### Python Example for Proc Start Linux Plugin

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/proc_start_linux/README.md

Demonstrates how to use the Panda Python API to interact with the proc_start_linux plugin. It sets up a Panda instance, defines a callback for the 'on_rec_auxv' event, and executes sample commands in the guest to display auxiliary vector information.

```python
from pandare import Panda
from sys import argv

arch = "i386" if len(argv) <= 1 else argv[1]
Panda = Panda(generic=arch)

@panda.queue_blocking
def guest_interaction():
    panda.revert_sync("root")
    for cmd in ["ls -la", "whoami", "time ls -la"]:
        print(f"{cmd} {panda.run_serial_cmd('LD_SHOW_AUXV=1 '+cmd)}")
    panda.end_analysis()

@panda.ppp("proc_start_linux", "on_rec_auxv")
def recv_auxv(cpu, tb, auxv):
    procname = panda.ffi.string(auxv.execfn)
    print(f"started proc {procname} {auxv.phdr:x} {auxv.entry:x}")

Panda.run()
```

--------------------------------

### Panda-ng Setup and Execution

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/scripts/README.md

Provides instructions for setting up a Python virtual environment, installing dependencies, and running scripts to generate syscall prototypes and C++ code from kernel sources.

```sh
python3 -m venv venv
. venv/bin/activate

pip install -r requirements2.txt

# Option A: Generate prototypes
./make_all_prototypes.sh

# Option B: Generate headers and C++ code
./make_all_generated.sh
```

--------------------------------

### Kernel Configuration Example

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/osi_linux/README.md

Example of how to configure the kernel with task switch hook addresses for introspection. This involves setting specific fields in a kernel configuration file.

```ini
[my_kernel_info]
name = #1 SMP Debian 3.2.51-1 i686
version.a = 3
...
    task.switch_task_hook_addr = <Address extracted from System.map>
```

--------------------------------

### System Boot and Configuration Functions

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x64_prototypes.txt

Functions for managing system boot entries, options, and driver order.

```APIDOC
NTSTATUS NtSerializeBoot ();
  - Serializes the boot configuration.

NTSTATUS NtSetBootEntryOrder (PULONG Ids, ULONG Count);
  - Sets the order of boot entries.
    - Parameters:
      - Ids: Array of boot entry identifiers.
      - Count: Number of identifiers in the array.

NTSTATUS NtSetBootOptions (PBOOT_OPTIONS BootOptions, ULONG FieldsToChange);
  - Sets the system boot options.
    - Parameters:
      - BootOptions: Pointer to a BOOT_OPTIONS structure.
      - FieldsToChange: Specifies which fields in BootOptions are to be changed.

NTSTATUS NtSetDriverEntryOrder (PULONG Ids, ULONG Count);
  - Sets the order of driver entries.
    - Parameters:
      - Ids: Array of driver entry identifiers.
      - Count: Number of identifiers in the array.
```

--------------------------------

### Install pandare Dependencies

Source: https://github.com/panda-re/panda-ng/blob/main/python/core/README.md

Installs necessary system dependencies for pandare on Ubuntu 20.04. These are required before installing the pandare package itself.

```bash
apt install libvdeplug-dev libpng16-16 libsdl2-2.0-0
```

--------------------------------

### File Handle Operations

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/freebsd_x64_prototypes.txt

Functions for operating on file handles, including getting file system statistics, opening files by handle, and getting file status.

```c
int fhstatfs(const struct fhandle *u_fhp, struct ostatfs *buf);
int fhopen(const struct fhandle *u_fhp, int flags);
int fhstat(const struct fhandle *u_fhp, struct freebsd11_stat *sb);
```

--------------------------------

### Invoking Panda System with Plugins

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/README.md

Command-line example demonstrating how to run the PANDA system emulator with the `syscalls2` plugin and a custom plugin like `filereadmon`.

```sh
$PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo \
    -os windows-32-7sp1 -panda syscalls2 -panda filereadmon
```

