pinvoke.net: Search Results

Summary

Closes a previously opened handle.

[DllImport("ntdll.dll", ExactSpelling=true, SetLastError=false)]

static extern int NtClose(IntPtr hObject);

<DllImport("ntdll.dll", ExactSpelling:=True, SetLastError:=False)> _

Public Shared Function NtClose(ByVal hObject As IntPtr) As Integer

Alternative Managed API:

Do you know one? Please contribute it!

The same functionality as CloseHandle().

Sample Code:

Please add some!

Documentation

[NtClose] on MSDN

[DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true)]

public static extern int NtCreateFile(out SafeFileHandle handle, FileAccess access, OBJECT_ATTRIBUTES* objectAttributes, IO_STATUS_BLOCK* ioStatus, ref long allocSize, uint fileAttributes, FileShare share, uint createDisposition, uint createOptions, IntPtr eaBuffer, uint eaLength);

[DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true)]

public static extern int NtCreateFile(

out Microsoft.Win32.SafeHandles.SafeFileHandle handle,

System.IO.FileAccess access,

ref IO_STATUS_BLOCK ioStatus,

ref long allocSize,

uint fileAttributes,

System.IO.FileShare share,

uint eaLength);

Declare Function NtCreateFile Lib "ntdll.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

To Get the handle when you know the File Reference number.

[StructLayout(LayoutKind.Sequential, Pack = 0)]

public struct IO_STATUS_BLOCK

public uint status;

public IntPtr information;

[StructLayout(LayoutKind.Sequential,Pack=0)]

public struct OBJECT_ATTRIBUTES

public Int32 Length;

public IntPtr RootDirectory;

public IntPtr ObjectName;

public uint Attributes;

public IntPtr SecurityDescriptor;

public IntPtr SecurityQualityOfService;

[StructLayout(LayoutKind.Sequential, Pack=0)]

public struct UNICODE_STRING

public ushort Length;

public ushort MaximumLength;

public IntPtr Buffer;

GetPathFromFileReference(UInt64 frn)

UInt32 FILE_OPEN = 0x1;

UInt32 FILE_OPEN_BY_FILE_ID = 0x2000;

UInt32 FILE_OPEN_FOR_BACKUP_INTENT = 0x4000;

IntPtr _RootHandle; //This will need to be initialized with the root handle, can use CreateFile from kernel32.dll

long allocSize = 0;

IO_STATUS_BLOCK ioStatusBlock = new IO_STATUS_BLOCK();

Microsoft.Win32.SafeHandles.SafeFileHandle hFile;

IntPtr buffer = Marshal.AllocHGlobal(4096);

IntPtr refPtr = Marshal.AllocHGlobal(8);

IntPtr objAttIntPtr = Marshal.AllocHGlobal(Marshal.SizeOf(objAttributes));

//frn = file reference number which is a UInt64

Marshal.WriteInt64(refPtr, (long)frn);

unicodeString.Length = 8;

unicodeString.MaximumLength = 8;

objAttributes.Length = System.Convert.ToInt32(Marshal.SizeOf(objAttributes));

objAttributes.RootDirectory = _RootHandle;

objAttributes.SecurityQualityOfService = IntPtr.Zero;

int fOk = Win32Api.NtCreateFile(

out hFile,

FileAccess.Read,

ref ioStatusBlock,

ref allocSize,

System.IO.FileShare.Read ,

FILE_OPEN,

FILE_OPEN_BY_FILE_ID | FILE_OPEN_FOR_BACKUP_INTENT,

//Use NtQueryInformationFile to get information on the file such as path

Documentation

[NtCreateFile] on MSDN

[DllImport("ntdll.dll", SetLastError=true)]

<DllImport("ntdll")> Private Shared Function NtGetContextThread(ByVal hThr As IntPtr, ByVal CNTXT As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Summary

Creates a new file or directory, or opens an existing file, device, directory, or volume.

[DllImport("ntdll.dll")]

public static extern int NtOpenDirectoryObject(

out SafeFileHandle DirectoryHandle,

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

SafeFileHandle h;

var buf = Marshal.AllocHGlobal(bufsz);

uint context = 0, len;

true, context == 0, ref context, out len);

Marshal.PtrToStructure(buf, typeof(OBJECT_DIRECTORY_INFORMATION));

Marshal.FreeHGlobal(buf);

Summary

Opens an existing symbolic link.

[DllImport("ntdll.dll")]

public static extern int NtOpenSymbolicLinkObject(

out SafeFileHandle LinkHandle,

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

static string GetSymbolicLinkTarget(string name)

SafeFileHandle h;

var st = Win32.NtOpenSymbolicLinkObject(

if (st < 0) return null;

int len;

st = Win32.NtQuerySymbolicLinkObject(h, ref buf, out len);

if (st < 0) return null;

cf. NtQuerySymbolicLinkObject

Documentation

[NtOpenSymbolicLinkObject] on MSDN

[DllImport("ntdll.dll")]

public static extern int NtQueryDirectoryObject(

SafeFileHandle DirectoryHandle,

int Length,

bool ReturnSingleEntry,

bool RestartScan,

out uint ReturnLength);

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

[DllImport("ntdll.dll", SetLastError=true)] static extern IntPtr NtQueryInformationFile(IntPtr fileHandle, ref IO_STATUS_BLOCK IoStatusBlock, IntPtr pInfoBlock, uint length, FILE_INFORMATION_CLASS fileInformation);

