- Removed oldshell version of `t` (types) commands - Removed `tk` command because types storage switched to the hashtable - Added `tfc` command to show the calling convention of the function or set it - Added `tsl` (RZ_OUTPUT_MODE_LONG) to show structure members' sizes and offsets - Added `tul` (RZ_OUTPUT_MODE_LONG) to show union members' sizes - Switched the types storage to the hashtable instead of SDB - Added load and export from/to SDB for standard type libraries and serialization for Projects - Changed all `char *type` occurences to the proper `RzType` - Added `RzCallable` type for the function/class method types - Changed all function types API to use the `RzCallable` API - Switched the function types (`RzCallable`) storage to the hashtable instead of SDB - Added a connection between `RzAnalysisFunction` and `RzCallable` - `rz_analysis_function_derive_type()` API function to derive new `RzCallable` type from the `RzAnalysisFunction` even if it doesn't exist in the RzTypeDB. - Moved type links to the RzAnalysis where they belong - Removed TCC and MPC-based parsers - Added Tree-Sitter-based parser for C grammar (see `librz/type/parser/*`) - Reworked type databases in `librz/analysis/d/` to be consistent with C standard, libc, platform-specific definitions - Switched the type links from `char *` to `RzType` - Switched the type links from SDB to the hashtable - Added concept of the "type paths", e.g. `a.b[20].c` where `b` is a member of `a` (`a` is either structure or a union) and `c` is a member of `b`, and `b` is an array where we take 20-th element. - Added concept of the typeclasses (a bit similar to Haskell) for numerical types: `None` (the most generic one), `Num` (includes `Integral` and `Floating`), `Integral` (includes `Signed Integral` and `Unsigned Integral`), `Floating`. - Added concept of type equality (`rz_types_equal(a, b)` API function) - Added Doxygen documentation to every API function in the `librz/type/*`. - Updated the project format from **V2** to **V3**, added migration.
385 lines
13 KiB
Text
385 lines
13 KiB
Text
### psapi.h ###
|
|
|
|
EmptyWorkingSet=func
|
|
func.EmptyWorkingSet.args=1
|
|
func.EmptyWorkingSet.arg.0=HANDLE,hProcess
|
|
func.EmptyWorkingSet.ret=BOOL
|
|
|
|
EnumDeviceDrivers=func
|
|
func.EnumDeviceDrivers.args=3
|
|
func.EnumDeviceDrivers.arg.0=LPVOID *,lpImageBase
|
|
func.EnumDeviceDrivers.arg.1=DWORD,cb
|
|
func.EnumDeviceDrivers.arg.2=LPDWORD,lpcbNeeded
|
|
func.EnumDeviceDrivers.ret=BOOL
|
|
|
|
EnumPageFilesA=func
|
|
func.EnumPageFilesA.args=2
|
|
func.EnumPageFilesA.arg.0=PENUM_PAGE_FILE_CALLBACKA,pCallBackRoutine
|
|
func.EnumPageFilesA.arg.1=LPVOID,pContext
|
|
func.EnumPageFilesA.ret=BOOL
|
|
|
|
EnumPageFilesW=func
|
|
func.EnumPageFilesW.args=2
|
|
func.EnumPageFilesW.arg.0=PENUM_PAGE_FILE_CALLBACKW,pCallBackRoutine
|
|
