Many new prototypes.

include/ntddk.h

@@ -7,8 +7,12 @@
 #define __WINE_NTDDK_H
 
 #include <ntdef.h>
+#include <winnt.h>
+#include "winbase.h"	/* fixme: should be taken out sometimes */
 
-/* end fixme */
+#ifdef __cplusplus
+extern "C" {
+#endif
 
 /****************** 
  * asynchronous I/O 
@@ -39,37 +43,6 @@ typedef enum _KEY_VALUE_INFORMATION_CLASS {
 	KeyValuePartialInformationAlign64
 } KEY_VALUE_INFORMATION_CLASS;
 
-typedef enum _PROCESSINFOCLASS 
-{	ProcessBasicInformation,
-	ProcessQuotaLimits,
-	ProcessIoCounters,
-	ProcessVmCounters,
-	ProcessTimes,
-	ProcessBasePriority,
-	ProcessRaisePriority,
-	ProcessDebugPort,
-	ProcessExceptionPort,
-	ProcessAccessToken,
-	ProcessLdtInformation,
-	ProcessLdtSize,
-	ProcessDefaultHardErrorMode,
-	ProcessIoPortHandlers,
-	ProcessPooledUsageAndLimits,
-	ProcessWorkingSetWatch,
-	ProcessUserModeIOPL,
-	ProcessEnableAlignmentFaultFixup,
-	ProcessPriorityClass,
-	ProcessWx86Information,
-	ProcessHandleCount,
-	ProcessAffinityMask,
-	ProcessPriorityBoost,
-	ProcessDeviceMap,
-	ProcessSessionInformation,
-	ProcessForegroundInformation,
-	ProcessWow64Information,
-	MaxProcessInfoClass
-} PROCESSINFOCLASS;
-
 typedef enum _THREADINFOCLASS 
 {	ThreadBasicInformation,
 	ThreadTimes,
@@ -132,24 +105,97 @@ typedef enum _FILE_INFORMATION_CLASS {
 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
 
 typedef enum _SECTION_INHERIT 
-{	ViewShare = 1,
+{
+	ViewShare = 1,
 	ViewUnmap = 2
+
 } SECTION_INHERIT;
  
 /*
 	placeholder
 */
 typedef enum _OBJECT_INFORMATION_CLASS
-{	DunnoTheConstants1
+{
+	DunnoTheConstants1
+
 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
 
+
+/*
+ *	NtQuerySystemInformation
+ */
+
 typedef enum SYSTEM_INFORMATION_CLASS
-{	DunnoTheConstants2
+{	Unknown1 = 1,
+	Unknown2,
+	Unknown3,
+	Unknown4,
+	SystemPerformanceInformation
 } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
 
