### Security Descriptor and SID Management in Rust

Source: https://context7.com/msxdos/ntapi/llms.txt

Provides examples for creating security descriptors, initializing SIDs for administrative domains, and constructing Access Control Lists (ACLs).

```rust
use ntapi::ntrtl::{RtlCreateSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlAllocateAndInitializeSid, RtlCreateAcl, RtlAddAccessAllowedAce};
use winapi::shared::ntdef::{NTSTATUS, BOOLEAN};
use winapi::um::winnt::{SECURITY_DESCRIPTOR, ACL, PSID, PSID_IDENTIFIER_AUTHORITY, SECURITY_DESCRIPTOR_REVISION, ACL_REVISION, SECURITY_NT_AUTHORITY, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, GENERIC_ALL};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn create_admin_only_sd() -> Result<SECURITY_DESCRIPTOR, NTSTATUS> {
    let mut sd: SECURITY_DESCRIPTOR = zeroed();
    RtlCreateSecurityDescriptor(&mut sd as *mut _ as *mut _, SECURITY_DESCRIPTOR_REVISION);
    let mut admin_sid: PSID = null_mut();
    let mut nt_authority: SID_IDENTIFIER_AUTHORITY = SECURITY_NT_AUTHORITY;
    let status = RtlAllocateAndInitializeSid(&mut nt_authority as *mut _ as PSID_IDENTIFIER_AUTHORITY, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &mut admin_sid);
    if status >= 0 {
        let acl_buffer = vec![0u8; 256];
        let acl = acl_buffer.as_ptr() as *mut ACL;
        RtlCreateAcl(acl, 256, ACL_REVISION);
        RtlAddAccessAllowedAce(acl, ACL_REVISION, GENERIC_ALL, admin_sid);
        RtlSetDaclSecurityDescriptor(&mut sd as *mut _ as *mut _, true as BOOLEAN, acl, false as BOOLEAN);
        Ok(sd)
    } else { Err(status) }
}
```

--------------------------------

### Manage Windows Processes using ntapi

Source: https://context7.com/msxdos/ntapi/llms.txt

Demonstrates how to open a process by ID and query its basic information using native NT system calls. This requires unsafe blocks to handle raw pointers and Windows handles.

```rust
use ntapi::ntpsapi::{
    NtOpenProcess, NtQueryInformationProcess, NtTerminateProcess,
    NtCurrentProcess, PROCESS_BASIC_INFORMATION, PROCESSINFOCLASS,
};
use ntapi::ntapi_base::CLIENT_ID;
use winapi::shared::ntdef::{HANDLE, NTSTATUS, OBJECT_ATTRIBUTES, PVOID, ULONG};
use winapi::um::winnt::{PROCESS_QUERY_INFORMATION, PROCESS_TERMINATE};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn get_process_info(process_id: u32) -> Result<PROCESS_BASIC_INFORMATION, NTSTATUS> {
    let mut handle: HANDLE = null_mut();
    let mut client_id: CLIENT_ID = zeroed();
    client_id.UniqueProcess = process_id as HANDLE;

    let mut obj_attrs: OBJECT_ATTRIBUTES = zeroed();

    let status = NtOpenProcess(
        &mut handle,
        PROCESS_QUERY_INFORMATION | PROCESS_TERMINATE,
        &mut obj_attrs,
        &mut client_id,
    );

    if status < 0 { return Err(status); }

    let mut info: PROCESS_BASIC_INFORMATION = zeroed();
    let mut return_length: ULONG = 0;

    let status = NtQueryInformationProcess(
        handle,
        PROCESSINFOCLASS::ProcessBasicInformation,
        &mut info as *mut _ as PVOID,
        core::mem::size_of::<PROCESS_BASIC_INFORMATION>() as ULONG,
        &mut return_length,
    );

    if status >= 0 { Ok(info) } else { Err(status) }
}
```