Declare Function NtQueryInformationFile Lib "ntdll.dll" (ByVal fileHandle As IntPtr, ByRef IoStatusBlock As IO_STATUS_BLOCK, ByVal pInfoBlock As IntPtr, ByVal length As UInteger, ByVal fileInformation As FILE_INFORMATION_CLASS) As IntPtr

Structure IO_STATUS_BLOCK

Dim information As ULong

Enum FILE_INFORMATION_CLASS

FileDirectoryInformation = 1

FileFullDirectoryInformation

FileBothDirectoryInformation

FileBasicInformation

FileStandardInformation

FileInternalInformation

FileEaInformation

FileAccessInformation

FileNameInformation

FileRenameInformation

FileLinkInformation

FileNamesInformation

FileDispositionInformation

FilePositionInformation

FileFullEaInformation

FileModeInformation = 16

FileAlignmentInformation

FileAllInformation

FileAllocationInformation

FileEndOfFileInformation

FileAlternateNameInformation

FileStreamInformation

FilePipeInformation

FilePipeLocalInformation

FilePipeRemoteInformation

FileMailslotQueryInformation

FileMailslotSetInformation

FileCompressionInformation

FileObjectIdInformation

FileCompletionInformation

FileMoveClusterInformation

FileQuotaInformation

FileReparsePointInformation

FileNetworkOpenInformation

FileAttributeTagInformation

FileTrackingInformation

FileIdBothDirectoryInformation

FileIdFullDirectoryInformation

FileValidDataLengthInformation

FileShortNameInformation

FileHardLinkInformation = 46

struct IO_STATUS_BLOCK

ulong information;

enum FILE_INFORMATION_CLASS

FileDirectoryInformation = 1, // 1

FileFullDirectoryInformation, // 2

FileBothDirectoryInformation, // 3

FileBasicInformation, // 4

FileStandardInformation, // 5

FileInternalInformation, // 6

FileEaInformation, // 7

FileAccessInformation, // 8

FileNameInformation, // 9

FileRenameInformation, // 10

FileLinkInformation, // 11

FileNamesInformation, // 12

FileDispositionInformation, // 13

FilePositionInformation, // 14

FileFullEaInformation, // 15

FileModeInformation = 16, // 16

FileAlignmentInformation, // 17

FileAllInformation, // 18

FileAllocationInformation, // 19

FileEndOfFileInformation, // 20

FileAlternateNameInformation, // 21

FileStreamInformation, // 22

FilePipeInformation, // 23

FilePipeLocalInformation, // 24

FilePipeRemoteInformation, // 25

FileMailslotQueryInformation, // 26

FileMailslotSetInformation, // 27

FileCompressionInformation, // 28

FileObjectIdInformation, // 29

FileCompletionInformation, // 30

FileMoveClusterInformation, // 31

FileQuotaInformation, // 32

FileReparsePointInformation, // 33

FileNetworkOpenInformation, // 34

FileAttributeTagInformation, // 35

FileTrackingInformation, // 36

FileIdBothDirectoryInformation, // 37

FileIdFullDirectoryInformation, // 38

FileValidDataLengthInformation, // 39

FileShortNameInformation, // 40

FileHardLinkInformation=46 // 46

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

// Copyright Alex Shvedov

// Feel free to use this sample code in any way you want.

using System.Runtime.InteropServices; // for DllImport and friends

using Microsoft.Win32.SafeHandles; // for SafeHandle

using System.Collections.Generic; // for ParseFileAttributes helper function (List<FileAttributes> only

using System.IO; // for test main (FileStream) only

using System.Text; // for test main (Encoding) only

using System.Threading; // for test main (Thread.Sleep) only

using System.Diagnostics; // for test main (Trace.Write[Line]) only

public class Nt {

struct IO_STATUS_BLOCK {

internal uint status;

internal ulong information;

enum FILE_INFORMATION_CLASS {

FileDirectoryInformation = 1, // 1

FileFullDirectoryInformation, // 2

FileBothDirectoryInformation, // 3

FileBasicInformation, // 4

FileStandardInformation, // 5

FileInternalInformation, // 6

FileEaInformation, // 7

FileAccessInformation, // 8

FileNameInformation, // 9

FileRenameInformation, // 10

FileLinkInformation, // 11

FileNamesInformation, // 12

FileDispositionInformation, // 13

FilePositionInformation, // 14

FileFullEaInformation, // 15

FileModeInformation = 16, // 16

FileAlignmentInformation, // 17

FileAllInformation, // 18

FileAllocationInformation, // 19

FileEndOfFileInformation, // 20

FileAlternateNameInformation, // 21

FileStreamInformation, // 22

FilePipeInformation, // 23

FilePipeLocalInformation, // 24

FilePipeRemoteInformation, // 25

FileMailslotQueryInformation, // 26

FileMailslotSetInformation, // 27

FileCompressionInformation, // 28

FileObjectIdInformation, // 29

FileCompletionInformation, // 30

FileMoveClusterInformation, // 31

FileQuotaInformation, // 32

FileReparsePointInformation, // 33

FileNetworkOpenInformation, // 34

FileAttributeTagInformation, // 35

FileTrackingInformation, // 36

FileIdBothDirectoryInformation, // 37

FileIdFullDirectoryInformation, // 38

FileValidDataLengthInformation, // 39

FileShortNameInformation, // 40

FileHardLinkInformation = 46 // 46

[StructLayout(LayoutKind.Explicit)]

struct FILE_BASIC_INFORMATION {

[FieldOffset(0)]

internal long CreationTime;