+/* reading coffee grounds... */
+typedef struct _THREAD_INFO
+{	DWORD	Unknown1[6];
+	DWORD	ThreadID;
+	DWORD	Unknown2[3];
+	DWORD	Status;
+	DWORD	WaitReason;
+	DWORD	Unknown3[4];
+} THREAD_INFO, PTHREAD_INFO;
+
+typedef struct _VM_COUNTERS_
+{	ULONG PeakVirtualSize;
+	ULONG VirtualSize;
+	ULONG PageFaultCount;
+	ULONG PeakWorkingSetSize;
+	ULONG WorkingSetSize;
+	ULONG QuotaPeakPagedPoolUsage;
+	ULONG QuotaPagedPoolUsage;
+	ULONG QuotaPeakNonPagedPoolUsage;
+	ULONG QuotaNonPagedPoolUsage;
+	ULONG PagefileUsage;
+	ULONG PeakPagefileUsage;
+} VM_COUNTERS, *PVM_COUNTERS;
+
+typedef struct _PROCESS_INFO
+{	DWORD		Offset;		/* 00 offset to next PROCESS_INFO ok*/
+	DWORD		ThreadCount;	/* 04 number of ThreadInfo member ok */
+	DWORD		Unknown1[6];
+	FILETIME	CreationTime;	/* 20 */
+	DWORD		Unknown2[5];
+	PWCHAR		ProcessName;	/* 3c ok */
+	DWORD		BasePriority;
+	DWORD		ProcessID;	/* 44 ok*/
+	DWORD		ParentProcessID;
+	DWORD		HandleCount;
+	DWORD		Unknown3[2];	/* 50 */
+	ULONG		PeakVirtualSize;
+	ULONG		VirtualSize;
+	ULONG		PageFaultCount;
+	ULONG		PeakWorkingSetSize;
+	ULONG		WorkingSetSize;
+	ULONG		QuotaPeakPagedPoolUsage;
+	ULONG		QuotaPagedPoolUsage;
+	ULONG		QuotaPeakNonPagedPoolUsage;
+	ULONG		QuotaNonPagedPoolUsage;
+	ULONG		PagefileUsage;
+	ULONG		PeakPagefileUsage;
+	DWORD		PrivateBytes;
+	DWORD		Unknown6[4];
+	THREAD_INFO 	ati[ANYSIZE_ARRAY];	/* 94 size=0x40*/
+} PROCESS_INFO, PPROCESS_INFO;
+
+NTSTATUS WINAPI NtQuerySystemInformation(
+	IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
+	OUT PVOID SystemInformation,
+	IN ULONG Length,
+	OUT PULONG ResultLength);
+
 /*
- *	NtQuerySystemInformation interface
+ *	system configuration
  */
+
+
 typedef struct _SYSTEM_TIME_ADJUSTMENT
 {
 	ULONG	TimeAdjustment;
@@ -191,17 +237,105 @@ typedef struct _SYSTEM_CACHE_INFORMATION
 } SYSTEM_CACHE_INFORMATION;
 
 /*
-	timer
-*/
+ *	NtQueryProcessInformation
+ */
+
+/* parameter ProcessInformationClass */
+
+typedef enum _PROCESSINFOCLASS 
+{	ProcessBasicInformation,
+	ProcessQuotaLimits,
+	ProcessIoCounters,
+	ProcessVmCounters,
+	ProcessTimes,
+	ProcessBasePriority,
+	ProcessRaisePriority,
+	ProcessDebugPort,
+	ProcessExceptionPort,
+	ProcessAccessToken,
+	ProcessLdtInformation,
+	ProcessLdtSize,
+	ProcessDefaultHardErrorMode,
+	ProcessIoPortHandlers,
+	ProcessPooledUsageAndLimits,
+	ProcessWorkingSetWatch,
+	ProcessUserModeIOPL,
+	ProcessEnableAlignmentFaultFixup,
+	ProcessPriorityClass,
+	ProcessWx86Information,
+	ProcessHandleCount,
+	ProcessAffinityMask,
+	ProcessPriorityBoost,
+	ProcessDeviceMap,
+	ProcessSessionInformation,
+	ProcessForegroundInformation,
+	ProcessWow64Information,
+	MaxProcessInfoClass
+} PROCESSINFOCLASS;
+
+/* parameter ProcessInformation (depending on ProcessInformationClass) */
+
+typedef struct _PROCESS_BASIC_INFORMATION 
+{	DWORD	ExitStatus;
+	DWORD	PebBaseAddress;
+	DWORD	AffinityMask;
+	DWORD	BasePriority;
+	ULONG	UniqueProcessId;
+	ULONG	InheritedFromUniqueProcessId;
+} PROCESS_BASIC_INFORMATION;
+
+NTSTATUS WINAPI NtQueryInformationProcess(
+	IN HANDLE ProcessHandle,
+	IN PROCESSINFOCLASS ProcessInformationClass,
+	OUT PVOID ProcessInformation,
+	IN ULONG ProcessInformationLength,
+	OUT PULONG ReturnLength);
+
+
+/*
+ *	timer
+ */
+
 typedef enum _TIMER_TYPE 
-{	NotificationTimer,
+{
+	NotificationTimer,
 	SynchronizationTimer
+
 } TIMER_TYPE;
 