func.EnumPageFilesW.arg.1=LPVOID,pContext
|
|
func.EnumPageFilesW.ret=BOOL
|
|
|
|
EnumProcesses=func
|
|
func.EnumProcesses.args=3
|
|
func.EnumProcesses.arg.0=DWORD *,lpidProcess
|
|
func.EnumProcesses.arg.1=DWORD,cb
|
|
func.EnumProcesses.arg.2=LPDWORD,lpcbNeeded
|
|
func.EnumProcesses.ret=BOOL
|
|
|
|
EnumProcessModules=func
|
|
func.EnumProcessModules.args=4
|
|
func.EnumProcessModules.arg.0=HANDLE,hProcess
|
|
func.EnumProcessModules.arg.1=HMODULE *,lphModule
|
|
func.EnumProcessModules.arg.2=DWORD,cb
|
|
func.EnumProcessModules.arg.3=LPDWORD,lpcbNeeded
|
|
func.EnumProcessModules.ret=BOOL
|
|
|
|
EnumProcessModulesEx=func
|
|
func.EnumProcessModulesEx.args=5
|
|
func.EnumProcessModulesEx.arg.0=HANDLE,hProcess
|
|
func.EnumProcessModulesEx.arg.1=HMODULE *,lphModule
|
|
func.EnumProcessModulesEx.arg.2=DWORD,cb
|
|
func.EnumProcessModulesEx.arg.3=LPDWORD,lpcbNeeded
|
|
func.EnumProcessModulesEx.arg.4=DWORD,dwFilterFlag
|
|
func.EnumProcessModulesEx.ret=BOOL
|
|
|
|
GetDeviceDriverBaseNameA=func
|
|
func.GetDeviceDriverBaseNameA.args=3
|
|
func.GetDeviceDriverBaseNameA.arg.0=LPVOID,ImageBase
|
|
func.GetDeviceDriverBaseNameA.arg.1=LPSTR,lpFilename
|
|
func.GetDeviceDriverBaseNameA.arg.2=DWORD,nSize
|
|
func.GetDeviceDriverBaseNameA.ret=DWORD
|
|
|
|
GetDeviceDriverBaseNameW=func
|
|
func.GetDeviceDriverBaseNameW.args=3
|
|
func.GetDeviceDriverBaseNameW.arg.0=LPVOID,ImageBase
|
|
func.GetDeviceDriverBaseNameW.arg.1=LPWSTR,lpBaseName
|
|
func.GetDeviceDriverBaseNameW.arg.2=DWORD,nSize
|
|
func.GetDeviceDriverBaseNameW.ret=DWORD
|
|
|
|
GetDeviceDriverFileNameA=func
|
|
func.GetDeviceDriverFileNameA.args=3
|
|
func.GetDeviceDriverFileNameA.arg.0=LPVOID,ImageBase
|
|
func.GetDeviceDriverFileNameA.arg.1=LPSTR,lpFilename
|
|
func.GetDeviceDriverFileNameA.arg.2=DWORD,nSize
|
|
func.GetDeviceDriverFileNameA.ret=DWORD
|
|
|
|
GetDeviceDriverFileNameW=func
|
|
func.GetDeviceDriverFileNameW.args=3
|
|
func.GetDeviceDriverFileNameW.arg.0=LPVOID,ImageBase
|
|
func.GetDeviceDriverFileNameW.arg.1=LPWSTR,lpFilename
|
|
func.GetDeviceDriverFileNameW.arg.2=DWORD,nSize
|
|
func.GetDeviceDriverFileNameW.ret=DWORD
|
|
|
|
GetMappedFileNameA=func
|
|
func.GetMappedFileNameA.args=4
|
|
func.GetMappedFileNameA.arg.0=HANDLE,hProcess
|
|
func.GetMappedFileNameA.arg.1=LPVOID,lpv
|
|
func.GetMappedFileNameA.arg.2=LPSTR,lpFilename
|
|
func.GetMappedFileNameA.arg.3=DWORD,nSize
|
|
func.GetMappedFileNameA.ret=DWORD
|
|
|
|
GetMappedFileNameW=func
|
|
func.GetMappedFileNameW.args=4
|
|
func.GetMappedFileNameW.arg.0=HANDLE,hProcess
|
|
func.GetMappedFileNameW.arg.1=LPVOID,lpv
|
|
func.GetMappedFileNameW.arg.2=LPWSTR,lpFilename
|
|
func.GetMappedFileNameW.arg.3=DWORD,nSize
|
|
func.GetMappedFileNameW.ret=DWORD
|
|
|
|
GetModuleBaseNameA=func
|
|
func.GetModuleBaseNameA.args=4
|
|
func.GetModuleBaseNameA.arg.0=HANDLE,hProcess
|
|