[FieldOffset(8)]

internal long LastAccessTime;

[FieldOffset(16)]

internal long LastWriteTime;

[FieldOffset(24)]

internal long ChangeTime;

[FieldOffset(32)]

internal ulong FileAttributes;

[DllImport("ntdll.dll", SetLastError = true)]

static extern IntPtr NtQueryInformationFile(SafeFileHandle fileHandle, ref IO_STATUS_BLOCK IoStatusBlock, IntPtr pInfoBlock, uint length, FILE_INFORMATION_CLASS fileInformation);

#region converter of bit-wise file attributes into a list

public static List<FileAttributes> ParseFileAttributes(ulong fileAttributes) {

List<FileAttributes> listOfFileAttributesPresent = new List<FileAttributes>();

FileAttributes[] allPossibleValues = new FileAttributes[] { // per definition of FileAttributes

FileAttributes.ReadOnly,

FileAttributes.Hidden,

FileAttributes.System,

FileAttributes.Directory,

FileAttributes.Archive,

FileAttributes.Device,

FileAttributes.Normal,

FileAttributes.Temporary,

FileAttributes.SparseFile,

FileAttributes.ReparsePoint,

FileAttributes.Compressed,

FileAttributes.Offline,

FileAttributes.NotContentIndexed,

FileAttributes.Encrypted,

foreach(FileAttributes currentFileAttribute in allPossibleValues) {

if((fileAttributes & (ulong)currentFileAttribute) != 0) {

listOfFileAttributesPresent.Add(currentFileAttribute);

return listOfFileAttributesPresent;

#endregion converter of bit-wise file attributes into a list

#region change time available only thru NtQueryInformationFile and only on NTFS volume

public static bool GetFourFileTimes(string path2file,

out DateTime creationTime, out DateTime lastAccessTime, out DateTime lastWriteTime, out DateTime changeTime, out ulong fileAttributes, out string errMsg) {

bool brc = false;

creationTime = default(DateTime);

lastAccessTime = default(DateTime);

lastWriteTime = default(DateTime);

changeTime = default(DateTime);

fileAttributes = 0;

FILE_BASIC_INFORMATION fbi = new FILE_BASIC_INFORMATION();

IO_STATUS_BLOCK iosb = new IO_STATUS_BLOCK();

using(FileStream fs = new FileStream(path2file, FileMode.Open, FileAccess.Read, FileShare.Read)) {

p_fbi = Marshal.AllocHGlobal(Marshal.SizeOf(fbi));

IntPtr iprc = NtQueryInformationFile(fs.SafeFileHandle, ref iosb, p_fbi, (uint)Marshal.SizeOf(fbi), FILE_INFORMATION_CLASS.FileBasicInformation);

brc = false;

fbi = (FILE_BASIC_INFORMATION)Marshal.PtrToStructure(p_fbi, typeof(FILE_BASIC_INFORMATION));

creationTime = DateTime.FromFileTime(fbi.CreationTime);

lastAccessTime = DateTime.FromFileTime(fbi.LastAccessTime);

lastWriteTime = DateTime.FromFileTime(fbi.LastWriteTime);

changeTime = DateTime.FromFileTime(fbi.ChangeTime);

fileAttributes = fbi.FileAttributes;

brc = false; // JIC

} finally {

if(p_fbi != IntPtr.Zero) { Marshal.FreeHGlobal(p_fbi); }

#endregion change time available only thru NtQueryInformationFile and only on NTFS volume

// create a test file:

string path2file = "test.fle";

string contents = "contents of test.fle";

Trace.WriteLine("path2file=" + path2file);

using(FileStream fs = File.Create(path2file)) {

fs.Write(Encoding.ASCII.GetBytes(contents), 0, Encoding.ASCII.GetBytes(contents).Length);

FileAttributes fileAttributesBefore = File.GetAttributes(path2file);

Trace.Write("fileAttributesBefore=");

foreach(FileAttributes fa1 in Nt.ParseFileAttributes((ulong)fileAttributesBefore)) {

Trace.WriteLine("");

// wait a little (1.5 sec) and modify test file attributes:

Thread.Sleep(1500);

File.SetAttributes(path2file, FileAttributes.Normal);

Trace.WriteLine("");

DateTime creationTime, lastAccessTime, lastWriteTime, changeTime;

ulong fileAttributesAfter;

bool brc = false;

brc = Nt.GetFourFileTimes(path2file, out creationTime, out lastAccessTime, out lastWriteTime, out changeTime, out fileAttributesAfter, out errMsg);

// print results:

Trace.WriteLine("Error: " + errMsg);

} else {

Trace.Write("fileAttributesAfter=");

foreach(FileAttributes fa1 in Nt.ParseFileAttributes(fileAttributesAfter)) {

Trace.WriteLine("");

Trace.WriteLine("lastWriteTime= " + lastWriteTime.ToString("o"));

Trace.WriteLine("creationTime= " + creationTime.ToString("o"));

Trace.WriteLine("lastAccessTime=" + lastAccessTime.ToString("o"));

Trace.WriteLine("changeTime= " + changeTime.ToString("o"));

// sample printout:

//path2file=test.fle

//fileAttributesBefore=Archive

//fileAttributesAfter=Normal

//lastWriteTime= 2011-03-13T13:40:46.1003635-04:00

//lastAccessTime=2011-03-13T13:40:04.8263635-04:00

Documentation

[NtQueryInformationFile] on MSDN

For FILE_INFORMATION_CLASS, see: http://msdn.microsoft.com/en-us/library/cc232064.aspx

Summary

Retrieves information about the specified process. This function is available in Windows 2000 and Windows XP, but it may be altered or unavailable in subsequent versions.