-/*	##############################
-	######	SID FUNCTIONS	######
-	##############################
-*/
+/*
+ *	token functions
+ */
+ 
+NTSTATUS WINAPI NtOpenProcessToken(
+	HANDLE ProcessHandle,
+	DWORD DesiredAccess, 
+	HANDLE *TokenHandle);
+	
+NTSTATUS WINAPI NtOpenThreadToken(
+	HANDLE ThreadHandle,
+	DWORD DesiredAccess, 
+	BOOLEAN OpenAsSelf,
+	HANDLE *TokenHandle);
+
+NTSTATUS WINAPI NtAdjustPrivilegesToken(
+	IN HANDLE TokenHandle,
+	IN BOOLEAN DisableAllPrivileges,
+	IN PTOKEN_PRIVILEGES NewState,
+	IN DWORD BufferLength,
+	OUT PTOKEN_PRIVILEGES PreviousState,
+	OUT PDWORD ReturnLength);
+
+NTSTATUS WINAPI NtQueryInformationToken(
+	HANDLE token,
+	DWORD tokeninfoclass, 
+	LPVOID tokeninfo,
+	DWORD tokeninfolength,
+	LPDWORD retlen );
+
+/*
+ *	sid functions
+ */
 
 BOOLEAN WINAPI RtlAllocateAndInitializeSid (
 	PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
@@ -225,19 +359,21 @@ LPDWORD WINAPI RtlSubAuthoritySid(PSID PSID,DWORD nr);
 LPBYTE WINAPI RtlSubAuthorityCountSid(PSID PSID);
 DWORD WINAPI RtlCopySid(DWORD len,PSID to,PSID from);
 
-/*	##############################################
-	######	SECURITY DESCRIPTOR FUNCTIONS	######
-	##############################################
-*/
+/*
+ *	security descriptor functions
+ */
 
 NTSTATUS WINAPI RtlCreateSecurityDescriptor(
 	PSECURITY_DESCRIPTOR lpsd,
 	DWORD rev);
 
-BOOLEAN WINAPI RtlValidSecurityDescriptor(
+NTSTATUS WINAPI RtlValidSecurityDescriptor(
+	PSECURITY_DESCRIPTOR SecurityDescriptor);
+
+ULONG WINAPI RtlLengthSecurityDescriptor(
 	PSECURITY_DESCRIPTOR SecurityDescriptor);
 
-DWORD WINAPI RtlGetDaclSecurityDescriptor(
+NTSTATUS WINAPI RtlGetDaclSecurityDescriptor(
 	IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
 	OUT PBOOLEAN lpbDaclPresent,
 	OUT PACL *pDacl,
@@ -249,10 +385,13 @@ NTSTATUS WINAPI RtlSetDaclSecurityDescriptor (
 	PACL dacl,
 	BOOLEAN dacldefaulted );
 
-ULONG WINAPI RtlLengthSecurityDescriptor(
-	PSECURITY_DESCRIPTOR SecurityDescriptor);
+NTSTATUS WINAPI RtlGetSaclSecurityDescriptor(
+	IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
+	OUT PBOOLEAN lpbSaclPresent,
+	OUT PACL *pSacl,
+	OUT PBOOLEAN lpbSaclDefaulted);
 
-DWORD  WINAPI RtlSetSaclSecurityDescriptor (
+NTSTATUS WINAPI RtlSetSaclSecurityDescriptor (
 	PSECURITY_DESCRIPTOR lpsd,
 	BOOLEAN saclpresent,
 	PACL sacl,
@@ -287,21 +426,21 @@ DWORD WINAPI RtlCreateAcl(PACL acl,DWORD size,DWORD rev);
 