func.GetModuleBaseNameA.arg.1=HMODULE,hModule
|
|
func.GetModuleBaseNameA.arg.2=LPSTR,lpBaseName
|
|
func.GetModuleBaseNameA.arg.3=DWORD,nSize
|
|
func.GetModuleBaseNameA.ret=DWORD
|
|
|
|
GetModuleBaseNameW=func
|
|
func.GetModuleBaseNameW.args=4
|
|
func.GetModuleBaseNameW.arg.0=HANDLE,hProcess
|
|
func.GetModuleBaseNameW.arg.1=HMODULE,hModule
|
|
func.GetModuleBaseNameW.arg.2=LPWSTR,lpBaseName
|
|
func.GetModuleBaseNameW.arg.3=DWORD,nSize
|
|
func.GetModuleBaseNameW.ret=DWORD
|
|
|
|
GetModuleFileNameExA=func
|
|
func.GetModuleFileNameExA.args=4
|
|
func.GetModuleFileNameExA.arg.0=HANDLE,hProcess
|
|
func.GetModuleFileNameExA.arg.1=HMODULE,hModule
|
|
func.GetModuleFileNameExA.arg.2=LPSTR,lpFilename
|
|
func.GetModuleFileNameExA.arg.3=DWORD,nSize
|
|
func.GetModuleFileNameExA.ret=DWORD
|
|
|
|
GetModuleFileNameExW=func
|
|
func.GetModuleFileNameExW.args=4
|
|
func.GetModuleFileNameExW.arg.0=HANDLE,hProcess
|
|
func.GetModuleFileNameExW.arg.1=HMODULE,hModule
|
|
func.GetModuleFileNameExW.arg.2=LPWSTR,lpFilename
|
|
func.GetModuleFileNameExW.arg.3=DWORD,nSize
|
|
func.GetModuleFileNameExW.ret=DWORD
|
|
|
|
GetModuleInformation=func
|
|
func.GetModuleInformation.args=4
|
|
func.GetModuleInformation.arg.0=HANDLE,hProcess
|
|
func.GetModuleInformation.arg.1=HMODULE,hModule
|
|
func.GetModuleInformation.arg.2=LPMODULEINFO,lpmodinfo
|
|
func.GetModuleInformation.arg.3=DWORD,cb
|
|
func.GetModuleInformation.ret=BOOL
|
|
|
|
GetPerformanceInfo=func
|
|
func.GetPerformanceInfo.args=2
|
|
func.GetPerformanceInfo.arg.0=PPERFORMANCE_INFORMATION,pPerformanceInformation
|
|
func.GetPerformanceInfo.arg.1=DWORD,cb
|
|
func.GetPerformanceInfo.ret=BOOL
|
|
|
|
GetProcessImageFileNameA=func
|
|
func.GetProcessImageFileNameA.args=3
|
|
func.GetProcessImageFileNameA.arg.0=HANDLE,hProcess
|
|
func.GetProcessImageFileNameA.arg.1=LPSTR,lpImageFileName
|
|
func.GetProcessImageFileNameA.arg.2=DWORD,nSize
|
|
func.GetProcessImageFileNameA.ret=DWORD
|
|
|
|
GetProcessImageFileNameW=func
|
|
func.GetProcessImageFileNameW.args=3
|
|
func.GetProcessImageFileNameW.arg.0=HANDLE,hProcess
|
|
func.GetProcessImageFileNameW.arg.1=LPWSTR,lpImageFileName
|
|
func.GetProcessImageFileNameW.arg.2=DWORD,nSize
|
|
func.GetProcessImageFileNameW.ret=DWORD
|
|
|
|
GetProcessMemoryInfo=func
|
|
func.GetProcessMemoryInfo.args=3
|
|
func.GetProcessMemoryInfo.arg.0=HANDLE,Process
|
|
func.GetProcessMemoryInfo.arg.1=PPROCESS_MEMORY_COUNTERS,ppsmemCounters
|
|
func.GetProcessMemoryInfo.arg.2=DWORD,cb
|
|
func.GetProcessMemoryInfo.ret=BOOL
|
|
|
|
GetWsChanges=func
|
|
func.GetWsChanges.args=3
|
|
func.GetWsChanges.arg.0=HANDLE,hProcess
|
|
func.GetWsChanges.arg.1=PPSAPI_WS_WATCH_INFORMATION,lpWatchInfo
|
|
func.GetWsChanges.arg.2=DWORD,cb
|
|
func.GetWsChanges.ret=BOOL
|
|
|
|
GetWsChangesEx=func
|
|
func.GetWsChangesEx.args=3
|
|
func.GetWsChangesEx.arg.0=HANDLE,hProcess
|
|
func.GetWsChangesEx.arg.1=PPSAPI_WS_WATCH_INFORMATION_EX,lpWatchInfoEx
|
|
func.GetWsChangesEx.arg.2=PDWORD,cb
|
|
func.GetWsChangesEx.ret=BOOL
|
|
|
|
InitializeProcessForWsWatch=func
|
|
func.InitializeProcessForWsWatch.args=1
|
|
func.InitializeProcessForWsWatch.arg.0=HANDLE,hProcess
|
|
func.InitializeProcessForWsWatch.ret=BOOL
|
|
|
|
QueryWorkingSet=func
|
|
func.QueryWorkingSet.args=3
|
|
func.QueryWorkingSet.arg.0=HANDLE,hProcess
|
|
func.QueryWorkingSet.arg.1=PVOID,pv
|
|
func.QueryWorkingSet.arg.2=DWORD,cb
|
|
func.QueryWorkingSet.ret=BOOL
|
|
|
|
QueryWorkingSetEx=func
|
|
func.QueryWorkingSetEx.args=3
|
|
func.QueryWorkingSetEx.arg.0=HANDLE,hProcess
|
|
func.QueryWorkingSetEx.arg.1=PVOID,pv
|
|
func.QueryWorkingSetEx.arg.2=DWORD,cb
|
|
func.QueryWorkingSetEx.ret=BOOL
|
|
|
|
K32EmptyWorkingSet=func
|
|
func.K32EmptyWorkingSet.args=1
|
|
func.K32EmptyWorkingSet.arg.0=HANDLE,hProcess
|
|
func.K32EmptyWorkingSet.ret=BOOL
|
|
|
|
K32EnumDeviceDrivers=func
|
|
func.K32EnumDeviceDrivers.args=3
|
|
func.K32EnumDeviceDrivers.arg.0=LPVOID *,lpImageBase
|
|
func.K32EnumDeviceDrivers.arg.1=DWORD,cb
|
|
func.K32EnumDeviceDrivers.arg.2=LPDWORD,lpcbNeeded
|
|
func.K32EnumDeviceDrivers.ret=BOOL
|
|
|
|
K32EnumPageFilesA=func
|
|
func.K32EnumPageFilesA.args=2
|
|
func.K32EnumPageFilesA.arg.0=PENUM_PAGE_FILE_CALLBACKA,pCallBackRoutine
|
|
func.K32EnumPageFilesA.arg.1=LPVOID,pContext
|
|
func.K32EnumPageFilesA.ret=BOOL
|
|
|
|
K32EnumPageFilesW=func
|
|
func.K32EnumPageFilesW.args=2
|
|
func.K32EnumPageFilesW.arg.0=PENUM_PAGE_FILE_CALLBACKW,pCallBackRoutine
|
|
func.K32EnumPageFilesW.arg.1=LPVOID,pContext
|
|
func.K32EnumPageFilesW.ret=BOOL
|
|
|
|
K32EnumProcesses=func
|
|
func.K32EnumProcesses.args=3
|
|
func.K32EnumProcesses.arg.0=DWORD *,lpidProcess
|
|
func.K32EnumProcesses.arg.1=DWORD,cb
|
|
func.K32EnumProcesses.arg.2=LPDWORD,lpcbNeeded
|
|
func.K32EnumProcesses.ret=BOOL
|
|
|
|
K32EnumProcessModules=func
|
|
func.K32EnumProcessModules.args=4
|
|
func.K32EnumProcessModules.arg.0=HANDLE,hProcess
|
|
func.K32EnumProcessModules.arg.1=HMODULE *,lphModule
|
|
func.K32EnumProcessModules.ret=BOOL
|
|
func.K32EnumProcessModules.arg.2=DWORD,cb
|
|
func.K32EnumProcessModules.arg.3=LPDWORD,lpcbNeeded
|
|
|
|
K32EnumProcessModulesEx=func
|
|
func.K32EnumProcessModulesEx.args=5
|
|
func.K32EnumProcessModulesEx.arg.0=HANDLE,hProcess
|
|
func.K32EnumProcessModulesEx.arg.1=HMODULE *,lphModule
|
|
func.K32EnumProcessModulesEx.arg.2=DWORD,cb
|
|
func.K32EnumProcessModulesEx.arg.3=LPDWORD,lpcbNeeded
|
|
func.K32EnumProcessModulesEx.arg.4=DWORD,dwFilterFlag
|
|
func.K32EnumProcessModulesEx.ret=BOOL
|
|
|
|
K32GetDeviceDriverBaseNameA=func
|
|
func.K32GetDeviceDriverBaseNameA.args=3
|
|
func.K32GetDeviceDriverBaseNameA.arg.0=LPVOID,ImageBase
|
|
func.K32GetDeviceDriverBaseNameA.arg.1=LPSTR,lpFilename
|
|
func.K32GetDeviceDriverBaseNameA.arg.2=DWORD,nSize
|
|
func.K32GetDeviceDriverBaseNameA.ret=DWORD
|
|
|
|
K32GetDeviceDriverBaseNameW=func
|
|
func.K32GetDeviceDriverBaseNameW.args=3
|
|
func.K32GetDeviceDriverBaseNameW.arg.0=LPVOID,ImageBase
|
|
func.K32GetDeviceDriverBaseNameW.arg.1=LPWSTR,lpBaseName
|
|
func.K32GetDeviceDriverBaseNameW.arg.2=DWORD,nSize
|
|
func.K32GetDeviceDriverBaseNameW.ret=DWORD
|
|
|
|
K32GetDeviceDriverFileNameA=func
|
|
func.K32GetDeviceDriverFileNameA.args=3
|
|
func.K32GetDeviceDriverFileNameA.arg.0=LPVOID,ImageBase
|
|
func.K32GetDeviceDriverFileNameA.arg.1=LPSTR,lpFilename
|
|
func.K32GetDeviceDriverFileNameA.arg.2=DWORD,nSize
|
|
func.K32GetDeviceDriverFileNameA.ret=DWORD
|
|
|
|
K32GetDeviceDriverFileNameW=func
|
|
func.K32GetDeviceDriverFileNameW.args=3
|
|
func.K32GetDeviceDriverFileNameW.arg.0=LPVOID,ImageBase
|
|
func.K32GetDeviceDriverFileNameW.arg.1=LPWSTR,lpFilename
|
|
func.K32GetDeviceDriverFileNameW.arg.2=DWORD,nSize
|
|
func.K32GetDeviceDriverFileNameW.ret=DWORD
|
|
|
|
K32GetMappedFileNameA=func
|
|
func.K32GetMappedFileNameA.args=4
|
|
func.K32GetMappedFileNameA.arg.0=HANDLE,hProcess
|
|
func.K32GetMappedFileNameA.arg.1=LPVOID,lpv
|
|
func.K32GetMappedFileNameA.arg.2=LPSTR,lpFilename
|
|
func.K32GetMappedFileNameA.arg.3=DWORD,nSize
|
|
func.K32GetMappedFileNameA.ret=DWORD
|
|
|
|
K32GetMappedFileNameW=func
|
|
func.K32GetMappedFileNameW.args=4
|
|
func.K32GetMappedFileNameW.arg.0=HANDLE,hProcess
|
|
func.K32GetMappedFileNameW.arg.1=LPVOID,lpv
|
|
func.K32GetMappedFileNameW.arg.2=LPWSTR,lpFilename
|
|
func.K32GetMappedFileNameW.arg.3=DWORD,nSize
|
|
func.K32GetMappedFileNameW.ret=DWORD
|
|
|
|
K32GetModuleBaseNameA=func
|
|
func.K32GetModuleBaseNameA.args=4
|
|
func.K32GetModuleBaseNameA.arg.0=HANDLE,hProcess
|
|
func.K32GetModuleBaseNameA.arg.1=HMODULE,hModule
|
|
func.K32GetModuleBaseNameA.arg.2=LPSTR,lpBaseName
|
|
func.K32GetModuleBaseNameA.arg.3=DWORD,nSize
|
|
func.K32GetModuleBaseNameA.ret=DWORD
|
|
|
|
K32GetModuleBaseNameW=func
|
|
func.K32GetModuleBaseNameW.args=4
|
|
func.K32GetModuleBaseNameW.arg.0=HANDLE,hProcess
|
|
func.K32GetModuleBaseNameW.arg.1=HMODULE,hModule
|
|
func.K32GetModuleBaseNameW.arg.2=LPWSTR,lpBaseName
|
|
func.K32GetModuleBaseNameW.arg.3=DWORD,nSize
|
|
func.K32GetModuleBaseNameW.ret=DWORD
|
|
|
|
K32GetModuleFileNameExA=func
|
|
func.K32GetModuleFileNameExA.args=4
|
|
func.K32GetModuleFileNameExA.arg.0=HANDLE,hProcess
|
|
func.K32GetModuleFileNameExA.arg.1=HMODULE,hModule
|
|
func.K32GetModuleFileNameExA.arg.2=LPSTR,lpFilename
|
|
func.K32GetModuleFileNameExA.arg.3=DWORD,nSize
|
|
func.K32GetModuleFileNameExA.ret=DWORD
|
|
|
|
K32GetModuleFileNameExW=func
|
|
func.K32GetModuleFileNameExW.args=4
|
|
func.K32GetModuleFileNameExW.arg.0=HANDLE,hProcess
|
|
func.K32GetModuleFileNameExW.arg.1=HMODULE,hModule
|
|
