Figure 1 Process and Thread APIs

GetProcessHandleCount
IsProcessInJob
IsWow64Process
CreateJobSet
GetProcessIdOfThread
GetThreadId
GetProcessId
GetThreadIOPendingFlag
GetCurrentProcessorNumber
SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx
RestoreLastError

Figure 2 ProcessesandThreads.cpp
//-------------------------------------------------------------------
// Matt Pietrek
// MSDN Magazine, 2003
// Program: ProcessesAndThreads
// Purpose: A demonstration of the Windows XP/Windows Server 2003 Process/
// Thread APIs
//-------------------------------------------------------------------
#include "stdafx.h"

// comment out to get just the XP APIs
#define W2K3SERVER  1

int main(int argc, char* argv[])
{
    DWORD dwThreadID = GetCurrentThreadId();
    DWORD dwProcessID = GetCurrentProcessId();
    printf( "ProcessId: %X  ThreadId: %X\n", dwProcessID, dwThreadID );

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID );
    if ( !hProcess )
    {
        printf( "unable to open process\n" );
        return 0;
    }

    // Show OpenThread()
    HANDLE hThread = OpenThread( THREAD_ALL_ACCESS, FALSE, dwThreadID );
    printf( "hProcess: %IX  hThread: %IX\n", hProcess, hThread );

    // Show GetProcessHandleCount()
    DWORD dwHandleCount;
    GetProcessHandleCount( hProcess, &dwHandleCount );
    printf( "Handle Count: %u\n", dwHandleCount );

    // Show IsProcessInJob()
    BOOL bIsInJob;
    IsProcessInJob( hProcess, NULL, &bIsInJob );
    printf( "IsProcessInJob: %s\n", bIsInJob ? "true" : "false" );

    // Show GetProcessId()
    printf( "Process ID from hProcess: %X\n", GetProcessId( hProcess ) );

    // Show IsWow64Process
    BOOL bIsWow64Process;
    IsWow64Process( hProcess, &bIsWow64Process );
    printf( "IsWow64Process: %s\n", bIsWow64Process ? "true" : "false" );

    BOOL bIOIsPending;
    GetThreadIOPendingFlag( hThread, &bIOIsPending );
    printf( "IoIsPending: %s\n", bIOIsPending ? "true" : "false" );

#ifdef W2K3SERVER
    // Show GetProcessWorkingSetSizeEx()
    DWORD wsFlags;
    SIZE_T wsSizeMin, wsSizeMax;
    GetProcessWorkingSetSizeEx( hProcess, &wsSizeMin, &wsSizeMax, 
                                &wsFlags );
    printf( "Working Set: min:%IX  max:%IX  flags:%X\n",
            wsSizeMin, wsSizeMax, wsFlags );

    // Show GetProcessIdOfThread()
    DWORD dwProcessIdFromThread = GetProcessIdOfThread( hThread );
    printf("Process ID obtained from thread ID: %X\n", 
           dwProcessIdFromThread);

    // Show GetThreadId();
    printf("Thread ID obtained from thread handle: 
           %X\n",GetThreadId(hThread));

#endif

    return 0;
}

Figure 3 Fiber APIs

FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ConvertFiberToThread
ConvertThreadToFiberEx
CreateFiberEx

Figure 5 VEHDemo.cpp
//-------------------------------------------------------------------
// Matt Pietrek
// MSDN Magazine, 2003
// Program: VEHDemo
// Purpose: A demonstration of Vectored Exception Handling
//-------------------------------------------------------------------

#define WIN32_LEAN_AND_MEAN
#define _WIN32_WINNT 0x0501
#include <stdio.h>
#include <tchar.h>
#include <windows.h>

LONG
WINAPI VectoredExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)
{
    // Stupid handler that does nothing except print out the faulting EIP
    printf( "In VectoredExceptionHandler, EIP =%p\n",
            (PVOID)(DWORD_PTR)ExceptionInfo->ContextRecord->Eip );

    // Don't handle the exception here.  Let normal processing continue
    return EXCEPTION_CONTINUE_SEARCH;
}