--------------------------------

### Context and Boot Configuration

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

Functions for setting thread context, debug filter states, and boot options.

```APIDOC
NTSTATUS NtSetContextThread (HANDLE ThreadHandle, PCONTEXT ThreadContext);
NTSTATUS NtSetDebugFilterState (ULONG ComponentId, ULONG Level, BOOLEAN State);
NTSTATUS NtSetBootOptions (PBOOT_OPTIONS BootOptions, ULONG FieldsToChange);
NTSTATUS NtSetBootEntryOrder (PULONG Ids, ULONG Count);
NTSTATUS NtSerializeBoot ();
```

--------------------------------

### Install and Use pandare

Source: https://github.com/panda-re/panda-ng/blob/main/python/core/README.md

Installs the pandare Python package using pip and demonstrates basic initialization of the Panda interface for a generic i386 system.

```bash
pip3 install pandare
```

```python
from pandare import Panda
panda = Panda(generic='i386')
...
```

--------------------------------

### Running Panda with Hypersyscalls

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/hypersyscalls/README.md

Provides the command-line arguments for running Panda with the hypersyscalls plugin enabled. This setup is necessary for guest-side integration where the guest OS notifies the hypervisor of system calls. It requires the `hypercaller` and `hypersyscalls` Panda plugins, along with a custom analysis plugin.

```bash
$PANDA_PATH/x86_64-softmmu/panda-system-x86_64 -replay foo \
    -panda hypercaller -panda hypersyscalls \
    -panda my_analysis_plugin
```

--------------------------------

### Download Kernel Information Module Snapshot

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/osi_linux/utils/kernelinfo/README.md

Provides commands to download a snapshot of the kernel information module source code. This is useful for obtaining the necessary files to compile and run the module.

```bash
wget https://panda-re.mit.edu/kernelinfos/generator_july20.tgz
```

```bash
svn export https://github.com/panda-re/panda/trunk/panda/plugins/osi_linux/utils/kernelinfo
```

--------------------------------

### Hook Callback Example (before_block_exec)

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/hooks/README.md

An example of a hook callback function for the `before_block_exec` style. This callback receives pointers to the CPU state, the translation block, and the hook structure itself.

```c
void (*before_block_exec)(CPUState* env, TranslationBlock* tb, struct hook*);
```

--------------------------------

### Clock Management System Calls

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/linux_mips64_prototypes.txt

These system calls provide access to system clocks for setting time (`sys_clock_settime`), getting current time (`sys_clock_gettime`), getting clock resolution (`sys_clock_getres`), and sleeping until a specific time (`sys_clock_nanosleep`).

```C
long sys_clock_settime(clockid_t which_clock, const struct __kernel_timespec __user *tp);
long sys_clock_gettime(clockid_t which_clock, struct __kernel_timespec __user *tp);
long sys_clock_getres(clockid_t which_clock, struct __kernel_timespec __user *tp);
long sys_clock_nanosleep(clockid_t which_clock, int flags, const struct __kernel_timespec __user *rqtp, struct __kernel_timespec __user *rmtp);
```

--------------------------------

### Driver and Boot Entry Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

Functions for adding driver entries and boot entries to the system.

```APIDOC
NtAddDriverEntry:
  Adds a driver entry to the system.
  Parameters:
    DriverEntry: Pointer to the driver entry structure.
    Id: Pointer to a variable that receives the ID of the added driver entry.
  Returns: NTSTATUS indicating success or failure.

NtAddBootEntry:
  Adds a boot entry to the system.
  Parameters:
    BootEntry: Pointer to the boot entry structure.
    Id: Pointer to a variable that receives the ID of the added boot entry.
  Returns: NTSTATUS indicating success or failure.
```

--------------------------------

### System Boot and Event Management Functions

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_xpsp3_x86_prototypes.txt

Functions for setting system boot options and managing event objects.

```APIDOC
NtSetBootEntryOrder:
  NtStatus NtSetBootEntryOrder(PULONG Ids, ULONG Count);
  - Sets the order of boot entries.
  - Parameters:
    - Ids: Pointer to an array of ULONG values that specify the order of boot entries.
    - Count: The number of entries in the Ids array.

NtSetBootOptions:
  NtStatus NtSetBootOptions(PBOOT_OPTIONS BootOptions, ULONG FieldsToChange);
  - Sets system boot options.
  - Parameters:
    - BootOptions: Pointer to a BOOT_OPTIONS structure that specifies the new boot options.
    - FieldsToChange: A bitmask indicating which fields in the BootOptions structure should be changed.

NtResetEvent:
  NtStatus NtResetEvent(HANDLE EventHandle, PLONG PreviousState);
  - Resets an event object to the signaled state.
  - Parameters:
    - EventHandle: Handle to the event object.
    - PreviousState: Pointer to a LONG that receives the previous state of the event object.
```