--------------------------------

### RTL Utility Functions in Rust

Source: https://context7.com/msxdos/ntapi/llms.txt

Demonstrates core Runtime Library operations including Unicode string initialization, private heap management, and linked list manipulation using ntapi.

```rust
use ntapi::ntrtl::{RtlInitUnicodeString, RtlCompareUnicodeString, RtlCreateHeap, RtlAllocateHeap, RtlFreeHeap, RtlDestroyHeap, RtlInitializeCriticalSection, RtlEnterCriticalSection, RtlLeaveCriticalSection, InitializeListHead, InsertTailList, RemoveHeadList, IsListEmpty};
use winapi::shared::ntdef::{UNICODE_STRING, LIST_ENTRY, BOOLEAN, PVOID};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn init_unicode_string(source: *const u16) -> UNICODE_STRING {
    let mut dest: UNICODE_STRING = zeroed();
    RtlInitUnicodeString(&mut dest, source);
    dest
}

unsafe fn create_private_heap(reserve_size: usize) -> PVOID {
    RtlCreateHeap(0x00000002, null_mut(), reserve_size, 0, null_mut(), null_mut())
}

unsafe fn demo_list_operations() {
    let mut list_head: LIST_ENTRY = zeroed();
    InitializeListHead(&mut list_head);
    let mut entry: LIST_ENTRY = zeroed();
    InsertTailList(&mut list_head, &mut entry);
}
```

--------------------------------

### Rust: Native File Reading with ntapi

Source: https://context7.com/msxdos/ntapi/llms.txt

Demonstrates reading file content using NtReadFile from the ntapi crate. It handles file opening, buffer allocation, and error checking. Requires winapi and core libraries.

```rust
use ntapi::ntioapi::{
    NtCreateFile, NtReadFile, NtQueryInformationFile,
    NtSetInformationFile, NtDeleteFile, NtClose,
    FILE_OPEN, FILE_CREATE, FILE_SYNCHRONOUS_IO_NONALERT,
    FILE_INFORMATION_CLASS, FILE_BASIC_INFORMATION, IO_STATUS_BLOCK,
};
use winapi::shared::ntdef::{HANDLE, NTSTATUS, OBJECT_ATTRIBUTES, UNICODE_STRING, PVOID, ULONG};
use winapi::um::winnt::{FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_SHARE_READ, FILE_ATTRIBUTE_NORMAL};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn native_read_file(path: &UNICODE_STRING) -> Result<Vec<u8>, NTSTATUS> {
    let mut handle: HANDLE = null_mut();
    let mut io_status: IO_STATUS_BLOCK = zeroed();
    let mut obj_attrs: OBJECT_ATTRIBUTES = zeroed();
    obj_attrs.Length = core::mem::size_of::<OBJECT_ATTRIBUTES>() as ULONG;
    obj_attrs.ObjectName = path as *const _ as *mut _;

    // Open file
    let status = NtCreateFile(
        &mut handle,
        FILE_GENERIC_READ,
        &mut obj_attrs,
        &mut io_status,
        null_mut(),
        FILE_ATTRIBUTE_NORMAL,
        FILE_SHARE_READ,
        FILE_OPEN,
        FILE_SYNCHRONOUS_IO_NONALERT,
        null_mut(),
        0,
    );

    if status < 0 { return Err(status); }

    // Read file content
    let mut buffer = vec![0u8; 4096];
    let status = NtReadFile(
        handle,
        null_mut(), // Event
        None,       // ApcRoutine
        null_mut(), // ApcContext
        &mut io_status,
        buffer.as_mut_ptr() as PVOID,
        buffer.len() as ULONG,
        null_mut(), // ByteOffset
        null_mut(), // Key
    );

    if status >= 0 {
        buffer.truncate(io_status.Information as usize);
        Ok(buffer)
    } else {
        Err(status)
    }
}
```

