NET Framework for developers. To work with HAL Extensions, prepare your development system, running Windows 10, version or a later version of Windows WinDbg Preview is a new version of WinDbg with more modern visuals, faster windows, a full-fledged scripting experience, built with the extensible debugger data model front and center.
WinDbg Preview supports debugging every version of Windows It's included in the SDK for Windows 7 and. To install the Debugging Tools for Windows as a standalone component, start the SDK installer, and in the installation wizard, select Debugging Tools for Windows , and clear all other components. Skip to main content. This browser is no longer supported.
Download Microsoft Edge More info. Contents Exit focus mode. Is this page helpful? Please rate your experience Yes No. Any additional feedback? Note Please review Hardware development kits for Windows 10, Version After the sleep interval has passed, the thread is ready to run.
If you specify 0 milliseconds, the thread will relinquish the remainder of its time slice but remain ready. Note that a ready thread is not guaranteed to run immediately.
Consequently, the thread may not run until some time after the sleep interval elapses. For more information, see Scheduling Priorities. Windows Phone 8. Windows 8. For an example, see Using Thread Local Storage. Process and Thread Functions. Suspending Thread Execution. Skip to main content. Registers a driver-supplied IoCompletion routine with a given IRP, so that the IoCompletion routine is called when lower-level drivers have completed the request. Creates or opens a file object representing a physical, logical, or virtual device, a directory, a data file, or a volume.
Returns information about the mapping between generic access rights and specific access rights for file objects. Synchronizes the execution of a driver-supplied SynchCritSection routine with that of the ISR associated with a set of interrupt objects, given a pointer to the interrupt objects. This routine reserves exclusive access to a DMA channel and map registers for the specified device. Releases an adapter object, representing a system DMA channel, and optionally releases map registers, if any were allocated.
Releases a set of map registers that were saved from a call to AllocateAdapterChannel, after the registers have been used by IoMapTransfer and the bus-master DMA transfer is complete. This routine reserves exclusive access to the hardware controller for the specified device. Releases a controller object, provided that all device operations queued to the controller for the current IRP have completed. Enables the timer for a given device object and calls the driver-supplied IoTimer routine once per second thereafter.
Disables the timer for a given device object so that the driver-supplied IoTimer routine is not called unless the driver reenables the timer. Sets the absolute or relative interval at which a timer object will be set to the Signaled state and optionally supplies a timer DPC to be executed after the interval expires. Sets the absolute or relative interval at which a timer object will be set to the Signaled state, optionally supplies a timer DPC to be executed when the interval expires, and optionally supplies a recurring interval for the timer.
Cancels a timer object before the interval passed to KeSetTimer expires; dequeues a timer DPC before the timer interval, if any was set, expires. Dequeues the next IRP, according to the specified sort-key value, for a given device object.
Registers a driver-supplied IoCompletion routine with a given IRP, so the IoCompletion routine is called when the next-lower-level driver has completed the requested operation in one or more of the following ways: successfully, with an error, or by canceling the IRP. Acquires an initialized resource for exclusive access by the calling thread and optionally waits for the resource to be acquired.
Acquires an initialized resource for shared access by the calling thread and optionally waits for the resource to be acquired. Acquires a given resource for shared access without waiting for any pending attempts to acquire exclusive access to the same resource.
Acquires a given resource for shared access, optionally waiting for any pending exclusive waiters to acquire and release the resource first. Reads data from an open file. Writes data to an open file. Sets or clears the Cancel routine in an IRP during a cancelable state transition. Setting a Cancel routine makes an IRP cancelable. An initialized spin lock also is a required parameter to the ExInterlockedXxx routines.
Acquires a spin lock so the caller can synchronize access to shared data safely on multiprocessor platforms. Acquires a queued spin lock so the caller can synchronize access to shared data safely on multiprocessor platforms. Insert and remove IRPs in a driver-managed internal queue, which is protected by an initialized spin lock for which the driver provides the storage. Insert and remove IRPs in a driver-allocated and managed internal device queue object, which is protected by a built-in spin lock.