[DllImport("ntdll.dll", SetLastError=true)]

static extern int NtQueryInformationProcess(IntPtr processHandle,

int processInformationClass, IntPtr processInformation, uint processInformationLength,

IntPtr returnLength);

[DllImport("NTDLL.DLL", SetLastError=true)]

static extern int NtQueryInformationProcess(IntPtr hProcess, PROCESSINFOCLASS pic,

Declare Function NtQueryInformationProcess Lib "ntdll.dll" ( _

processHandle As IntPtr, processInformationClass As Integer, _

processInformation As IntPtr, processInformationLength As Integer, _

returnLength As IntPtr) As Integer

Please add some!

Sample Code:

public static IntPtr GetPEBAddress()

//Get a handle to our own process

IntPtr hProc = OpenProcess(0x001F0FFF, false, Process.GetCurrentProcess().Id);

//Allocate memory for a new PROCESS_BASIC_INFORMATION structure

IntPtr pbi = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION)));

//Allocate memory for a long

IntPtr outLong = Marshal.AllocHGlobal(sizeof(long));

int queryStatus = false;

//Store API call success in a boolean

queryStatus = NtQueryInformationProcess(hProc, 0, pbi, (uint)Marshal.SizeOf(typeof(PROCESS_BASIC_INFORMATION)), outLong);

//Close handle and free allocated memory

CloseHandle(hProc);

Marshal.FreeHGlobal(outLong);

//STATUS_SUCCESS = 0, so if API call was successful querySuccess should contain 0 ergo we reverse the check.

//Free allocated space

Marshal.FreeHGlobal(pbi);

public static int GetParentProcessId()

//Get a handle to our own process

IntPtr hProc = OpenProcess((ProcessAccessFlags)0x001F0FFF, false, Process.GetCurrentProcess().Id);

int queryStatus = NtQueryInformationProcess(hProc, (PROCESSINFOCLASS)0, ref pbi, pbi.Size, out sizeInfoReturned);

finally

if (!hProc.Equals(IntPtr.Zero))

//Close handle and free allocated memory

CloseHandle(hProc);

Alternative Managed API:

Do you know one? Please contribute it!

[DllImport("ntdll.dll")]

public static extern NtStatus NtQueryObject(IntPtr objectHandle, OBJECT_INFORMATION_CLASS informationClass, IntPtr informationPtr, uint informationLength, ref uint returnLength);

Declare Function NtQueryObject Lib "ntdll.dll" (TODO) As TODO

NtStatus, OBJECT_INFORMATION_CLASS

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

//helper method with "dynamic" buffer allocation

public static IntPtr NtQueryObject(IntPtr handle, OBJECT_INFORMATION_CLASS infoClass, uint infoLength = 0)

if (infoLength == 0)

infoLength = (uint)Marshal.SizeOf(typeof(uint));

IntPtr infoPtr = Marshal.AllocHGlobal((int)infoLength);

NtStatus result;

while (true)

result = NtQueryObject(handle, infoClass, infoPtr, infoLength, ref infoLength);

if (result == NtStatus.InfoLengthMismatch || result == NtStatus.BufferOverflow || result == NtStatus.BufferTooSmall)

Marshal.FreeHGlobal(infoPtr);

infoPtr = Marshal.AllocHGlobal((int)infoLength);

else if (result == NtStatus.Success || tries > 5)

else

//throw new Exception("Unhandled NtStatus " + result);

if (result == NtStatus.Success)

return infoPtr;//don't forget to free the pointer with Marshal.FreeHGlobal after you're done with it

else

Marshal.FreeHGlobal(infoPtr);//free pointer when not Successful

Summary

Retrieves the target of a symbolic link.

[DllImport("ntdll.dll")]

public static extern int NtQuerySymbolicLinkObject(

SafeFileHandle LinkHandle,

ref UNICODE_STRING LinkTarget,

out int ReturnedLength);

Alternative Managed API:

Do you know one? Please contribute it!

Requires buffers. For example:

int len;

NtQuerySymbolicLinkObject(h, ref buffer, out len);

Debug.WriteLine(buffer.ToString());

Sample Code:

cf. NtOpenSymbolicLinkObject

Documentation

[NtQuerySymbolicLinkObject] on MSDN

Summary

Retrieves the specified system information. Specify the information you want, a pointer to hold the results.

/// <param name="InfoClass">indicate the kind of system information to be retrieved</param>

/// <param name="Size">The allocation size of the buffer pointed to by Info</param>

/// <param name="Length">If null, ignored. Otherwise tells you the size of the information returned by the kernel.</param>

/// http://msdn.microsoft.com/en-us/library/windows/desktop/ms724509%28v=vs.85%29.aspx

[DllImport("ntdll.dll")]

public static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, uint Size, out uint Length);

Declare Function NtQuerySystemInformation Lib "ntdll.dll" (TODO) As TODO

NtStatus, SYSTEM_INFORMATION_CLASS

Please add some!