--------------------------------

### Manage Windows Job Objects using ntapi

Source: https://context7.com/msxdos/ntapi/llms.txt

Demonstrates creating a Windows job object and assigning a process to it using NtCreateJobObject and NtAssignProcessToJobObject. These functions require unsafe blocks and return NTSTATUS codes to indicate success or failure.

```rust
use ntapi::ntpsapi::{
    NtCreateJobObject, NtAssignProcessToJobObject, NtTerminateJobObject,
    NtQueryInformationJobObject, NtSetInformationJobObject,
};
use winapi::shared::ntdef::{HANDLE, NTSTATUS, OBJECT_ATTRIBUTES, PVOID, ULONG};
use winapi::um::winnt::{JOB_OBJECT_ALL_ACCESS, JOBOBJECTINFOCLASS};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn create_job_and_assign_process(process_handle: HANDLE) -> Result<HANDLE, NTSTATUS> {
    let mut job_handle: HANDLE = null_mut();
    let mut obj_attrs: OBJECT_ATTRIBUTES = zeroed();
    obj_attrs.Length = core::mem::size_of::<OBJECT_ATTRIBUTES>() as ULONG;

    let status = NtCreateJobObject(
        &mut job_handle,
        JOB_OBJECT_ALL_ACCESS,
        &mut obj_attrs,
    );

    if status < 0 { return Err(status); }

    let status = NtAssignProcessToJobObject(job_handle, process_handle);

    if status >= 0 { Ok(job_handle) } else { Err(status) }
}

unsafe fn terminate_all_processes_in_job(job_handle: HANDLE, exit_status: NTSTATUS) -> NTSTATUS {
    NtTerminateJobObject(job_handle, exit_status)
}
```

--------------------------------

### Manage Virtual Memory with Rust NTAPI

Source: https://context7.com/msxdos/ntapi/llms.txt

Demonstrates how to allocate virtual memory with specific permissions and change protection to executable. It also provides a utility for freeing allocated memory regions using NtFreeVirtualMemory.

```rust
use ntapi::ntmmapi::{
    NtAllocateVirtualMemory, NtFreeVirtualMemory, NtProtectVirtualMemory,
};
use ntapi::ntpsapi::NtCurrentProcess;
use winapi::shared::ntdef::{NTSTATUS, PVOID};
use winapi::shared::basetsd::SIZE_T;
use winapi::um::winnt::{MEM_COMMIT, MEM_RESERVE, MEM_RELEASE, PAGE_READWRITE, PAGE_EXECUTE_READ};
use core::ptr::null_mut;

unsafe fn allocate_executable_memory(size: SIZE_T) -> Result<PVOID, NTSTATUS> {
    let mut base_address: PVOID = null_mut();
    let mut region_size: SIZE_T = size;

    let status = NtAllocateVirtualMemory(
        NtCurrentProcess,
        &mut base_address,
        0,
        &mut region_size,
        MEM_COMMIT | MEM_RESERVE,
        PAGE_READWRITE,
    );

    if status < 0 { return Err(status); }

    let mut old_protect: u32 = 0;
    let status = NtProtectVirtualMemory(
        NtCurrentProcess,
        &mut base_address,
        &mut region_size,
        PAGE_EXECUTE_READ,
        &mut old_protect,
    );

    if status >= 0 { Ok(base_address) } else { Err(status) }
}

unsafe fn free_memory(base_address: PVOID) -> NTSTATUS {
    let mut addr = base_address;
    let mut size: SIZE_T = 0;
    NtFreeVirtualMemory(NtCurrentProcess, &mut addr, &mut size, MEM_RELEASE)
}
```

--------------------------------

### Configure ntapi Crate Features

Source: https://context7.com/msxdos/ntapi/llms.txt

Shows how to define dependencies in Cargo.toml and use conditional compilation features like 'func-types' and 'impl-default' in Rust code.

```toml
[dependencies.ntapi]
version = "0.4"
features = ["func-types", "impl-default", "user"]
```

```rust
#[cfg(feature = "func-types")]
use ntapi::ntpsapi::NtQueryInformationProcess as NtQueryInformationProcessFn;

#[cfg(feature = "impl-default")]
fn example() {
    use ntapi::ntpsapi::PROCESS_BASIC_INFORMATION;
    let info = PROCESS_BASIC_INFORMATION::default();
}
```