 BOOLEAN WINAPI RtlFirstFreeAce(
 	PACL acl,
-	LPACE_HEADER *x);
+	PACE_HEADER *x);
+
 NTSTATUS WINAPI RtlAddAce(
 	PACL acl,
 	DWORD rev,
 	DWORD xnrofaces,
-	LPACE_HEADER acestart,
+	PACE_HEADER acestart,
 	DWORD acelen);
 	
 DWORD WINAPI RtlAddAccessAllowedAce(DWORD x1,DWORD x2,DWORD x3,DWORD x4);
 DWORD WINAPI RtlGetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce );
 
-/*	######################################
-	######	STRING FUNCTIONS	######
-	######################################
-*/
+/*
+ *	string functions
+ */
 
 DWORD WINAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING uni,PANSI_STRING ansi,BOOLEAN doalloc);
 DWORD WINAPI RtlOemStringToUnicodeString(PUNICODE_STRING uni,PSTRING ansi,BOOLEAN doalloc);
@@ -322,17 +461,116 @@ UINT WINAPI RtlxAnsiStringToUnicodeSize(PANSI_STRING str);
 DWORD WINAPI RtlIsTextUnicode(LPVOID buf, DWORD len, DWORD *pf);
 NTSTATUS WINAPI RtlCompareUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive);
 
-/*	######################################
-	######	RESOURCE FUNCTIONS	######
-	######################################
+/*
+ *	resource functions
+ */
+
+typedef struct _RTL_RWLOCK {
+	CRITICAL_SECTION	rtlCS;
+	HANDLE		hSharedReleaseSemaphore;
+	UINT			uSharedWaiters;
+	HANDLE		hExclusiveReleaseSemaphore;
+	UINT			uExclusiveWaiters;
+	INT			iNumberActive;
+	HANDLE		hOwningThreadId;
+	DWORD			dwTimeoutBoost;
+	PVOID			pDebugInfo;
+} RTL_RWLOCK, *LPRTL_RWLOCK;
+
+VOID   WINAPI RtlInitializeResource(
+	LPRTL_RWLOCK);
+	
+VOID   WINAPI RtlDeleteResource(
+	LPRTL_RWLOCK);
+	
+BYTE   WINAPI RtlAcquireResourceExclusive(
+	LPRTL_RWLOCK, BYTE fWait);
+	
+BYTE   WINAPI RtlAcquireResourceShared(
+	LPRTL_RWLOCK, BYTE fWait);
+	
+VOID   WINAPI RtlReleaseResource(
+	LPRTL_RWLOCK);
+	
+VOID   WINAPI RtlDumpResource(
+	LPRTL_RWLOCK);
+
+/*
+	time functions
+ */
+
+typedef struct _TIME_FIELDS 
+{   CSHORT Year;
+    CSHORT Month;
+    CSHORT Day;
+    CSHORT Hour;
+    CSHORT Minute;
+    CSHORT Second;
+    CSHORT Milliseconds;
+    CSHORT Weekday;
+} TIME_FIELDS;
+
+typedef TIME_FIELDS *PTIME_FIELDS;
+
+VOID WINAPI RtlSystemTimeToLocalTime(
+	IN  PLARGE_INTEGER SystemTime,
+	OUT PLARGE_INTEGER LocalTime);
+
+VOID WINAPI RtlTimeToTimeFields(
+	PLARGE_INTEGER liTime,
+	PTIME_FIELDS TimeFields);
+
+BOOLEAN WINAPI RtlTimeFieldsToTime(
+	PTIME_FIELDS tfTimeFields,
+	PLARGE_INTEGER Time);
+	
+VOID WINAPI RtlTimeToElapsedTimeFields(
+	PLARGE_INTEGER liTime,
+	PTIME_FIELDS TimeFields);
+	
+BOOLEAN WINAPI RtlTimeToSecondsSince1980(
+	LPFILETIME ft,
+	LPDWORD timeret);
+
+BOOLEAN WINAPI RtlTimeToSecondsSince1970(
+	LPFILETIME ft,
+	LPDWORD timeret);
+
+/*
+	heap functions
 */
-void WINAPI RtlInitializeResource(LPRTL_RWLOCK rwl);
-void WINAPI RtlDeleteResource(LPRTL_RWLOCK rwl);
-BYTE WINAPI RtlAcquireResourceExclusive(LPRTL_RWLOCK rwl, BYTE fWait);
-BYTE WINAPI RtlAcquireResourceShared(LPRTL_RWLOCK rwl, BYTE fWait);
-void WINAPI RtlReleaseResource(LPRTL_RWLOCK rwl);
-void WINAPI RtlDumpResource(LPRTL_RWLOCK rwl);
 
+/* Data structure for heap definition. This includes various
+   sizing parameters and callback routines, which, if left NULL,
+   result in default behavior */
+
+typedef struct
+{	ULONG	Length;		/* = sizeof(RTL_HEAP_DEFINITION) */
+	ULONG	Unknown[11];
+} RTL_HEAP_DEFINITION, *PRTL_HEAP_DEFINITION;
+
+HANDLE WINAPI RtlCreateHeap(
+	ULONG Flags,
+	PVOID BaseAddress,
+	ULONG SizeToReserve,
+	ULONG SizeToCommit,
+	PVOID Unknown,
+	PRTL_HEAP_DEFINITION Definition);
+
+PVOID WINAPI RtlAllocateHeap(
+	HANDLE Heap,
+	ULONG Flags,
+	ULONG Size);
+
+
+BOOLEAN WINAPI RtlFreeHeap(
+	HANDLE Heap,
+	ULONG Flags,
+	PVOID Address);
+
+/*
+ *	misc
+ */
 void __cdecl DbgPrint(LPCSTR fmt,LPVOID args);
 DWORD NtRaiseException ( DWORD dwExceptionCode, DWORD dwExceptionFlags, DWORD nNumberOfArguments,CONST ULONG_PTR *lpArguments);
 DWORD RtlRaiseException ( DWORD x);
@@ -340,19 +578,14 @@ VOID WINAPI RtlAcquirePebLock(void);
 VOID WINAPI RtlReleasePebLock(void);
 DWORD WINAPI RtlAdjustPrivilege(DWORD x1,DWORD x2,DWORD x3,DWORD x4);
 DWORD WINAPI RtlIntegerToChar(DWORD x1,DWORD x2,DWORD x3,DWORD x4);
-DWORD WINAPI RtlSystemTimeToLocalTime(DWORD x1,DWORD x2);
-DWORD WINAPI RtlTimeToTimeFields(DWORD x1,DWORD x2);
 DWORD WINAPI RtlSetEnvironmentVariable(DWORD x1,PUNICODE_STRING key,PUNICODE_STRING val);
 DWORD WINAPI RtlNewSecurityObject(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5,DWORD x6);
 DWORD WINAPI RtlDeleteSecurityObject(DWORD x1);
-BOOLEAN WINAPI RtlTimeToSecondsSince1980(LPFILETIME ft,LPDWORD timeret);
-BOOLEAN WINAPI RtlTimeToSecondsSince1970(LPFILETIME ft,LPDWORD timeret);
 LPVOID WINAPI RtlNormalizeProcessParams(LPVOID x);
 DWORD WINAPI RtlNtStatusToDosError(DWORD error);
 BOOLEAN WINAPI RtlGetNtProductType(LPDWORD type);
-DWORD WINAPI RtlTimeToElapsedTimeFields( DWORD x1, DWORD x2 );
 INT WINAPI RtlExtendedLargeIntegerDivide(LARGE_INTEGER dividend, DWORD divisor, LPDWORD rest);
-LARGE_INTEGER WINAPI RtlExtendedIntegerMultiply(LARGE_INTEGER factor1,INT factor2);
+long long WINAPI RtlExtendedIntegerMultiply(LARGE_INTEGER factor1,INT factor2);
 DWORD WINAPI RtlFormatCurrentUserKeyPath(DWORD x);
 DWORD WINAPI RtlOpenCurrentUser(DWORD x1, DWORD *x2);
 BOOLEAN WINAPI RtlDosPathNameToNtPathName_U( LPWSTR from,PUNICODE_STRING us,DWORD x2,DWORD x3);
@@ -360,6 +593,28 @@ DWORD WINAPI RtlCreateEnvironment(DWORD x1,DWORD x2);
 DWORD WINAPI RtlDestroyEnvironment(DWORD x);
 DWORD WINAPI RtlQueryEnvironmentVariable_U(DWORD x1,PUNICODE_STRING key,PUNICODE_STRING val) ;
 