Sample Code:

//helper method with "dynamic" buffer allocation

public static IntPtr NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS infoClass, uint infoLength = 0)

if (infoLength == 0)

infoLength = 0x10000;

var infoPtr = Marshal.AllocHGlobal((int)infoLength);

while (true)

var result = NtQuerySystemInformation(infoClass, infoPtr, infoLength, out infoLength);

if (result == NtStatus.Success)

Marshal.FreeHGlobal(infoPtr); //free pointer when not Successful

if (result != NtStatus.InfoLengthMismatch && result != NtStatus.BufferOverflow && result != NtStatus.BufferTooSmall)

//throw new Exception("Unhandled NtStatus " + result);

infoPtr = Marshal.AllocHGlobal((int)infoLength);

public void Test()

result = 0;

NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION

MemoryList;

arr = new Int32[] { (Int32)Commands.MEMORYLIST };

buff = Marshal.AllocHGlobal(1024); // should be more than adequate

result = (UInt32)NativeMethods.NtQuerySystemInformation(NativeMethods.SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation, buff, result, out returnSize);

if (result != 0)

// Most likely error is InfoLengthMismatch = 0xc0000004 -- meaning you need to make the buffer larger

throw new System.ComponentModel.Win32Exception(((NativeMethods.NtStatus)result).ToString());

if (NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION_SIZE == 0)

NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION_SIZE = returnSize;

MemoryList = (NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION)Marshal.PtrToStructure(buff, typeof(NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION));

finally

Marshal.FreeHGlobal(buff);

[DllImport("ntdll.dll", SetLastError=true)]

public static extern uint NtQuerySystemTime(out long SystemTime);

Declare Function NtQuerySystemTime Lib "ntdll.dll" (Currency) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

long t;

MessageBox.Show(DateTime.FromFileTime(t).ToString());

Summary

Returns the resolution of the system Timer in the context of the calling process.

[DllImport("ntdll.dll", SetLastError=true)]

static extern int NtQueryTimerResolution(out int MinimumResolution, out int MaximumResolution, out int CurrentResolution);

Please add some!

Sample Code:

Please add some!

Documentation

[NtQueryTimerResolution] on MSDN

Summary

Resumes a suspended process. Pass the process handle from "OpenProcess"

[DllImport("ntdll.dll", SetLastError = true)]

public static extern IntPtr NtResumeProcess(IntPtr ProcessHandle);

<DllImport("ntdll.dll", SetLastError:=True)> _

Public Shared Function NtResumeProcess(ByVal ProcessHandle As IntPtr) As IntPtr

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

/// <param name="InfoClass"></param>

/// <param name="Length">Allocated bytes for the Info block</param>

/// <returns>Opposite of boolean. Zero means success, non-zero means fail and use GetLastError</returns>

[DllImport("ntdll.dll")]

static extern UInt32 NtSetSystemInformation(NtSystemInformation.SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, UInt32 Length);

Declare Function NtSetSystemInformation Lib "ntdll.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

/// <param name="InfoClass"></param>

public static void SetSystemInformation(NtSystemInformation.SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, UInt32 Length)

result = NtSetSystemInformationKernel(InfoClass, Info, Length);

if (result != 0)

Summary

Sets the resolution of the system Timer in the calling process context.

[DllImport("ntdll.dll", SetLastError=true)]

static extern int NtSetTimerResolution(int DesiredResolution, bool SetResolution, out int CurrentResolution );

Declare Function NtSetTimerResolution Lib "ntdll.dll" (ByVal DesiredResolution as UInteger, ByVal SetResolution as Boolean, ByRef CurrentResolution as UInteger)

Please add some!

Sample Code:

NtSetTimerResolution(0.5, True, 0)

Please add some!

Documentation

[NtSetTimerResolution] on MSDN

Summary

Suspends a process. Argument ProcessHandle is the handle of the process.

[DllImport("ntdll.dll", SetLastError = false)]

public static extern IntPtr NtSuspendProcess(IntPtr ProcessHandle);

<DllImport("ntdll.dll", SetLastError:=False)> _

Public Shared Function NtSuspendProcess(ByVal ProcessHandle As IntPtr) As IntPtr

Alternative Managed API:

Please add some!

Sample Code:

Please add some!

[DllImport("ntdll.dll", SetLastError=true)]

<DllImport("ntdll")> Private Shared Function NtUnmapViewOfSection(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr) As UInteger

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

private enum PROCESSINFOCLASS: int

ProcessQuotaLimits, // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX

ProcessTimes, // q: KERNEL_USER_TIMES

ProcessRaisePriority, // s: ULONG

ProcessDebugPort, // q: HANDLE

ProcessExceptionPort, // s: HANDLE

ProcessLdtInformation, // 10

ProcessLdtSize,

ProcessDefaultHardErrorMode, // qs: ULONG

ProcessIoPortHandlers, // (kernel-mode only)

ProcessPooledUsageAndLimits, // q: POOLED_USAGE_AND_LIMITS

ProcessUserModeIOPL,

ProcessEnableAlignmentFaultFixup, // s: BOOLEAN

ProcessPriorityClass, // qs: PROCESS_PRIORITY_CLASS

ProcessHandleCount, // 20, q: ULONG, PROCESS_HANDLE_INFORMATION

ProcessPriorityBoost, // qs: ULONG

ProcessWow64Information, // q: ULONG_PTR

ProcessImageFileName, // q: UNICODE_STRING

ProcessLUIDDeviceMapsEnabled, // q: ULONG

ProcessBreakOnTermination, // qs: ULONG

ProcessDebugObjectHandle, // 30, q: HANDLE

ProcessDebugFlags, // qs: ULONG

ProcessHandleTracing, // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables, otherwise enables