Adds a value to a variable of type ULONG as an atomic operation, using a spin lock to ensure multiprocessor-safe access to the variable; returns the value of the variable before the call occurred. Increments a variable of type LONG as an atomic operation. The sign of the return value is the sign of the result of the operation.
Decrements a variable of type LONG as an atomic operation. Sets a variable of type LONG to a specified value as an atomic operation; returns the value of the variable before the call occurred. Adds a value to a given integer variable as an atomic operation; returns the value of the variable before the call occurred.
Compares the values referenced by two pointers. If the values are equal, resets one of the values to a caller-supplied value in an atomic operation. Compares the pointers referenced by two pointers. If the pointer values are equal, resets one of the values to a caller-supplied value in an atomic operation. Associates a timer with the given device object and registers a driver-supplied IoTimer routine for the device object.
Enables the timer for a given device object and calls the driver-supplied IoTimer routine once every second. Disables the timer for a given device object so the driver-supplied IoTimer routine is not called unless the driver reenables the timer.
Initializes a DPC object and sets up a driver-supplied CustomTimerDpc routine that can be called with a given context.
Sets the absolute or relative interval at which a timer object will be set to the Signaled state; optionally supplies a timer DPC to be executed when the interval expires. Sets the absolute or relative interval at which a timer object will be set to the Signaled state; optionally supplies a timer DPC to be executed when the interval expires; and optionally supplies a recurring interval for the timer.
Returns the number of nanosecond units that are added to the system time at each interval-timer interrupt. Returns the current value of the system interrupt-time count in nanosecond units, with accuracy to within system clock tick.
Returns the current value of the system interrupt-time count in nanosecond units, with accuracy to within a microsecond. Initializes a resource, for which the caller provides the storage, to be used for synchronization by a set of threads shared readers, exclusive writers.
Returns the number of threads currently waiting to acquire a given resource for exclusive access. Queues an initialized work queue item so the driver-supplied routine will be called when a system worker thread is given control. Sets the absolute or relative interval at which a timer object will be set to the Signaled state, and optionally supplies a timer DPC to be executed when the interval expires.
Sets the absolute or relative interval at which a timer object will be set to the Signaled state. Optionally supplies a timer DPC to be executed when the interval expires and a recurring interval for the timer. Cancels a timer object before the interval passed to KeSetTimer expires. Dequeues a timer DPC before the timer interval if any expires.
Returns the previous state of a given event object and sets the event if not already Signaled to the Signaled state. Returns the current state nonzero for Signaled or zero for Not-Signaled of a given event object. Acquires an initialized fast mutex, possibly after putting the caller into a wait state until it is acquired, and gives the calling thread ownership with APCs disabled.
Acquires an initialized fast mutex, possibly after putting the caller into a wait state until it is acquired. Releases a given mutex object, specifying whether the caller will call one of the KeWaitXxx routines as soon as KeReleaseMutex returns the previous value of the mutex state a zero for Signaled; otherwise, Not-Signaled. Returns the current state one for Signaled or any other value for Not-Signaled of a given mutex object. Releases a given semaphore object.
Supplies a run-time priority boost for waiting threads if the release sets the semaphore to the Signaled state. Augments the semaphore count by a given value and specifies whether the caller will call one of the KeWaitXxx routines as soon as KeReleaseSemaphore returns. Returns the current state zero for Not-Signaled or a positive value for Signaled of a given semaphore object.
Puts the current thread into an alertable or nonalertable wait state until a given dispatcher object is set to the Signaled state or optionally until the wait times out. Puts the current thread into an alertable or nonalertable wait state until a given mutex is set to the Signaled state or optionally until the wait times out.
Puts the current thread into an alertable or nonalertable wait state until any one or all of a number of dispatcher objects are set to the Signaled state or optionally until the wait times out.
Special kernel-mode APCs are still delivered. Reenables, as soon as possible, the delivery of normal kernel-mode APCs that were disabled by a preceding call to KeEnterCriticalRegion. Saves the current thread's nonvolatile floating-point context so that the caller can carry out its own floating-point operations. Restores the previous nonvolatile floating-point context that was saved with KeSaveFloatingPointState.