-
+BOOL WINAPI IsValidSid(PSID);
+BOOL WINAPI EqualSid(PSID,PSID);
+BOOL WINAPI EqualPrefixSid(PSID,PSID);
+DWORD  WINAPI GetSidLengthRequired(BYTE);
+BOOL WINAPI AllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY,BYTE,DWORD,
+                                       DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,
+                                       DWORD,PSID*);
+VOID*  WINAPI FreeSid(PSID);
+BOOL WINAPI InitializeSecurityDescriptor(SECURITY_DESCRIPTOR*,DWORD);
+BOOL WINAPI InitializeSid(PSID,PSID_IDENTIFIER_AUTHORITY,BYTE);
+DWORD* WINAPI GetSidSubAuthority(PSID,DWORD);
+BYTE * WINAPI GetSidSubAuthorityCount(PSID);
+DWORD  WINAPI GetLengthSid(PSID);
+BOOL WINAPI CopySid(DWORD,PSID,PSID);
+BOOL WINAPI LookupAccountSidA(LPCSTR,PSID,LPCSTR,LPDWORD,LPCSTR,LPDWORD,
+                                  PSID_NAME_USE);
+BOOL WINAPI LookupAccountSidW(LPCWSTR,PSID,LPCWSTR,LPDWORD,LPCWSTR,LPDWORD,
+                                  PSID_NAME_USE);
+PSID_IDENTIFIER_AUTHORITY WINAPI GetSidIdentifierAuthority(PSID);
+
+#ifdef __cplusplus
+}
+#endif
 
 #endif

include/ntdef.h

 #ifndef __WINE_NTDEF_H
 #define __WINE_NTDEF_H
 
+/* fixme: include basestd.h instead */
+#include "wintypes.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #define NTAPI   __stdcall 
 
 #ifndef IN
@@ -15,26 +22,38 @@
 #define OPTIONAL
 #endif
 
+#ifndef VOID
+#define VOID void
+#endif
+
+typedef LONG NTSTATUS;
+typedef NTSTATUS *PNTSTATUS;
+
+typedef short CSHORT;
+typedef CSHORT *PCSHORT;  
+
+typedef WCHAR * PWCHAR;
+
 /* NT lowlevel Strings (handled by Rtl* functions in NTDLL)
  * If they are zero terminated, Length does not include the terminating 0.
  */
 
 typedef struct _STRING {
-	UINT16	Length;
-	UINT16	MaximumLength;
-	LPSTR	Buffer;
+	USHORT	Length;
+	USHORT	MaximumLength;
+	PSTR	Buffer;
 } STRING,*PSTRING,ANSI_STRING,*PANSI_STRING;
 
 typedef struct _CSTRING {
-	UINT16	Length;
-	UINT16	MaximumLength;
-	LPCSTR	Buffer;
+	USHORT	Length;
+	USHORT	MaximumLength;
+	PCSTR	Buffer;
 } CSTRING,*PCSTRING;
 
 typedef struct _UNICODE_STRING {
-	UINT16	Length;		/* bytes */
-	UINT16	MaximumLength;	/* bytes */
-	LPWSTR	Buffer;
+	USHORT	Length;		/* bytes */
+	USHORT	MaximumLength;	/* bytes */
+	PWSTR	Buffer;
 } UNICODE_STRING,*PUNICODE_STRING;
 