--------------------------------

### MUIRegistry Information Retrieval

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp1_x86_prototypes.txt

Function to get MUI registry information.

```APIDOC
NtGetMUIRegistryInfo:
  Gets MUI registry information.
  Parameters:
    Flags: Flags for retrieving information.
    DataSize: Pointer to receive the size of the data.
    Data: Pointer to receive the registry data.
  Returns: NTSTATUS code.
```

--------------------------------

### Registry Initialization and Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_vistasp12_x86_prototypes.txt

Functions for initializing and managing the registry.

```APIDOC
NTSTATUS NtInitializeRegistry (USHORT BootCondition);
  - Initializes the registry.

NTSTATUS NtLoadKey (POBJECT_ATTRIBUTES TargetKey, POBJECT_ATTRIBUTES SourceFile);
  - Loads a registry key.

NTSTATUS NtLoadKey2 (POBJECT_ATTRIBUTES TargetKey, POBJECT_ATTRIBUTES SourceFile, ULONG Flags);
  - Loads a registry key with flags.

NTSTATUS NtLoadKeyEx (POBJECT_ATTRIBUTES TargetKey, POBJECT_ATTRIBUTES SourceFile, ULONG Flags, HANDLE TrustClassKey );
  - Loads a registry key with extended options.

NTSTATUS NtLockRegistryKey (HANDLE KeyHandle);
  - Locks a registry key.
```

--------------------------------

### Capability Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/linux_mips64_prototypes.txt

System calls for getting and setting process capabilities.

```APIDOC
sys_capget(cap_user_header_t header, cap_user_data_t dataptr);
  - Retrieves the capabilities of the calling process.

sys_capset(cap_user_header_t header, const cap_user_data_t data);
  - Sets the capabilities of the calling process.
```

--------------------------------

### Real-time Priority Control

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/freebsd_x64_prototypes.txt

Sets or gets the real-time priority of a thread.

```c
int rtprio_thread(int function, lwpid_t lwpid, struct rtprio *rtp);
```

--------------------------------

### I/O Completion and Profile Functions

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

Functions for setting I/O completion port information and interval profiles.

```APIDOC
NTSTATUS NtSetIoCompletionEx (HANDLE IoCompletionHandle, HANDLE IoCompletionReserveHandle, PVOID KeyContext, PVOID ApcContext, NTSTATUS IoStatus, ULONG_PTR IoStatusInformation);
NTSTATUS NtSetIoCompletion (HANDLE IoCompletionHandle, PVOID KeyContext, PVOID ApcContext, NTSTATUS IoStatus, ULONG_PTR IoStatusInformation);
NTSTATUS NtSetIntervalProfile (ULONG Interval, KPROFILE_SOURCE Source);
```