Registers a highest level driver's callback routine that is subsequently executed whenever a new process is created or existing process deleted. Registers a highest level driver's callback routine that is subsequently executed whenever a new thread is created or an existing thread is deleted. Registers a callback routine for a highest level system-profiling driver.
The callback routine is subsequently executed whenever a new image is loaded for execution. Allocates optionally cache-aligned pool memory from paged or nonpaged system space. The caller-supplied tag is put into any crash dump of memory that occurs. After successful initialization of the list, fixed-size blocks can be allocated from, and freed to, the lookaside list.
Removes the first entry from the specified lookaside list in nonpaged memory. If the lookaside list is empty, allocates an entry from nonpaged pool. Returns an entry to the specified lookaside list in nonpaged memory. If the list has reached its maximum size, returns the entry to nonpaged pool. After successful initialization of the list, fixed-size blocks can be allocated from and freed to the lookaside list.
Removes the first entry from the specified lookaside list in paged memory. If the lookaside list is empty, allocates an entry from paged pool. Returns an entry to the specified lookaside list in paged memory. If the list has reached its maximum size, returns the entry to paged pool. Returns TRUE if the machine is running as a server.
Allocates a virtual address range of noncached and cache-aligned memory in nonpaged system space pool. Releases a virtual address range of noncached memory in nonpaged system space when the driver unloads. Allocates and maps a logically contiguous region of memory that is simultaneously accessible both from the processor and from a device, given access to an adapter object, the requested length of the memory region to allocate, and access to variables where the starting logical and virtual addresses of the allocated region are returned.
Returns TRUE if the requested length was allocated. Releases an allocated common buffer and unmaps it, given access to the adapter object, the length, and the starting logical and virtual addresses of the region to be freed when the driver unloads. Arguments must match those passed in the call to AllocateCommonBuffer.
Compares data, given pointers to caller-supplied buffers and the length in bytes for the comparison. Returns the number of bytes that are equal. Copies the data from one caller-supplied buffer to another, given pointers to both buffers and the length in bytes to be copied.
Copies the data from one caller-supplied memory range to another, given pointers to the base of both ranges and the length in bytes to be copied. Fills a caller-supplied buffer with the specified UCHAR value, given a pointer to the buffer and the length in bytes to be filled.
Fills a buffer with zeros, given a pointer to the caller-supplied buffer and the length in bytes to be filled. Retrieves a USHORT value at a given address, avoiding alignment faults, and stores the value at a given address that is assumed to be aligned. Retrieves a ULONG value at a given address, avoiding alignment faults, and stores the value at a given address that is assumed to be aligned. Fills in the corresponding physical addresses of a given MDL that specifies a range of virtual addresses in nonpaged pool.
Allocates and initializes an MDL describing a buffer specified by the given virtual address and length in bytes; returns a pointer to the MDL. Returns a possibly invalid virtual address for a buffer described by a given MDL; the returned address, used as an index to a physical address entry in the MDL, can be input to MapTransfer for drivers that use DMA.
If no virtual address exists, one is assigned. Initializes a caller-created MDL to describe a buffer specified by the given virtual address and length in bytes. Returns whether a page fault will occur if a read or write operation is done at the given virtual address. Maps a physical address range to a cached or noncached virtual address range in nonpaged system space. Maps already locked physical pages, described by a given MDL, to a returned virtual address range.
Probes the pages specified in an MDL for a particular kind of access, makes the pages resident, and locks them in memory; returns the MDL updated with corresponding physical addresses. Usually, only highest-level drivers call this routine.
Secures a memory-address range so that it cannot be freed and its page protection cannot be made more restrictive. Returns the number of bytes required for an MDL describing the buffer specified by the given virtual address and length in bytes.
Releases a section that was previously locked into system space when the driver is no longer processing IRPs, or when the contents of the section are no longer required. Lets a driver page all of its code and data regardless of the attributes of the various sections in the driver's image.