ProcessIoPriority, // qs: ULONG

ProcessExecuteFlags, // qs: ULONG

ProcessCookie, // q: ULONG

ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION

ProcessPagePriority, // q: ULONG

ProcessInstrumentationCallback, // 40

ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX

ProcessImageFileNameWin32, // q: UNICODE_STRING

ProcessImageFileMapping, // q: HANDLE (input)

ProcessMemoryAllocationMode, // qs: PROCESS_MEMORY_ALLOCATION_MODE

ProcessTokenVirtualizationEnabled, // s: ULONG

ProcessConsoleHostProcess, // q: ULONG_PTR

ProcessHandleInformation, // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since WIN8

ProcessMitigationPolicy, // s: PROCESS_MITIGATION_POLICY_INFORMATION

ProcessDynamicFunctionTableInformation,

ProcessHandleCheckingMode,

ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION

ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION

MaxProcessInfoClass

Declare Function PROCESSINFOCLASS Lib "ntdll.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[PROCESSINFOCLASS] on MSDN

Summary

Return Type is NTSTATUS but too long type definition to wrote this page

[DllImport("ntdll.dll", SetLastError = true)]

public static extern IntPtr RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege,

bool IsThreadPrivilege, out bool PreviousValue);

Public Declare Function RtlAdjustPrivilege Lib "ntdll.dll" (ByVal Privilege As Integer, ByVal bEnablePrivilege As Boolean, ByVal IsThreadPrivilege As Boolean, ByRef PreviousValue As Boolean) As IntPtr

Declare Function RtlAdjustPrivilege Lib "ntdll.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

SE_SHUTDOWN_PRIVILEGE = 19

SE_DEBUG_PRIVILEGE = 20

Please add some!

Sample Code:

Please add some!

Documentation

[RtlAdjustPrivilege] on MSDN

[DllImport("ntdll.dll")]

public static extern void RtlFreeUnicodeString(

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[RtlFreeUnicodeString] on MSDN

Summary

The RtlInitializeSid routine initializes a security identifier (SID) structure.

[DllImport("ntdll", CharSet = CharSet.Auto, ExactSpelling = true, SetLastError = true)]

private static extern Int32 RtlInitializeSid([In, Out] ref SID Sid, [In] ref SID_IDENTIFIER_AUTHORITY IdentifierAuthority, byte SubAuthorityCount);

Declare Function RtlInitializeSid Lib "ntdll.dll" (TODO) As TODO

[StructLayout(LayoutKind.Sequential, Size = 6)]

[MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)]

public byte[] Value;

public SID_IDENTIFIER_AUTHORITY(byte[] value)

if (value.Length != 6)

throw new ArgumentOutOfRangeException("value", "Value must be an array of 6 bytes.");

this.Value = value;

[StructLayout(LayoutKind.Sequential)]

public byte Revision;

public byte SubAuthorityCount;

public SID_IDENTIFIER_AUTHORITY IdentifierAuthority;

public UInt32[] SubAuthority;

public SID(int subAuthorityCount)

this.IdentifierAuthority = default(SID_IDENTIFIER_AUTHORITY);

Alternative Managed API:

Do you know one? Please contribute it!

Tested on Win8.1 x64 by @gsuberland, but not thoroughly.

Please add some!

Sample Code:

// just using a null identifier here

// new SID with an allocated SubAuthority count of 1

// make the call, passing the correct SubAuthority count

var status = RtlInitializeSid(ref sid, ref id, (byte)sid.SubAuthority.Length);

Console.WriteLine("Failed.");

else

Console.WriteLine("Success.");

Documentation

[RtlInitializeSid] on MSDN

[DllImport("ntdll.dll")]

public static extern void RtlInitUnicodeString(

[MarshalAs(UnmanagedType.LPWStr)] string SourceString);

[DllImport("ntdll.dll")]

public static extern void RtlInitUnicodeString(

[MarshalAs(UnmanagedType.LPWStr)] string SourceString);

public struct UNICODE_STRING

public ushort Length;

public ushort MaximumLength;

[MarshalAs(UnmanagedType.LPWStr)]

public string Buffer;

Sample Code:

http://www.rootkit.com/vault/hoglund/migbot.zip

[DllImport("ntdll.dll")]

public static uint RtlNtStatusToDosError(int Status);

Declare Function RtlNtStatusToDosError Lib "ntdll.dll" (ByVal status as Integer) As UInteger

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[RtlNtStatusToDosError] on MSDN

Summary

Tells NtQuerySystemInformation and NtSetSystemInformation what you would like to read/change.