--------------------------------

### System and Profile Information

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_2003sp0_x86_prototypes.txt

Functions for querying system-wide information, including boot options, locale settings, and performance counters.

```APIDOC
NTSTATUS NtQueryBootEntryOrder (PULONG Ids, PULONG Count);
  - Retrieves the boot entry order.
  - Parameters:
    - Ids: Pointer to an array of ULONGs that receives the boot entry identifiers.
    - Count: Pointer to a ULONG that receives the number of boot entry identifiers.

NTSTATUS NtQueryBootOptions (PBOOT_OPTIONS BootOptions, PULONG BootOptionsLength);
  - Retrieves the system's boot options.
  - Parameters:
    - BootOptions: Pointer to a BOOT_OPTIONS structure that receives the boot options.
    - BootOptionsLength: Pointer to a ULONG that specifies the size of the BootOptions buffer.

NTSTATUS NtQueryDebugFilterState (ULONG ComponentId, ULONG Level);
  - Retrieves the debug filter state for a specified component and level.
  - Parameters:
    - ComponentId: Identifier of the component.
    - Level: Debugging level.

NTSTATUS NtQueryDefaultLocale (BOOLEAN UserProfile, PLCID DefaultLocaleId);
  - Retrieves the default locale identifier.
  - Parameters:
    - UserProfile: If TRUE, retrieves the user's default locale; otherwise, retrieves the system's default locale.
    - DefaultLocaleId: Pointer to a LCID that receives the default locale identifier.

NTSTATUS NtQueryDefaultUILanguage (LANGID *DefaultUILanguageId);
  - Retrieves the default UI language identifier.
  - Parameters:
    - DefaultUILanguageId: Pointer to a LANGID that receives the default UI language identifier.

NTSTATUS NtQueryDriverEntryOrder (PULONG Ids, PULONG Count);
  - Retrieves the driver entry order.
  - Parameters:
    - Ids: Pointer to an array of ULONGs that receives the driver entry identifiers.
    - Count: Pointer to a ULONG that receives the number of driver entry identifiers.

NTSTATUS NtQueryInstallUILanguage (LANGID *InstallUILanguageId);
  - Retrieves the installed UI language identifier.
  - Parameters:
    - InstallUILanguageId: Pointer to a LANGID that receives the installed UI language identifier.

NTSTATUS NtQueryIntervalProfile (KPROFILE_SOURCE ProfileSource, PULONG Interval);
  - Retrieves the interval for a specified profiling source.
  - Parameters:
    - ProfileSource: The profiling source (e.g., ProfileTime, ProfileAlignment, ProfileError).
    - Interval: Pointer to a ULONG that receives the profiling interval.

NTSTATUS NtQueryIoCompletion (HANDLE IoCompletionHandle, IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, PVOID IoCompletionInformation, ULONG IoCompletionInformationLength, PULONG ReturnLength);
  - Retrieves information about an I/O completion port.
  - Parameters:
    - IoCompletionHandle: Handle to the I/O completion port.
    - IoCompletionInformationClass: Type of I/O completion information to retrieve.
    - IoCompletionInformation: Buffer to receive I/O completion information.
    - IoCompletionInformationLength: Size of the IoCompletionInformation buffer.
    - ReturnLength: Pointer to a variable that receives the number of bytes returned.

NTSTATUS NtQueryPerformanceCounter (PLARGE_INTEGER PerformanceCounter, PLARGE_INTEGER PerformanceFrequency);
  - Retrieves the performance counter and frequency.
  - Parameters:
    - PerformanceCounter: Pointer to a LARGE_INTEGER that receives the current value of the performance counter.
    - PerformanceFrequency: Pointer to a LARGE_INTEGER that receives the performance counter's frequency.

NTSTATUS NtQuerySection (HANDLE SectionHandle, SECTION_INFORMATION_CLASS SectionInformationClass, PVOID SectionInformation, SIZE_T SectionInformationLength, PSIZE_T ReturnLength);
  - Retrieves information about a section object.
  - Parameters:
    - SectionHandle: Handle to the section object.
    - SectionInformationClass: Type of section information to retrieve.
    - SectionInformation: Buffer to receive section information.
    - SectionInformationLength: Size of the SectionInformation buffer.
    - ReturnLength: Pointer to a SIZE_T that receives the number of bytes returned.
```

--------------------------------

### UI Language Flushing Function

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_vistasp0_x64_prototypes.txt

This function flushes the installed UI language.

```APIDOC
NtFlushInstallUILanguage:
  Flushes the installed UI language.
  Parameters:
    InstallUILanguage: The installed UI language.
    SetComittedFlag: A flag indicating whether to commit the changes.
  Returns: NTSTATUS indicating success or failure.
```

--------------------------------

### Device Power State Retrieval

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp1_x86_prototypes.txt

Function to get the power state of a device.

```APIDOC
NtGetDevicePowerState:
  Gets the power state of a device.
  Parameters:
    Device: Handle to the device.
    State: Pointer to a DEVICE_POWER_STATE structure to receive the state.
  Returns: NTSTATUS code.
```

--------------------------------

### Registry Initialization and Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_vistasp0_x86_prototypes.txt

Functions for initializing and managing the registry.

```APIDOC
NTSTATUS NtInitializeRegistry (USHORT BootCondition);
  - Initializes the registry.

NTSTATUS NtLoadKey (POBJECT_ATTRIBUTES TargetKey, POBJECT_ATTRIBUTES SourceFile);
  - Loads a registry key.

NTSTATUS NtLoadKey2 (POBJECT_ATTRIBUTES TargetKey, POBJECT_ATTRIBUTES SourceFile, ULONG Flags);
  - Loads a registry key with flags.

NTSTATUS NtLoadKeyEx (POBJECT_ATTRIBUTES TargetKey, POBJECT_ATTRIBUTES SourceFile, ULONG Flags, HANDLE TrustClassKey );
  - Loads a registry key with extended options.

NTSTATUS NtLockRegistryKey (HANDLE KeyHandle);
  - Locks a registry key.
```

--------------------------------

### NLS Section Pointer Retrieval

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp1_x86_prototypes.txt

Function to get a pointer to an NLS section.

```APIDOC
NtGetNlsSectionPtr:
  Retrieves a pointer to an NLS section.
  Parameters:
    SectionType: Type of the NLS section.
    SectionData: Data for the section.
    ContextData: Context data for the section.
    SectionPointer: Pointer to receive the section pointer.
    SectionSize: Pointer to receive the section size.
  Returns: NTSTATUS code.
```

--------------------------------

### Processor Information

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

Function to get the current processor number.

```APIDOC
ULONG NtGetCurrentProcessorNumber ();
```

--------------------------------

### C Plugin Hypercall Example

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/hypercaller/README.md

Illustrates how to register a hypercall from a C plugin. It includes obtaining the hypercaller plugin and dynamically linking the registration function.

```C
#include <panda/plugin.h>
#include <hypercaller/hypercaller.h>

hypercall_t* register_hypercall;

void my_hypercall(CPUState *cpu) {
    printf("Hello from my hypercall!\n");
}

bool init_plugin(void *self) {
    void *hypercaller = panda_get_plugin_by_name("hypercaller");
    if (hypercaller == NULL){
      panda_require("hypercaller");
      hypercaller = panda_get_plugin_by_name("hypercaller");
    }
    register_hypercall = (hypercall_t*)dlsym(hypercaller, "register_hypercall");
    register_hypercall(0x12345678, my_hypercall);
    return true;
}
```

--------------------------------

### System Boot and Event Management Functions

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_xpsp2_x86_prototypes.txt

Functions for setting system boot options and managing event objects.

```APIDOC
NtSetBootEntryOrder:
  NtStatus NtSetBootEntryOrder(PULONG Ids, ULONG Count);
  - Sets the order of boot entries.
  - Parameters:
    - Ids: Pointer to an array of ULONG values that specify the order of boot entries.
    - Count: The number of entries in the Ids array.

NtSetBootOptions:
  NtStatus NtSetBootOptions(PBOOT_OPTIONS BootOptions, ULONG FieldsToChange);
  - Sets system boot options.
  - Parameters:
    - BootOptions: Pointer to a BOOT_OPTIONS structure that specifies the new boot options.
    - FieldsToChange: A bitmask indicating which fields in the BootOptions structure should be changed.

NtResetEvent:
  NtStatus NtResetEvent(HANDLE EventHandle, PLONG PreviousState);
  - Resets an event object to the signaled state.
  - Parameters:
    - EventHandle: Handle to the event object.
    - PreviousState: Pointer to a LONG that receives the previous state of the event object.
```