--------------------------------

### Rust: Registry Value Reading with ntapi

Source: https://context7.com/msxdos/ntapi/llms.txt

Shows how to read a registry value using NtQueryValueKey from the ntapi crate. It first queries the required buffer size and then reads the value data. Requires winapi and core libraries.

```rust
use ntapi::ntregapi::{
    NtCreateKey, NtOpenKey, NtQueryValueKey, NtSetValueKey,
    NtDeleteKey, NtEnumerateKey, NtFlushKey,
    KEY_INFORMATION_CLASS, KEY_VALUE_INFORMATION_CLASS,
    KEY_VALUE_PARTIAL_INFORMATION, KEY_BASIC_INFORMATION,
};
use winapi::shared::ntdef::{HANDLE, NTSTATUS, OBJECT_ATTRIBUTES, UNICODE_STRING, PVOID, ULONG};
use winapi::um::winnt::{KEY_READ, KEY_WRITE, REG_SZ, REG_DWORD};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn read_registry_value(
    key_handle: HANDLE,
    value_name: &mut UNICODE_STRING,
) -> Result<Vec<u8>, NTSTATUS> {
    let mut result_length: ULONG = 0;

    // Query required buffer size
    let status = NtQueryValueKey(
        key_handle,
        value_name,
        KEY_VALUE_INFORMATION_CLASS::KeyValuePartialInformation,
        null_mut(),
        0,
        &mut result_length,
    );

    // Allocate and query value
    let mut buffer = vec![0u8; result_length as usize];
    let status = NtQueryValueKey(
        key_handle,
        value_name,
        KEY_VALUE_INFORMATION_CLASS::KeyValuePartialInformation,
        buffer.as_mut_ptr() as PVOID,
        result_length,
        &mut result_length,
    );

    if status >= 0 {
        let info = &*(buffer.as_ptr() as *const KEY_VALUE_PARTIAL_INFORMATION);
        let data_slice = core::slice::from_raw_parts(
            info.Data.as_ptr(),
            info.DataLength as usize,
        );
        Ok(data_slice.to_vec())
    } else {
        Err(status)
    }
}
```

--------------------------------

### Manage Windows Threads using ntapi

Source: https://context7.com/msxdos/ntapi/llms.txt

Shows how to create a suspended thread and perform suspend/resume operations using native NT APIs. These functions provide granular control over thread execution states.

```rust
use ntapi::ntpsapi::{
    NtCreateThreadEx, NtSuspendThread, NtResumeThread, NtTerminateThread,
    NtQueryInformationThread, THREAD_BASIC_INFORMATION, THREADINFOCLASS,
    THREAD_CREATE_FLAGS_CREATE_SUSPENDED,
};
use winapi::shared::ntdef::{HANDLE, NTSTATUS, PVOID, ULONG, POBJECT_ATTRIBUTES};
use winapi::shared::basetsd::SIZE_T;
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn create_suspended_thread(
    process: HANDLE,
    start_routine: PVOID,
    argument: PVOID,
) -> Result<HANDLE, NTSTATUS> {
    let mut thread_handle: HANDLE = null_mut();

    let status = NtCreateThreadEx(
        &mut thread_handle,
        0x1FFFFF, // THREAD_ALL_ACCESS
        null_mut(),
        process,
        start_routine,
        argument,
        THREAD_CREATE_FLAGS_CREATE_SUSPENDED,
        0,
        0,
        0,
        null_mut(),
    );

    if status >= 0 { Ok(thread_handle) } else { Err(status) }
}

unsafe fn suspend_and_resume(thread: HANDLE) -> NTSTATUS {
    let mut previous_count: ULONG = 0;

    let status = NtSuspendThread(thread, &mut previous_count);
    if status < 0 { return status; }

    NtResumeThread(thread, &mut previous_count)
}
```

