// Public NTLite file metadata ABI declarations shared between kernel, drivers, and user mode. #pragma once #include #include #include #define SYS_FILE_TYPE_UNKNOWN 0u #define SYS_FILE_TYPE_REGULAR 1u #define SYS_FILE_TYPE_DIRECTORY 2u #define SYS_FILE_ATTR_READ_ONLY 0x00000001u #define SYS_FILE_ATTR_HIDDEN 0x00000002u #define SYS_FILE_ATTR_SYSTEM 0x00000004u #define SYS_FILE_ATTR_VOLUME_ID 0x00000008u #define SYS_FILE_ATTR_DIRECTORY 0x00000010u #define SYS_FILE_ATTR_ARCHIVE 0x00000020u // Metadata returned by path and handle stat syscalls. typedef struct SYS_FILE_STAT { uint32_t Size; uint32_t Type; uint32_t Attributes; uint32_t LinkCount; uint64_t FileSize; uint64_t VolumeId; uint64_t FileId; SYS_SYSTEM_TIME CreationTime; SYS_SYSTEM_TIME LastAccessTime; SYS_SYSTEM_TIME LastWriteTime; SYS_SYSTEM_TIME ChangeTime; } SYS_FILE_STAT; // Native file metadata is copied between independently built modules. _Static_assert(offsetof(SYS_FILE_STAT, FileId) == 32u, "SYS_FILE_STAT FileId offset changed"); _Static_assert(offsetof(SYS_FILE_STAT, CreationTime) == 40u, "SYS_FILE_STAT CreationTime offset changed"); _Static_assert(sizeof(SYS_FILE_STAT) == 200u, "SYS_FILE_STAT ABI size changed");