LONG
WINAPI SecondVectoredExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)
{
    // If the faulting EIP points to a HLT instruction, just skip past
    // it, to show us "Handling" an exception
    if ( *(PBYTE)ExceptionInfo->ContextRecord->Eip == 0xF4 )
    {
        printf( "In SecondVectoredExceptionHandler - handling it\n" );
        ExceptionInfo->ContextRecord->Eip++;
        return EXCEPTION_CONTINUE_EXECUTION;
    }
    else    // For everything else, we won't handle the exception here
    {
        printf("In SecondVectoredExceptionHandler - NOT handling it\n");
        return EXCEPTION_CONTINUE_SEARCH;
    }
}

int _tmain(int argc, _TCHAR* argv[])
{
    // Add a vectored exception handler.  In fact, add the same
    // handler 3 times, to prove that they handlers are stored
    // in a linked list.  This handler always returns "keep looking"
    AddVectoredExceptionHandler( 1, VectoredExceptionHandler );
    AddVectoredExceptionHandler( 1, VectoredExceptionHandler );
    AddVectoredExceptionHandler( 1, VectoredExceptionHandler );

    // And a second vectored handler that knows how to handle a HLT
    // caused exception, but nothing else
    AddVectoredExceptionHandler( 0, SecondVectoredExceptionHandler );

    __try
    {
        __asm   HLT         // Cause a privileged instruction fault
        *(int *)0 = 0;      // Access Violate by dereferencing NULL ptr
    }
    __except( EXCEPTION_EXECUTE_HANDLER )
    {   // This handler will catch the *(int *)0 = 0 fault
        printf( "Caught the exception in Function1\n" );
    }

    return 0;
}

Figure 6 VEHDemo Output
In VectoredExceptionHandler, EIP =00411BBA
In VectoredExceptionHandler, EIP =00411BBA
In VectoredExceptionHandler, EIP =00411BBA
In SecondVectoredExceptionHandler - handling it
In VectoredExceptionHandler, EIP =00411BBB
In VectoredExceptionHandler, EIP =00411BBB
In VectoredExceptionHandler, EIP =00411BBB
In SecondVectoredExceptionHandler - NOT handling it
Caught the exception in Function1

Figure 7 Directory and File APIs

GetDllDirectory / SetDllDirectory
NeedCurrentDirectoryForExePath
GetSystemWow64Directory
SetFileShortName
CheckNameLegalDOS8Dot3
SetFileValidData
GetVolumePathNamesForVolumeName
FindFirstStream / FindNextStream
ReOpenFile

Figure 8 FindFirstStream.cpp
//-------------------------------------------------------------------
// Matt Pietrek
// MSDN Magazine, 2003
// Program: FindFirstStream
// Purpose: A demonstration of the Windows XP/Windows Server 2003 File 
// Stream APIs
//-------------------------------------------------------------------
#include "stdafx.h"

int main(int argc, char * argv[])
{
    if ( argc != 2 )
        return 0;

    WIN32_FIND_STREAM_DATA streamData;

    wchar_t wszFileName[512];
    mbstowcs( wszFileName, argv[1], 0xFFFFFFFF );
    HANDLE h = FindFirstStreamW( wszFileName, FindStreamInfoStandard,
                                &streamData, 0 );
    if ( h == (HANDLE)ERROR_INVALID_HANDLE )
    {
        // printf( "unable to being stream enum for file %s\n", argv[1] );
        return 0;
    }
    while ( 1 )
    {
        if ( !FindNextStreamW( h, &streamData ) )
            break;
        printf( "%ls%ls\n", wszFileName, streamData.cStreamName );
    }

    // Do we need to close the stream handle???

    return 0;
}

Figure 9 System Information APIs

GetLargePageMinimum
GetSystemRegistryQuota
GetSystemTimes
GetNativeSystemInfo
TzSpecificLocalTimeToSystemTime
SetFirmwareEnvironmentVariable
GetFirmwareEnvironmentVariable
CreateMemoryResourceNotification
QueryMemoryResourceNotification
GetLogicalProcessorInformation

Figure 10 SystemInfo.cpp
//-------------------------------------------------------------------
// Matt Pietrek
// MSDN Magazine, 2003
// Program: SystemInfo
// Purpose: A demo of the Windows XP/Windows Server 2003 System Info APIs
//-------------------------------------------------------------------
#include "stdafx.h"