--------------------------------

### Timer Operations

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/linux_arm_prototypes.txt

System calls for creating, setting, getting, and deleting timers.

```APIDOC
sys_timer_create(clockid_t which_clock, struct sigevent __user *timer_event_spec, timer_t __user *created_timer_id)
  - Creates a new timer.
  - Parameters:
    - which_clock: The clock to use for the timer.
    - timer_event_spec: Structure specifying how to notify upon timer expiration.
    - created_timer_id: Pointer to store the ID of the created timer.

sys_timer_settime(timer_t timer_id, int flags, const struct itimerspec __user *new_setting, struct itimerspec __user *old_setting)
  - Sets the time and interval for a timer.
  - Parameters:
    - timer_id: The ID of the timer to set.
    - flags: Flags to control timer behavior (e.g., TIMER_ABSTIME).
    - new_setting: Structure specifying the new timer expiration and interval.
    - old_setting: Pointer to store the previous timer settings.

sys_timer_gettime(timer_t timer_id, struct itimerspec __user *setting)
  - Gets the remaining time and interval for a timer.
  - Parameters:
    - timer_id: The ID of the timer.
    - setting: Pointer to store the timer settings.

sys_timer_getoverrun(timer_t timer_id)
  - Gets the number of missed timer expirations.
  - Parameters:
    - timer_id: The ID of the timer.

sys_timer_delete(timer_t timer_id)
  - Deletes a timer.
  - Parameters:
    - timer_id: The ID of the timer to delete.

sys_clock_settime(clockid_t which_clock, const struct timespec __user *tp)
  - Sets the time for a specified clock.
  - Parameters:
    - which_clock: The clock to set.
    - tp: Pointer to a timespec structure with the new time.
```

--------------------------------

### Scheduling System Calls

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/linux_arm64_prototypes.txt

Allows for setting and getting scheduling attributes for processes.

```APIDOC
sys_sched_setattr(pid_t pid, struct sched_attr __user *attr, unsigned int flags);
  - Set scheduling attributes.

sys_sched_getattr(pid_t pid, struct sched_attr __user *attr, unsigned int size, unsigned int flags);
  - Get scheduling attributes.
```

--------------------------------

### System and Profile Information

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_2003sp12_x86_prototypes.txt

Functions for querying system-wide information, including boot options, locale settings, and performance counters.

```APIDOC
NTSTATUS NtQueryBootEntryOrder (PULONG Ids, PULONG Count);
  - Retrieves the boot entry order.
  - Parameters:
    - Ids: Pointer to an array of ULONGs that receives the boot entry identifiers.
    - Count: Pointer to a ULONG that receives the number of boot entry identifiers.

NTSTATUS NtQueryBootOptions (PBOOT_OPTIONS BootOptions, PULONG BootOptionsLength);
  - Retrieves the system's boot options.
  - Parameters:
    - BootOptions: Pointer to a BOOT_OPTIONS structure that receives the boot options.
    - BootOptionsLength: Pointer to a ULONG that specifies the size of the BootOptions buffer.

NTSTATUS NtQueryDebugFilterState (ULONG ComponentId, ULONG Level);
  - Retrieves the debug filter state for a specified component and level.
  - Parameters:
    - ComponentId: Identifier of the component.
    - Level: Debugging level.

NTSTATUS NtQueryDefaultLocale (BOOLEAN UserProfile, PLCID DefaultLocaleId);
  - Retrieves the default locale identifier.
  - Parameters:
    - UserProfile: If TRUE, retrieves the user's default locale; otherwise, retrieves the system's default locale.
    - DefaultLocaleId: Pointer to a LCID that receives the default locale identifier.

NTSTATUS NtQueryDefaultUILanguage (LANGID *DefaultUILanguageId);
  - Retrieves the default UI language identifier.
  - Parameters:
    - DefaultUILanguageId: Pointer to a LANGID that receives the default UI language identifier.

NTSTATUS NtQueryDriverEntryOrder (PULONG Ids, PULONG Count);
  - Retrieves the driver entry order.
  - Parameters:
    - Ids: Pointer to an array of ULONGs that receives the driver entry identifiers.
    - Count: Pointer to a ULONG that receives the number of driver entry identifiers.

NTSTATUS NtQueryInstallUILanguage (LANGID *InstallUILanguageId);
  - Retrieves the installed UI language identifier.
  - Parameters:
    - InstallUILanguageId: Pointer to a LANGID that receives the installed UI language identifier.

NTSTATUS NtQueryIntervalProfile (KPROFILE_SOURCE ProfileSource, PULONG Interval);
  - Retrieves the interval for a specified profiling source.
  - Parameters:
    - ProfileSource: The profiling source (e.g., ProfileTime, ProfileAlignment, ProfileError).
    - Interval: Pointer to a ULONG that receives the profiling interval.

NTSTATUS NtQueryIoCompletion (HANDLE IoCompletionHandle, IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, PVOID IoCompletionInformation, ULONG IoCompletionInformationLength, PULONG ReturnLength);
  - Retrieves information about an I/O completion port.
  - Parameters:
    - IoCompletionHandle: Handle to the I/O completion port.
    - IoCompletionInformationClass: Type of I/O completion information to retrieve.
    - IoCompletionInformation: Buffer to receive I/O completion information.
    - IoCompletionInformationLength: Size of the IoCompletionInformation buffer.
    - ReturnLength: Pointer to a variable that receives the number of bytes returned.

NTSTATUS NtQueryPerformanceCounter (PLARGE_INTEGER PerformanceCounter, PLARGE_INTEGER PerformanceFrequency);
  - Retrieves the performance counter and frequency.
  - Parameters:
    - PerformanceCounter: Pointer to a LARGE_INTEGER that receives the current value of the performance counter.
    - PerformanceFrequency: Pointer to a LARGE_INTEGER that receives the performance counter's frequency.

NTSTATUS NtQuerySection (HANDLE SectionHandle, SECTION_INFORMATION_CLASS SectionInformationClass, PVOID SectionInformation, SIZE_T SectionInformationLength, PSIZE_T ReturnLength);
  - Retrieves information about a section object.
  - Parameters:
    - SectionHandle: Handle to the section object.
    - SectionInformationClass: Type of section information to retrieve.
    - SectionInformation: Buffer to receive section information.
    - SectionInformationLength: Size of the SectionInformation buffer.
    - ReturnLength: Pointer to a SIZE_T that receives the number of bytes returned.
```