public enum SYSTEM_INFORMATION_CLASS

SystemCallCountInformation = 0x0006,

SystemFlagsInformation = 0x0009,

SystemCallTimeInformation = 0x000A,

SystemModuleInformation = 0x000B,

SystemLocksInformation = 0x000C,

SystemPagedPoolInformation = 0x000E,

SystemNonPagedPoolInformation = 0x000F,

SystemHandleInformation = 0x0010,

SystemPageFileInformation = 0x0012,

SystemVdmInstemulInformation = 0x0013,

SystemFileCacheInformation = 0x0015,

SystemPoolTagInformation = 0x0016,

SystemFullMemoryInformation = 0x0019,

SystemLoadGdiDriverInformation = 0x001A,

SystemUnloadGdiDriverInformation = 0x001B,

SystemKernelDebuggerInformation = 0x0023,

SystemExtendServiceTableInformation = 0x0026,

SystemProcessorIdleInformation = 0x002A,

SystemLegacyDriverInformation = 0x002B,

SystemLookasideInformation = 0x002D,

SystemTimeSlipNotification = 0x002E,

SystemLoadGdiDriverInSystemSpace = 0x0036,

SystemRecommendedSharedDataAlignment = 0x003A,

SystemComPlusPackage = 0x003B,

SystemNumaAvailableMemory = 0x003C,

SystemEmulationBasicInformation = 0x003E,

SystemEmulationProcessorInformation = 0x003F,

SystemExtendedHandleInformation = 0x0040,

SystemLostDelayedWriteInformation = 0x0041,

SystemBigPoolInformation = 0x0042,

SystemSessionPoolTagInformation = 0x0043,

SystemWatchdogTimerHandler = 0x0047,

SystemLogicalProcessorInformation = 0x0049,

SystemWow64SharedInformationObsolete = 0x004A,

SystemRegisterFirmwareTableInformationHandler = 0x004B,

SystemFirmwareTableInformation = 0x004C,

SystemModuleInformationEx = 0x004D,

SystemMemoryListInformation = 0x0050, // SYSTEM_MEMORY_LIST_INFORMATION

SystemFileCacheInformationEx = 0x0051,

SystemThreadPriorityClientIdInformation = 0x0052,

SystemProcessorIdleCycleTimeInformation = 0x0053,

SystemVerifierCancellationInformation = 0x0054,

SystemSpecialPoolInformation = 0x0057,

SystemImageFileExecutionOptionsInformation = 0x005E,

SystemVerifierFaultsInformation = 0x0061,

SystemVirtualAddressInformation = 0x006A,

SystemLogicalProcessorAndGroupInformation = 0x006B,

SystemProcessorCycleTimeInformation = 0x006C,

SystemAitSamplingValue = 0x006F,

SystemLowPriorityIoInformation = 0x0074,

SystemPagedPoolInformationEx = 0x0077,

SystemSessionBigPoolInformation = 0x007D,

SystemScrubPhysicalMemoryInformation = 0x007F,

SystemProcessorProfileControlArea = 0x0081,

SystemCombinePhysicalMemoryInformation = 0x0082,

SystemConsoleInformation = 0x0084,

SystemPlatformBinaryInformation = 0x0085,

SystemThrottleNotificationInformation = 0x0086,

SystemMemoryTopologyInformation = 0x008A,

SystemMemoryChannelInformation = 0x008B,

SystemBootLogoInformation = 0x008C,

SystemSecureBootPolicyInformation = 0x008F,

SystemPageFileInformationEx = 0x0090,

SystemPortableWorkspaceEfiLauncherInformation = 0x0093,

SystemFullProcessInformation = 0x0094,

MaxSystemInfoClass = 0x0095

Declare Function SYSTEM_INFORMATION_CLASS Lib "ntdll.dll" (TODO) As TODO

Documentation

[SYSTEM_INFORMATION_CLASS] on MSDN

Summary

Structure returned by NtQuerySystemInformation in response to SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation = 0x0050

/// allocate at least 168 bytes to your buffer or it will likely fail.

[StructLayout(LayoutKind.Sequential, Pack = 1)]

public struct SYSTEM_MEMORY_LIST_INFORMATION // Size=88

public UInt32 ZeroPageCount; // Size=4 Offset=0

public UInt32 FreePageCount; // Size=4 Offset=4

public UInt32 ModifiedPageCount; // Size=4 Offset=8

public UInt32 ModifiedNoWritePageCount; // Size=4 Offset=12

public UInt32 BadPageCount; // Size=4 Offset=16

/// <summary>There are 8 priority levels, so array of 8</summary>

[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]

public UInt32[] PageCountByPriority; // Size=32 Offset=20

/// <summary>There are 8 priority levels, so array of 8</summary>

[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]

public UInt32[] RepurposedPagesByPriority; // Size=32 Offset=52

public UInt32 ModifiedPageCountPageFile; // Size=4 Offset=84

Declare Function SYSTEM_MEMORY_LIST_INFORMATION Lib "ntdll.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

public void Test()

result = 0;

NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION

MemoryList;

arr = new Int32[] { (Int32)Commands.MEMORYLIST };

buff = Marshal.AllocHGlobal(1024); // should be more than adequate

result = (UInt32)NativeMethods.NtQuerySystemInformation(NativeMethods.SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation, buff, result, out returnSize);

if (result != 0)

// Most likely error is InfoLengthMismatch = 0xc0000004 -- meaning you need to make the buffer larger

throw new System.ComponentModel.Win32Exception(((NativeMethods.NtStatus)result).ToString());

MemoryList = (NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION)Marshal.PtrToStructure(buff, typeof(NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION));

finally

Marshal.FreeHGlobal(buff);

Documentation

[SYSTEM_MEMORY_LIST_INFORMATION] on MSDN

[DllImport("ntdll.dll")]

public static extern IntPtr ZwClose(IntPtr handle);

Declare Sub ZwClose Lib "ntdll.dll" (Handle As Intptr)

Alternative Managed API:

Do you know one? Please contribute it!

Use it for closing e.g. sectionHandle opened with ZwOpenSection.

Please add some!

Sample Code:

Please add some!