// Uncomment to get Windows Server 2003 APIs as well
// #define W2K3SERVER   1

int main(int argc, char * argv[])
{
    // Show GetSystemRegistryQuota();
    DWORD dwQuotaAllowed, dwQuotaUsed;
    GetSystemRegistryQuota( &dwQuotaAllowed, &dwQuotaUsed );
    printf( "Quota allowed: %uK, Quota used: %uK\n",
            dwQuotaAllowed/1024, dwQuotaUsed / 1024 );

    // Show GetSystemTimes()
    FILETIME IdleTime;
    FILETIME KernelTime;
    FILETIME UserTime;
    GetSystemTimes( &IdleTime, &KernelTime, &UserTime );

    const DWORD filetimeDivisor = 1000000000 / 100;

    printf( "IdleTime:   %I64u seconds\n",
        *(PDWORD64)&IdleTime / filetimeDivisor );

    printf( "KernelTime: %I64u seconds\n",
        *(PDWORD64)&KernelTime / filetimeDivisor );

    printf( "UserTime:   %I64u seconds\n",
        *(PDWORD64)&UserTime / filetimeDivisor );

    // Show GetNativeSystemInfo().  If you're running in a WOW session
    // (e.g., an X86 app running on IA64), it'll return the capabilities
    // of the actual OS, not the WOW info.  If not running in WOW, you'll
    // get the same info as GetSystemInfo
    SYSTEM_INFO sysInfo;
    GetNativeSystemInfo( &sysInfo );
    printf( "Native System Info - Processor type: %u  page size: %X\n",
            sysInfo.dwProcessorType, sysInfo.dwPageSize );

#ifdef W2K3SERVER
    printf( "Large Page Minimum size: %IX\n", GetLargePageMinimum() );
#endif
    return 0;
}

Figure 11 ActCtx APIs

CreateActCtx
AddRefActCtx
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetCurrentActCtx
QueryActCtx
ZombifyActCtx
FindActCtxSectionString
FindActCtxSectionGuid

Figure 12 USER32 APIs

Raw Input APIs
GetRawInputData
GetRawInputDeviceInfo
GetRawInputBuffer
RegisterRawInputDevices
GetRegisteredRawInputDevices
GetRawInputDeviceList
DefRawInputProc
Other New APIs
PrintWindow
IsGUIThread
GetWindowRgnBox
BroadcastSystemMessageEx
DisableProcessWindowsGhosting

Figure 13 Credential APIs

CredRead
CredWrite
CredRename
CredEnumerate
CredDelete
CredFree
CredGetSessionTypes
CredGetTargetInfo
CredMarshalCredential
CredIsMarshaledCredential
CredReadDomainCredentials
CredWriteDomainCredentials
CredProfileLoaded
CredUnmarshalCredential
CredUIPromptForCredentials
CredUICmdLinePromptForCredentials
CredUIParseUserName
CredUIConfirmCredentials
CredUIStoreSSOCred

Figure 14 Credential
//-------------------------------------------------------------------
// Matt Pietrek
// MSDN Magazine, 2003
// Program: Credential
// Purpose: A demonstration of the Windows XP/ Windows Server 2003 
// Credential APIs
//-------------------------------------------------------------------
#include "stdafx.h"

int _tmain(int argc, _TCHAR* argv[])
{
    PCREDENTIAL * pCreds;
    DWORD cCreds;

    CredEnumerate( NULL, 0, &cCreds, &pCreds );

    for ( DWORD i = 0; i < cCreds; i++ )
    {
        PCREDENTIAL p = pCreds[i];
        printf( "Flags:%X  Type:%X  Target: %s  User: %s\n",
            p->Flags, p->Type, p->TargetName, p->UserName );
    }

    CredFree( pCreds );

    return 0;
}

Figure 15 More APIs

Safer APIs
SaferGetPolicyInformation
SaferSetPolicyInformation
SaferCreateLevel
SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
SaferGetLevelInformation
SaferSetLevelInformation
SaferRecordEventLogEntry
Event Tracing APIs
TraceMessage
TraceMessageVA
EnumerateTraceGUIDs
FlushTrace