaphore
SEMAPHORE_INFORMATION_CLASS
SemaphoreBasicInformation
ZwCreateMutant
ZwOpenMutant
ZwReleaseMutant
ZwQueryMutant
MUTANT_INFORMATION_CLASS
MutantBasicInformation
ZwCreateIoCompletion
ZwOpenIoCompletion
ZwSetIoCompletion
ZwRemoveIoCompletion
ZwQueryIoCompletion
IO_COMPLETION_INFORMATION_CLASS
IoCompletionBasicInformation
ZwCreateEventPair
ZwOpenEventPair
ZwWaitLowEventPair
ZwWaitHighEventPair
ZwSetLowWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwSetLowEventPair
ZwSetHighEventPair
第10章時間
ZwQuerySystemTime
ZwSetSystemTime
ZwQueryPerformanceCounter
ZwSetTimerResolution
ZwQueryTimerResolution
ZwDelayExecution
ZwYieldExecution
ZwGettickCount
第11章執(zhí)行配置
DPROFILE_SOURCE
ZwCreateProfile
ZwSetIntervalProfile
ZwQueryIntervalProfile
ZwStartProfile
ZwStopProfile
例子11.1：配置內(nèi)核
第12章端口（局部過程調(diào)用）
PORT_MESSAGE
PORT_SECTION_WRITE
PORT_SECTION_READ
ZwCreatePort
ZwCreateWaitablePort
ZwConnectPort
ZwSecureConnectPort
ZwListenPort
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwRequestPort
ZwRequestWaitReplyPort
ZwReplyPort
ZwReplyWaitReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReceivePortEx
ZwReadRequestData
ZwWriteRequestData
ZwQueryInformationPort
PORT_INFORMATION_CLASS
PortBasicInformation
ZwImpersonateClientOfPort
例子12.1：連接到一個命名端口
第13章文件
ZwCreateFile
ZwOpenFile
ZwDeleteFile
ZwFlushBuffersFile
ZwCancelIoFile
ZwReadFile
ZwWriteFile
ZwReadFileScatter
ZwWriteFileGather
ZwLockFile
ZwUnlockFile
ZwDeviceIoControlFile
ZwFscontrolFile
ZwNotifyChangeDirectoryFile
FILE_NOTIFY_INFORMATION
ZwQueryEaFile
ZwSetEaFile
FILE_FULL_EA_INFORMATION
FILE_GET_EA_INFORMATION
ZwCreateNamedPipeFile
ZwCreateMailslotFile
ZwQueryVolumeInformationFile
ZwSetVolumeInformationFile
FS_INFORMATION_CLASS
FileFsVolumeInformation
FileFsVolumeInformation
FileFsLabelInformation
FileFssizeInformation
FileFsdeviceInformation
FileFsAttributeInformation
FileFsControlInformation
FileFsFullSizeInformation
FileFsObjectIdInformation
ZwQueryQuotaInformationFile
ZwSetquotaInformationFile
FILE_USER_QUOTA_INFORMATION
FILE_QUOTA_LIST_INFORMATION
ZwQueryAttributesFile
ZwQueryFullAttributesFile
ZwQueryInformationFile
ZwSetInformationFile
ZwQueryDirectoryFile
ZwQueryOleDirectoryFile
FILE_INFORMATION_CLASS
FileDirectoryInformation
FilefullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FilestandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation和FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOffileInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailstotSetInformation
FilecompressionInformation
FileObjectIdInformation
FileCompletionInformation
FileMoveClusterInformation
FileQuotaInformation
FileReparsePointInformation
FileNetworkOpenInformation
FileAttributeTagInformation
例子13.1：通過文件標識符打開一個文件
第14章注冊表關(guān)鍵項
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwFlushKey
ZwSaveKey
ZwSaveMergedKey
ZwRestoreKey
ZwLoadKey
ZwLoadKey2
ZwUnloadKey
ZwQueryOpenSubKeys
ZwReplaceKey
ZwSetInformationKey
KEY_SET_INFORMATION_CLASS
KeyLastWriteTimeInforamtion