 /*
@@ -61,5 +80,8 @@ typedef struct _OBJECT_ATTRIBUTES
 
 typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;
 
+#ifdef __cplusplus
+}
+#endif
 
 #endif

include/winnt.h

@@ -378,6 +378,11 @@ typedef struct _SID {
     DWORD SubAuthority[1];
 } SID,*PSID;
 
+#define	SID_REVISION			(1)	/* Current revision */
+#define	SID_MAX_SUB_AUTHORITIES		(15)	/* current max subauths */
+#define	SID_RECOMMENDED_SUB_AUTHORITIES	(1)	/* recommended subauths */
+
+
 /* 
  * ACL 
  */
@@ -551,6 +556,81 @@ typedef struct _TOKEN_STATISTICS {
   LUID  ModifiedId; 
 } TOKEN_STATISTICS; 
 
+/* 
+ *	ACLs of NT 
+ */
+
+#define	ACL_REVISION	2
+
+#define	ACL_REVISION1	1
+#define	ACL_REVISION2	2
+
+/* ACEs, directly starting after an ACL */
+typedef struct _ACE_HEADER {
+	BYTE	AceType;
+	BYTE	AceFlags;
+	WORD	AceSize;
+} ACE_HEADER,*PACE_HEADER;
+
+/* AceType */
+#define	ACCESS_ALLOWED_ACE_TYPE		0
+#define	ACCESS_DENIED_ACE_TYPE		1
+#define	SYSTEM_AUDIT_ACE_TYPE		2
+#define	SYSTEM_ALARM_ACE_TYPE		3
+
+/* inherit AceFlags */
+#define	OBJECT_INHERIT_ACE		0x01
+#define	CONTAINER_INHERIT_ACE		0x02
+#define	NO_PROPAGATE_INHERIT_ACE	0x04
+#define	INHERIT_ONLY_ACE		0x08
+#define	VALID_INHERIT_FLAGS		0x0F
+
+/* AceFlags mask for what events we (should) audit */
+#define	SUCCESSFUL_ACCESS_ACE_FLAG	0x40
+#define	FAILED_ACCESS_ACE_FLAG		0x80
+
+/* different ACEs depending on AceType 
+ * SidStart marks the begin of a SID
+ * so the thing finally looks like this:
+ * 0: ACE_HEADER
+ * 4: ACCESS_MASK
+ * 8... : SID
+ */
+typedef struct _ACCESS_ALLOWED_ACE {
+	ACE_HEADER	Header;
+	DWORD		Mask;
+	DWORD		SidStart;
+} ACCESS_ALLOWED_ACE,*PACCESS_ALLOWED_ACE;
+
+typedef struct _ACCESS_DENIED_ACE {
+	ACE_HEADER	Header;
+	DWORD		Mask;
+	DWORD		SidStart;
+} ACCESS_DENIED_ACE,*PACCESS_DENIED_ACE;
+
+typedef struct _SYSTEM_AUDIT_ACE {
+	ACE_HEADER	Header;
+	DWORD		Mask;
+	DWORD		SidStart;
+} SYSTEM_AUDIT_ACE,*PSYSTEM_AUDIT_ACE;
+
+typedef struct _SYSTEM_ALARM_ACE {
+	ACE_HEADER	Header;
+	DWORD		Mask;
+	DWORD		SidStart;
+} SYSTEM_ALARM_ACE,*PSYSTEM_ALARM_ACE;
+
+typedef enum tagSID_NAME_USE {
+	SidTypeUser = 1,
+	SidTypeGroup,
+	SidTypeDomain,
+	SidTypeAlias,
+	SidTypeWellKnownGroup,
+	SidTypeDeletedAccount,
+	SidTypeInvalid,
+	SidTypeUnknown
+} SID_NAME_USE,*PSID_NAME_USE;
+
 /* Access rights */
 
 #define DELETE                     0x00010000