--------------------------------

### NTSTATUS Helper Functions in Rust

Source: https://context7.com/msxdos/ntapi/llms.txt

Utilities for interpreting NTSTATUS codes, including checking for Win32 error mapping and extracting facility codes.

```rust
use ntapi::ntapi_base::{NT_FACILITY, NT_NTWIN32, WIN32_FROM_NTSTATUS};
use winapi::shared::ntdef::NTSTATUS;

fn handle_status(status: NTSTATUS) {
    if status >= 0 {
        println!("Success");
    } else if NT_NTWIN32(status) {
        println!("Win32 error: {}", WIN32_FROM_NTSTATUS(status));
    } else {
        println!("NT status: 0x{:08X}, facility: {}", status, NT_FACILITY(status));
    }
}
```

--------------------------------

### Create Shared Memory Sections with Rust NTAPI

Source: https://context7.com/msxdos/ntapi/llms.txt

Illustrates the creation of a section object for shared memory and mapping it into the current process address space. This is useful for inter-process communication or memory-mapped file operations.

```rust
use ntapi::ntmmapi::{NtCreateSection, NtMapViewOfSection, SECTION_INHERIT};
use winapi::shared::ntdef::{HANDLE, NTSTATUS, PVOID, LARGE_INTEGER};
use winapi::shared::basetsd::SIZE_T;
use winapi::um::winnt::{SECTION_ALL_ACCESS, PAGE_READWRITE, SEC_COMMIT};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn create_shared_memory(size: u64) -> Result<(HANDLE, PVOID), NTSTATUS> {
    let mut section_handle: HANDLE = null_mut();
    let mut max_size: LARGE_INTEGER = zeroed();
    *max_size.QuadPart_mut() = size as i64;

    let status = NtCreateSection(
        &mut section_handle,
        SECTION_ALL_ACCESS,
        null_mut(),
        &mut max_size,
        PAGE_READWRITE,
        SEC_COMMIT,
        null_mut(),
    );

    if status < 0 { return Err(status); }

    let mut base_address: PVOID = null_mut();
    let mut view_size: SIZE_T = 0;

    let status = NtMapViewOfSection(
        section_handle,
        ntapi::ntpsapi::NtCurrentProcess,
        &mut base_address,
        0,
        0,
        null_mut(),
        &mut view_size,
        SECTION_INHERIT::ViewShare,
        0,
        PAGE_READWRITE,
    );

    if status >= 0 { Ok((section_handle, base_address)) } else { Err(status) }
}
```

--------------------------------

### Rust: Registry DWORD Value Setting with ntapi

Source: https://context7.com/msxdos/ntapi/llms.txt

Provides a function to set a DWORD registry value using NtSetValueKey from the ntapi crate. It takes a key handle, value name, and the DWORD value to set. Requires winapi and core libraries.

```rust
use ntapi::ntregapi::{
    NtCreateKey, NtOpenKey, NtQueryValueKey, NtSetValueKey,
    NtDeleteKey, NtEnumerateKey, NtFlushKey,
    KEY_INFORMATION_CLASS, KEY_VALUE_INFORMATION_CLASS,
    KEY_VALUE_PARTIAL_INFORMATION, KEY_BASIC_INFORMATION,
};
use winapi::shared::ntdef::{HANDLE, NTSTATUS, OBJECT_ATTRIBUTES, UNICODE_STRING, PVOID, ULONG};
use winapi::um::winnt::{KEY_READ, KEY_WRITE, REG_SZ, REG_DWORD};
use core::mem::zeroed;
use core::ptr::null_mut;

unsafe fn set_registry_dword(
    key_handle: HANDLE,
    value_name: &mut UNICODE_STRING,
    value: u32,
) -> NTSTATUS {
    NtSetValueKey(
        key_handle,
        value_name,
        0,
        REG_DWORD,
        &value as *const _ as PVOID,
        core::mem::size_of::<u32>() as ULONG,
    )
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.