--------------------------------

### Windows NT Native API - Profile Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

This section details Windows NT Native API functions for managing profiling, including starting and stopping profiles.

```APIDOC
NTSTATUS NtStopProfile (HANDLE ProfileHandle);
  Stops a profile.
  Parameters:
    ProfileHandle: A handle to the profile.

NTSTATUS NtStartProfile (HANDLE ProfileHandle);
  Starts a profile.
  Parameters:
    ProfileHandle: A handle to the profile.
```

--------------------------------

### Thread and Context Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_vistasp12_x86_prototypes.txt

Functions for getting thread context and managing thread impersonation.

```APIDOC
NTSTATUS NtGetContextThread (HANDLE ThreadHandle, PCONTEXT ThreadContext);
  - Gets the context of a thread.

NTSTATUS NtIsProcessInJob (HANDLE ProcessHandle, HANDLE JobHandle);
  - Checks if a process is in a job.

BOOLEAN NtIsSystemResumeAutomatic ();
  - Checks if the system resume is automatic.
```

--------------------------------

### Registry Initialization

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

Function to initialize the registry based on boot conditions.

```APIDOC
NTSTATUS NtInitializeRegistry (USHORT BootCondition);
```

--------------------------------

### Thread and Context Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_vistasp0_x86_prototypes.txt

Functions for getting thread context and managing thread impersonation.

```APIDOC
NTSTATUS NtGetContextThread (HANDLE ThreadHandle, PCONTEXT ThreadContext);
  - Gets the context of a thread.

NTSTATUS NtIsProcessInJob (HANDLE ProcessHandle, HANDLE JobHandle);
  - Checks if a process is in a job.

BOOLEAN NtIsSystemResumeAutomatic ();
  - Checks if the system resume is automatic.
```

--------------------------------

### Driver and System Management

Source: https://github.com/panda-re/panda-ng/blob/main/plugins/syscalls2/generated-in/windows_8sp0_x86_prototypes.txt

Functions for loading drivers, listening on ports, and managing system power states.

```APIDOC
NTSTATUS NtLoadDriver (PUNICODE_STRING DriverServiceName);
NTSTATUS NtListenPort (HANDLE PortHandle, PPORT_MESSAGE ConnectionRequest);
NTSTATUS NtInitiatePowerAction (POWER_ACTION SystemAction, SYSTEM_POWER_STATE MinSystemState, ULONG Flags, BOOLEAN Asynchronous);
```