ZwQueryKey
ZwEnumerateKey
KEY_INFORMATION_CLASS
KeyBasicInformation
KeyNodeInformation
KeyFullInformation
KeyNameInformation
ZwNotifyChangeKey
ZwNotifyChangeMultipleKeys
ZwdeleteValueKey
ZwSetValueKey
ZwQueryValueKey
ZwEnumerateValueKey
KEY_VALUE_INFORMATION_CLASS
KeyValueBasicInformation
KeyValueFullInformation和KeyValueFullInformationAlign64
KeyValuePartialInformation
ZwQueryMultipleValueKey
DEY_VALUE_ENTRY
ZwInitializeRegistry
第15章安全性和審計
ZwPrivilegeCheck
ZwPrivilegeObjectAuditAlarm
ZwPrivilegeServiceAuditAlarm
ZwAccess Check
ZwAccess CheckAndAuditAlarm
ZwAccess CheckByType
ZwAccess CheckByTypeAndAuditAlarm
ZwAccess CheckByTypeResultList
ZwAccess CheckByTypeResultListAndAuditAlarm
ZwAccess CheckByteResultListAndauditAlarmByHandle
ZwOpenObjectAuditAlarm
ZwcloseObjectAuditAlarm
ZwdeleteObjectAuditAlarm
第16章即插即用和電源管理
ZwRequestWakeupLatency
ZwRequestDeviceWakeup
ZwCancelDeviceWakeupRequest
ZwIssystemResumeAutomatic
ZwSetThreadExecutionState
ZwGetDevicePowerState
ZwSetsystemPowerState
ZwInitiatePowerAction
ZwPowerInformation
POWER_INFORMATION_LEVEL
SystemPowerPolicyAc，SystemPowerPolicDc，SystemPowerPolicyCurrent
SystemPowerCapabilities
SystemBatteryState
SystemPowerStatehandler
ProcessorStateHandler
AdministratorPowerPolicy
ProcessorInformation
SystemPowerInformation
ZwPlugPlayControl
ZwGetPlugPlayEvent
第17章其它系統(tǒng)服務(wù)
ZwRaiseException
ZwContinue
ZwW32Call
ZwCallbackReturn
ZwsetLowWaitHighThread
ZwSetHighWaitLowThread
ZwLoadDriver
ZwUnloadDriver
ZwFlushInstructionCache
ZwFlushWriteBuffer
ZwQueryDefaultLocale
ZsSetDefaultLocale
ZwQueryDefaultUILanguage
ZwSetDefaultUILanguage
ZwQueryInstallUILanguage
ZwAllocateLocallyUniqueId
ZwAllocateUuids
ZwSetUuidSeed
ZwRaiseHardError
ZwSetDefaultHardErrorPort
ZwDisplayString
ZwCreatePagingFile
ZwAddAtom
ZwFindAtom
ZwDeleteAtom
ZwQueryInformationAtom
ATOM_INFORMATION_CLASS
AtomBasicInformation
AtomListInformation
ZwSetLdtEntries
ZwVdmControl
Unimplemented System Services
附錄A 從內(nèi)核模式調(diào)用系統(tǒng)服務(wù)
例子A.1：重新實現(xiàn)NtQueryEvent
例子A.2：動態(tài)粘接到ntdll.dl
附錄B 內(nèi)核模式具體針對Intel平臺的入口點
KiTrap03
KiTrap04
KiGetTickCount
KiCallbackReturn
kiSetLowWaitHighThread
KiDebugService
KiSystemService
附錄C 異常和調(diào)試
例子C.1：KiDispatchException的偽代碼
例子C.2：KiUserExceptionDispatcher的偽代碼
內(nèi)核調(diào)試器
例子C.3：debugService的偽代碼
用戶模式調(diào)試器
DEBU_MESSAGE
調(diào)試消息路由
由路由進程添加的值
OutputDebugString
跟蹤對DLL所導(dǎo)出的例程的調(diào)用
例子C.4：跟蹤實用程序
附錄D 取NTFS盤上結(jié)構(gòu)
NTFS_RECORD_HEADER
FILE_RECORD_HEADER
ATTRIBUTE
RESIDENT_ATTRIBUTE
NONRESIDENT_ATTRIBUTE
AttributeStandardInformation
AttributeAttributeList
AttributeFileName
AttributeObjectId
AttributeSecuritydescriptor
AttributeVolumeName
AttributeVolumeInformation
AttributeData
AttributeIndexRoot
AttributeIndexAllocation
DIRECTORY_INDEX
DIRECTORY_ENTRY
AttributeBitmap
AttributeReparsePoint
AttributeEAInformation
AttributeEA
AttributePropertySet
AttributeLoggedUtilityStream
特殊文件
打開特殊文件
從被刪除的文件恢復(fù)數(shù)據(jù)
例子D.1：從一個文件恢復(fù)數(shù)據(jù)
例子D.2：對被恢復(fù)的數(shù)據(jù)解壓縮