func.K32GetModuleFileNameExW.arg.2=LPWSTR,lpFilename
|
|
func.K32GetModuleFileNameExW.arg.3=DWORD,nSize
|
|
func.K32GetModuleFileNameExW.ret=DWORD
|
|
|
|
K32GetModuleInformation=func
|
|
func.K32GetModuleInformation.args=4
|
|
func.K32GetModuleInformation.arg.0=HANDLE,hProcess
|
|
func.K32GetModuleInformation.arg.1=HMODULE,hModule
|
|
func.K32GetModuleInformation.arg.2=LPMODULEINFO,lpmodinfo
|
|
func.K32GetModuleInformation.arg.3=DWORD,cb
|
|
func.K32GetModuleInformation.ret=BOOL
|
|
|
|
K32GetPerformanceInfo=func
|
|
func.K32GetPerformanceInfo.args=2
|
|
func.K32GetPerformanceInfo.arg.0=PPERFORMANCE_INFORMATION,pPerformanceInformation
|
|
func.K32GetPerformanceInfo.arg.1=DWORD,cb
|
|
func.K32GetPerformanceInfo.ret=BOOL
|
|
|
|
K32GetProcessImageFileNameA=func
|
|
func.K32GetProcessImageFileNameA.args=3
|
|
func.K32GetProcessImageFileNameA.arg.0=HANDLE,hProcess
|
|
func.K32GetProcessImageFileNameA.arg.1=LPSTR,lpImageFileName
|
|
func.K32GetProcessImageFileNameA.arg.2=DWORD,nSize
|
|
func.K32GetProcessImageFileNameA.ret=DWORD
|
|
|
|
K32GetProcessImageFileNameW=func
|
|
func.K32GetProcessImageFileNameW.args=3
|
|
func.K32GetProcessImageFileNameW.arg.0=HANDLE,hProcess
|
|
func.K32GetProcessImageFileNameW.arg.1=LPWSTR,lpImageFileName
|
|
func.K32GetProcessImageFileNameW.arg.2=DWORD,nSize
|
|
func.K32GetProcessImageFileNameW.ret=DWORD
|
|
|
|
K32GetProcessMemoryInfo=func
|
|
func.K32GetProcessMemoryInfo.args=3
|
|
func.K32GetProcessMemoryInfo.arg.0=HANDLE,Process
|
|
func.K32GetProcessMemoryInfo.arg.1=PPROCESS_MEMORY_COUNTERS,ppsmemCounters
|
|
func.K32GetProcessMemoryInfo.arg.2=DWORD,cb
|
|
func.K32GetProcessMemoryInfo.ret=BOOL
|
|
|
|
K32GetWsChanges=func
|
|
func.K32GetWsChanges.args=3
|
|
func.K32GetWsChanges.arg.0=HANDLE,hProcess
|
|
func.K32GetWsChanges.arg.1=PPSAPI_WS_WATCH_INFORMATION,lpWatchInfo
|
|
func.K32GetWsChanges.arg.2=DWORD,cb
|
|
func.K32GetWsChanges.ret=BOOL
|
|
|
|
K32GetWsChangesEx=func
|
|
func.K32GetWsChangesEx.args=3
|
|
func.K32GetWsChangesEx.arg.0=HANDLE,hProcess
|
|
func.K32GetWsChangesEx.arg.1=PPSAPI_WS_WATCH_INFORMATION_EX,lpWatchInfoEx
|
|
func.K32GetWsChangesEx.arg.2=PDWORD,cb
|
|
func.K32GetWsChangesEx.ret=BOOL
|
|
|
|
K32InitializeProcessForWsWatch=func
|
|
func.K32InitializeProcessForWsWatch.args=1
|
|
func.K32InitializeProcessForWsWatch.arg.0=HANDLE,hProcess
|
|
func.K32InitializeProcessForWsWatch.ret=BOOL
|
|
|
|
K32QueryWorkingSet=func
|
|
func.K32QueryWorkingSet.args=3
|
|
func.K32QueryWorkingSet.arg.0=HANDLE,hProcess
|
|
func.K32QueryWorkingSet.arg.1=PVOID,pv
|
|
func.K32QueryWorkingSet.arg.2=DWORD,cb
|
|
func.K32QueryWorkingSet.ret=BOOL
|
|
|
|
K32QueryWorkingSetEx=func
|
|
func.K32QueryWorkingSetEx.args=3
|
|
func.K32QueryWorkingSetEx.arg.0=HANDLE,hProcess
|
|
func.K32QueryWorkingSetEx.arg.1=PVOID,pv
|
|
func.K32QueryWorkingSetEx.arg.2=DWORD,cb
|
|
func.K32QueryWorkingSetEx.ret=BOOL
|