Resets a driver's pageable status to that specified by the sections making up the driver's image. Maps a view of an open section into the virtual address space of a process. Returns an offset into the section base of the mapped view and the size mapped. Returns the base address of an instance of a structure given the structure type and the address of a field within it.
Notifies the PnP manager that the PnP state of a device has changed. Claims hardware resources in the configuration registry for a legacy device. This routine is for drivers that detect legacy hardware that cannot be enumerated by PnP. Returns a list of device interfaces of a particular device interface class such as all devices on the system that support a HID interface.
Returns the alias device interface of the specified interface class, if the alias exists. Device interfaces are considered aliases if they are exposed by the same underlying device and have identical interface reference strings, but are of different interface classes. Notifies the PnP manager that a custom event has occurred on a device. The PnP manager sends notification of the event to drivers that registered for it. Returns immediately and does not wait while the PnP manager sends notification of the event to drivers that registered for it.
Initializes a remove lock for a device object. Increments the count for a remove lock, indicating that the associated device object should not be detached from the device stack nor deleted. Releases a remove lock acquired with a previous call to IoAcquireRemoveLock and waits until all acquisitions of the lock have been released. Increments or decrements a caller-supplied page-file counter as an atomic operation.
This routine can be used to adjust other counters, such as counters for hibernation files or crash-dump files. Notifies the PnP manager that the device eject button was pressed. Note that this routine reports a request for a device eject, not media eject. The WmiFireEvent routine sends an event to WMI for delivery to data consumers that have requested notification of the event.
Given a device object, determines the WMI class instance name supported by the corresponding driver. Callers can use this to determine the instance names supported by a particular driver. Given a file handle, determines the WMI class instance name supported by the corresponding driver.
The NtRenameTransactionManager routine changes the identity of the transaction manager object that is stored in the CLFS log file stream contained in the log file name.
The ZwAllocateVirtualMemory routine reserves, commits, or both, a region of pages within the user-mode virtual address space of a specified process. The ZwCreateEvent routine creates an event object, sets the initial state of the event to the specified value, and opens a handle to the object with the specified desired access.
The ZwCreateKeyTransacted routine creates a new registry key or opens an existing one, and it associates the key with a transaction. The ZwDeleteValueKey routine deletes a value entry matching a name from an open key in the registry. If no such entry exists, an error is returned. The ZwDeviceIoControlFile routine sends a control code directly to a specified device driver, causing the corresponding driver to perform the specified operation. The ZwDuplicateToken function creates a handle to a new access token that duplicates an existing token.
This function can create either a primary token or an impersonation token. The ZwFlushBuffersFile routine is called by a file system filter driver to send a flush request for the specified file to the file system.
The ZwFlushBuffersFileEx routine is called by a file system filter driver to send a flush request for a given file to the file system. An optional flush operation flag can be set to control how file data is written to storage. The ZwFlushVirtualMemory routine flushes a range of virtual addresses within the virtual address space of a specified process which map to a data file back out to the data file if they have been modified. The ZwFreeVirtualMemory routine releases, decommits, or both, a region of pages within the virtual address space of a specified process.
The ZwFsControlFile routine sends a control code directly to a specified file system or file system filter driver, causing the corresponding driver to perform the specified action. The ZwMapViewOfSection routine maps a view of a section into the virtual address space of a subject process. The ZwNotifyChangeKey routine allows a driver to request notification when a registry key changes.
The ZwOpenEvent routine opens a handle to an existing named event object with the specified desired access. The ZwOpenKeyTransacted routine opens an existing registry key and associates the key with a transaction. The ZwOpenKeyTransactedEx routine opens an existing registry key and associates the key with a transaction.
The ZwOpenProcess routine opens a handle to a process object and sets the access rights to this object. The ZwQueryInformationThread routine retrieves information about the specified thread, such as its page priority.
The ZwQueryDirectoryFile routine returns various kinds of information about files in the directory specified by a given file handle. The ZwQueryInformationToken routine retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information. The ZwQueryKey routine provides information about the class of a registry key, and the number and sizes of its subkeys. The ZwQueryVirtualMemory routine determines the state, protection, and type of a region of pages within the virtual address space of the subject process.
