Cmd represents service state change request. It is sent to a service by the service manager, and should be actioned upon by the service.

Accepted is used to describe commands accepted by the service. Note that Interrogate is always accepted.

Key is a handle to an open Windows registry key. Keys can be obtained by calling OpenKey; there are also some predefined root keys such as CURRENT_USE

NTStatus corresponds with NTSTATUS, error values returned by ntdll.dll and other native functions.

State describes service execution state (Stopped, Running and so on).

Authorization Functions sys checkTokenMembership(tokenHandle Token, sidToCheck *SID, isMember *int32) (err error) = advapi32.CheckTokenMembership sys

This type is the union inside of TRUSTEE and must be created using one of the TrusteeValueFrom* functions.

Basic types

Wait status is 7 bits at bottom, either 0 (exited), 0x7F (stopped), or a signal number that caused an exit. The 0x80 bit is whether there was a core d

* * Wait */

Wait status is 7 bits at bottom, either 0 (exited), 0x7F (stopped), or a signal number that caused an exit. The 0x80 bit is whether there was a core d

CPU affinity

sys WTSQueryUserToken(session uint32, token *Token) (err error) = wtsapi32.WTSQueryUserToken sys WTSEnumerateSessions(handle Handle, reserved uint32,

BLKTRACE API

BLKPG ioctl: