杀毒

开发平台：
Visual C++

ntdll.h：源码内容
							typedef LONG NTSTATUS;
#define   OBJ_INHERIT  0x02
#define   STATUS_SUCCESS  0x0
#define   DUPLICATE_SAME_ATTRIBUTES  0x04
#define NT_SUCCESS(status)      ((NTSTATUS)(status)>=0)
typedef enum _SYSTEM_INFORMATION_CLASS     //    Q S
{
    SystemBasicInformation,                // 00 Y N
    SystemProcessorInformation,            // 01 Y N
    SystemPerformanceInformation,          // 02 Y N
    SystemTimeOfDayInformation,            // 03 Y N
    SystemNotImplemented1,                 // 04 Y N
    SystemProcessesAndThreadsInformation,  // 05 Y N
    SystemCallCounts,                      // 06 Y N
    SystemConfigurationInformation,        // 07 Y N
    SystemProcessorTimes,                  // 08 Y N
    SystemGlobalFlag,                      // 09 Y Y
    SystemNotImplemented2,                 // 10 Y N
    SystemModuleInformation,               // 11 Y N
    SystemLockInformation,                 // 12 Y N
    SystemNotImplemented3,                 // 13 Y N
    SystemNotImplemented4,                 // 14 Y N
    SystemNotImplemented5,                 // 15 Y N
    SystemHandleInformation,               // 16 Y N
    SystemObjectInformation,               // 17 Y N
    SystemPagefileInformation,             // 18 Y N
    SystemInstructionEmulationCounts,      // 19 Y N
    SystemInvalidInfoClass1,               // 20
    SystemCacheInformation,                // 21 Y Y
    SystemPoolTagInformation,              // 22 Y N
    SystemProcessorStatistics,             // 23 Y N
    SystemDpcInformation,                  // 24 Y Y
    SystemNotImplemented6,                 // 25 Y N
    SystemLoadImage,                       // 26 N Y
    SystemUnloadImage,                     // 27 N Y
    SystemTimeAdjustment,                  // 28 Y Y
    SystemNotImplemented7,                 // 29 Y N
    SystemNotImplemented8,                 // 30 Y N
    SystemNotImplemented9,                 // 31 Y N
    SystemCrashDumpInformation,            // 32 Y N
    SystemExceptionInformation,            // 33 Y N
    SystemCrashDumpStateInformation,       // 34 Y Y/N
    SystemKernelDebuggerInformation,       // 35 Y N
    SystemContextSwitchInformation,        // 36 Y N
    SystemRegistryQuotaInformation,        // 37 Y Y
    SystemLoadAndCallImage,                // 38 N Y
    SystemPrioritySeparation,              // 39 N Y
    SystemNotImplemented10,                // 40 Y N
    SystemNotImplemented11,                // 41 Y N
    SystemInvalidInfoClass2,               // 42
    SystemInvalidInfoClass3,               // 43
    SystemTimeZoneInformation,             // 44 Y N
    SystemLookasideInformation,            // 45 Y N
    SystemSetTimeSlipEvent,                // 46 N Y
    SystemCreateSession,                   // 47 N Y
    SystemDeleteSession,                   // 48 N Y
    SystemInvalidInfoClass4,               // 49
    SystemRangeStartInformation,           // 50 Y N
    SystemVerifierInformation,             // 51 Y Y
    SystemAddVerifier,                     // 52 N Y
    SystemSessionProcessesInformation      // 53 Y N
} SYSTEM_INFORMATION_CLASS;
typedef struct _SYSTEM_MODULE_INFORMATION  // Information Class 11
{
    ULONG  Reserved[2];
    PVOID  Base;
    ULONG  Size;
    ULONG  Flags;
    USHORT Index;
    USHORT Unknown;
    USHORT LoadCount;
    USHORT ModuleNameOffset;
    CHAR   ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
typedef struct _SYSTEM_HANDLE_INFORMATION 
{
	ULONG ProcessId;
	UCHAR ObjectTypeNumber;
	UCHAR Flags;
	USHORT Handle;
	ULONG Object;
	ACCESS_MASK GrantedAccess;
}SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
typedef struct _CLIENT_ID
{
	HANDLE  UniqueProcess;
	HANDLE  UniqueThread;
}CLIENT_ID,*PCLIENT_ID;
typedef struct _UNICODE_STRING {
  USHORT  Length;
  USHORT  MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
    ULONG  Length;
    HANDLE  RootDirectory;
    PUNICODE_STRING  ObjectName;
    ULONG  Attributes;
    PVOID  SecurityDescriptor;
    PVOID  SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _SYSTEM_HANDLE_INFORMATION_EX 
{
	ULONG NumberOfHandles;
	SYSTEM_HANDLE_INFORMATION Information[1];
}SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
typedef 
NTSTATUS 
( __stdcall *ZWQUERYSYSTEMINFORMATION ) 
                                      ( 
									  IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 
									  IN OUT PVOID SystemInformation, 
									  IN ULONG SystemInformationLength, 
									  OUT PULONG ReturnLength OPTIONAL 
									  );
static ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = NULL;
#define STATUS_INFO_LENGTH_MISMATCH  0xC0000004
typedef struct _TIME_FIELDS {
    short  Year;        // range [1601...]
    short  Month;       // range [1..12]
    short  Day;         // range [1..31]
    short  Hour;        // range [0..23]
    short  Minute;      // range [0..59]
    short  Second;      // range [0..59]
    short  Milliseconds;// range [0..999]
    short  Weekday;     // range [0..6] == [Sunday..Saturday]
} TIME_FIELDS;
//typedef TIME_FIELDS *PTIME_FIELDS;
typedef struct _DIRECTORY_INFO{
       char FileName[50];      
	   LARGE_INTEGER  AllocationSize;
       TIME_FIELDS    CreationTime;
        TIME_FIELDS    LastAccessTime ; 
		TIME_FIELDS             LastWriteTime;  
		TIME_FIELDS			   ChangeTime; 	
        ULONG     FileAttributes ;    
}DIRECTORY_INFO ,*PDIRECTORY_INFO ;
typedef struct _IOFCOM_CODE
{
	unsigned int  a;
	ULONG   b;
	BYTE   c;
}IOFCOM_CODE,*PIOFCOM_CODE;
typedef struct _PROCESS_BASIC_INFORMATION {
    PVOID Reserved1;
    ULONG PebBaseAddress;
    PVOID Reserved2[2];
    ULONG UniqueProcessId;
    PVOID Reserved3;
} PROCESS_BASIC_INFORMATION;
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO{
        int  UniqueProcessId;
        int  CreatorBackTraceIndex;
        byte  ObjectTypeIndex;
        byte  HandleAttributes;
        int   HandleValue ;
        ULONG  pObject;
        ULONG GrantedAccess;
}SYSTEM_HANDLE_TABLE_ENTRY_INFO,*PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;

						