The ZwQueryVolumeInformationFile routine retrieves information about the volume associated with a given file, directory, storage device, or volume. The ZwSetEvent routine sets an event object to a Signaled state and attempts to satisfy as many waits as possible.
The ZwSetInformationToken routine modifies information in a specified token. The calling process must have appropriate access rights to set the information. The ZwSetInformationVirtualMemory routine performs an operation on a specified list of address ranges in the user address space of a process. All of the quota entries in the specified buffer are applied to the volume.
The ZwSetVolumeInformationFile routine modifies information about the volume associated with a given file, directory, storage device, or volume. The ZwUnloadDriver routine unloads a driver from the system. Use this routine with extreme caution. See the following Remarks section. The ZwUnmapViewOfSection routine unmaps a view of a section from the virtual address space of a subject process.
An optional time-out can also be specified. Returns a pointer to an adapter object that represents either the DMA channel to which the driver's device is connected or the driver's bus-master adapter. Also returns the maximum number of map registers the driver can specify for each DMA transfer. Returns the base virtual address of a buffer described by a given MDL. The returned address, used as an index to a physical address entry in the MDL, can be input to MapTransfer.
Returns a nonpaged system-space virtual address for the base of the memory area described by an MDL. It maps the physical pages described by the MDL into system space, if they are not already mapped to system space. Returns the number of pages spanned by the virtual range defined by a virtual address and a length in bytes. A driver can use this macro to determine whether a transfer request must be split into partial transfers. Reserves exclusive access to a DMA channel and map registers for a device.
Allocates and maps a logically contiguous region of memory that is simultaneously accessible from both the processor and a device. This routine returns TRUE if the requested length was allocated. Forces any data remaining in either a bus-master adapter's or the system DMA controller's internal buffers to be written into memory or to the device. Releases an adapter object that represents a system DMA channel, and optionally releases any allocated map registers.
Releases and unmaps a previously allocated common buffer. Arguments must match those passed in an earlier call to AllocateCommonBuffer.
Releases a set of map registers that were saved from a call to AllocateAdapterChannel. A driver calls this routine after using the registers in one or more calls to MapTransfer, flushing the cache by calling FlushAdapterBuffers, and completing the bus-master DMA transfer. Sets up map registers for an adapter object previously allocated by AllocateAdapterChannel to map a transfer from a locked-down buffer.
Returns the number of bytes yet to be transferred during the current system DMA operation in autoinitialize mode. Returns a system-space virtual address that maps the physical pages described by a given MDL for drivers whose devices must use PIO.
Registers a driver's interrupt handling routine. An initialized spin lock is a required parameter to the ExInterlockedXxxList routines. Inserts an entry at the tail of a doubly linked list, using a spin lock to ensure multiprocessor-safe access to the list and atomic modification of the list links. Inserts an entry at the head of a doubly linked list, using a spin lock to ensure multiprocessor-safe access to the list and atomic modification of the links in the list.
Removes an entry from the head of a doubly linked list, using a spin lock to ensure multiprocessor-safe access to the list and atomic modification of the links in the list. Removes an entry from the head of a singly linked list as an atomic operation, using a spin lock to ensure multiprocessor-safe access to the list. Inserts an entry at the head of a singly linked list as an atomic operation, using a spin lock to ensure multiprocessor-safe access to the list.
Returns TRUE if a queue is empty. This type of doubly linked list is not protected by a spin lock, unless the caller explicitly manages synchronization to queued entries with an initialized spin lock for which the caller supplies the storage.
Inserts an entry into the queue. This type of singly linked list is not protected by a spin lock, unless the caller explicitly manages synchronization to queued entries with an initialized spin lock for which the caller supplies the storage. Removes an entry from the head of a sequenced, singly linked list that was set up with ExInitializeSListHead.
Queues an entry at the head of a sequenced, singly linked list that was set up with ExInitializeSListHead. Sets up a lookaside list, protected by a system-supplied spin lock, in nonpaged pool from which the driver can allocate and free blocks of a fixed size. Initializes a device queue object to a not-busy state, setting up an associated spin lock for multiprocessor-safe access to device queue entries.
Acquires the device queue spin lock and queues an entry to a device driver if the device queue is not empty; otherwise, inserts the entry at the tail of the device queue. Acquires the device queue spin lock and queues an entry to a device driver if the device queue is not empty; otherwise, inserts the entry into the queue according to the given sort-key value. Removes an entry, selected according to the specified sort-key value, from the given device queue.
Creates a kernel-mode thread associated with a given process object or with the default system process. Process-creation callback implemented by a driver to track the system-wide creation and deletion of processes against the driver's internal state. The PsSetCreateProcessNotifyRoutine routine adds a driver-supplied callback routine to, or removes it from, a list of routines to be called whenever a process is created or deleted. A callback routine implemented by a driver to notify the caller when a process is created or exits.
The PsSetCreateProcessNotifyRoutineEx routine registers or removes a callback routine that notifies the caller when a process is created or exits. The PsSetCreateProcessNotifyRoutineEx2 routine registers or removes a callback routine that notifies the caller when a process is created or deleted. Called by the operating system to notify the driver when a driver image or a user image for example, a DLL or EXE is mapped into virtual memory. The PsSetLoadImageNotifyRoutine routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded or mapped into memory.
The PsSetLoadImageNotifyRoutineEx routine registers a driver-supplied callback that is subsequently notified whenever an image is loaded or mapped into memory. Converts a buffered ANSI string to a Unicode string, given a pointer to the source-string buffer and the address of caller-supplied storage for a pointer to the destination buffer. This routine allocates a destination buffer if the caller does not supply the storage. You can also use the string manipulation routines provided by a compiler to convert ANSI strings to Unicode.
Converts a buffered Unicode string to an ANSI string, given a pointer to the source-string buffer and the address of caller-supplied storage for a pointer to the destination buffer. Concatenates a copy of a buffered Unicode string with a buffered Unicode string, given pointers to both buffers.
Concatenates a given input string with a buffered Unicode string, given a pointer to the buffer. Copies the source string to the destination, given pointers to both buffers, or sets the length of the destination string but not the length of the destination buffer to zero if the optional pointer to the source-string buffer is NULL. Compares two buffered, single-byte character strings and returns a signed value indicating whether they are equivalent or which is greater.
Compares two buffered Unicode strings and returns a signed value indicating whether they are equivalent or which is greater. Converts a copy of a buffered Unicode string to uppercase and stores the copy in a destination buffer.
Converts an unsigned integer value in the specified base to one or more Unicode characters in a buffer. RtlUnicodeStringToInteger converts the Unicode string representation of an integer into its integer equivalent.
Sets a variable of type LONG to a given value as an atomic operation; returns the original value of the variable. Converts an unsigned integer value in the specified base to one or more Unicode characters in the given buffer. Registers a callback routine with a previously created or opened callback object, so that the caller can be notified when conditions defined for the callback routine occur.
Registers device functionality a device interface that a driver can enable for use by applications or other system components. Sets the access allowed to a given file object representing a device. Checks whether a request to open a file object specifies a desired access that is compatible with the current shared access permissions for the open file object. Modifies the current shared access permissions on the given file object.
Restores the shared access permissions on the given file object that were modified by a preceding call to IoUpdateShareAccess. Initializes a new security descriptor to an absolute format with default values in effect, with no security constraints. Builds a security descriptor for a new object, given the security descriptor of its parent directory if any and an originally requested security for the object. Deallocates the memory associated with a security descriptor that was created with SeAssignSecurity.
Returns a Boolean value indicating whether the requested access rights can be granted to an object protected by a security descriptor and, possibly, a current owner. Returns a Boolean value indicating whether the current thread has at least the given privilege level. Allocates and initializes an error log packet; returns a pointer so the caller can supply error log data and call IoWriteErrorLogEntry with the packet.
Queues a previously allocated error log packet, filled in by the driver, to the system error logging thread.
0コメント