Documentation

[ZwClose] on MSDN

[DllImport("ntdll.dll")]

public static extern IntPtr ZwOpenSection(

out IntPtr sectionHandle, uint desiredAccess, ref OBJECT_ATTRIBUTES attributes);

Declare Function ZwOpenSection Lib "ntdll.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Dont forget to close the sectionHandle with ZwClose!

Please add some!

Sample Code:

Please add some!

credui,advapi32,gdi32,kernel32,ole32,shell32,user32,glossary,coredll,rasapi32,mpr,netapi32,uxtheme,avifil32,aygshell,winscard,crypt32,secur32,wtsapi32,shlwapi,winspool,oleacc,rapi,oleaut32,winfax,odbc32,msi,cards,powrprof,urlmon,xolehlp,twain_32,winmm,wininet,comdlg32,imm32,ntdsapi,odbccp32,glu32,mapi32,Constants,Delegates,Enums,Interfaces,Structures

[DllImport("shell32.dll", SetLastError=true)]

Declare Function api Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

by murali

Summary

Structure for using SHAppBarMessage. Also needs the RECT structure.

[StructLayout(LayoutKind.Sequential)]

public struct APPBARDATA

// UINT uCallbackMessage;

// LPARAM lParam;

public static readonly int cbSize = Marshal.SizeOf(typeof(APPBARDATA));

public IntPtr hWnd;

public uint uCallbackMessage;

public uint uEdge;

public RECT rc;

public int lParam;

Public Struct APPBARDATA

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Summary

The APPBARDATA Structure for use with the SHAppBarMessage. Also requires the RECT structure.

[StructLayout(LayoutKind.Sequential)]

public struct APPBARDATA

public int cbSize; // initialize this field using: Marshal.SizeOf(typeof(APPBARDATA));

public IntPtr hWnd;

public uint uCallbackMessage;

public uint uEdge;

public RECT rc;

public int lParam;

<StructLayout(LayoutKind.Sequential)> Structure APPBARDATA

Public cbSize As Integer

Public hWnd As IntPtr

Public uCallbackMessage As Integer

Public uEdge As Integer

Public rc As RECT

Public lParam As IntPtr

Initialy the C# signature in this article used a public static readonly int for cbSize so it could be initialized inline but the static field is then no longer where you expect it to be in memory so the call to SHAppBarMessage() fails. The field cannot be static.

If you want a single line way to get an APBARDATA with the cbSize field initialized then you can add a public static method as follows:

[StructLayout(LayoutKind.Sequential)]

public struct APPBARDATA

public int cbSize; // initialize this field using: Marshal.SizeOf(typeof(APPBARDATA));

public IntPtr hWnd;

public uint uCallbackMessage;

public uint uEdge;

public RECT rc;

public int lParam;

public static APPBARDATA NewAPPBARDATA()

abd.cbSize = Marshal.SizeOf(typeof(APPBARDATA));

myBarData.hWnd = MyBar.Handle;

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

[DllImport("shell32.dll", SetLastError=true)]

Declare Function BatchExec Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

ERazMA <a href="http://oomskttpbhdu.com/">oomskttpbhdu</a>, [url=http://nmkiqhxlyxfw.com/]nmkiqhxlyxfw[/url], [link=http://xtxwrlisppgq.com/]xtxwrlisppgq[/link], http://gwlplgpicepo.com/

Summary

The CommandLineToArgvW API

[DllImport("shell32.dll", SetLastError = true)]

static extern IntPtr CommandLineToArgvW(

[MarshalAs(UnmanagedType.LPWStr)] string lpCmdLine,

Declare Function CommandLineToArgv Lib "shell32.dll" Alias "CommandLineToArgvW" ( _

ByVal lpCmdLine As String, _

ByRef pNumArgs As Integer) As Long

Minimum DLL Version

Shell32.dll version 6.0 or later

Minimum operating systems

Windows NT Workstation 3.5, Windows NT Server 3.5, Windows 2000 Professional, Windows 2000 Server, Windows XP, Windows Server 2003

Unicode

This function is implemented as Unicode.

Please add some!

Sample Code:

static class CmdLineToArgvW

// The previous examples on this page used incorrect

// pointer logic and were removed.

static string[] SplitArgs(string unsplitArgumentLine)

IntPtr ptrToSplitArgs;

string[] splitArgs;

ptrToSplitArgs = CommandLineToArgvW(unsplitArgumentLine, out numberOfArgs);

// CommandLineToArgvW returns NULL upon failure.

if (ptrToSplitArgs == IntPtr.Zero)

throw new ArgumentException("Unable to split argument.", new Win32Exception());

// Make sure the memory ptrToSplitArgs to is freed, even upon failure.

splitArgs = new string[numberOfArgs];

// ptrToSplitArgs is an array of pointers to null terminated Unicode strings.

// Copy each of these strings into our split argument array.

splitArgs[i] = Marshal.PtrToStringUni(

Marshal.ReadIntPtr(ptrToSplitArgs, i * IntPtr.Size));

return splitArgs;

finally

// Free memory obtained by CommandLineToArgW.

LocalFree(ptrToSplitArgs);

[DllImport("shell32.dll", SetLastError = true)]

static extern IntPtr CommandLineToArgvW(

[MarshalAs(UnmanagedType.LPWStr)] string lpCmdLine,

[DllImport("kernel32.dll")]

static extern IntPtr LocalFree(IntPtr hMem);

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[CommandLineToArgvW] on MSDN

Summary

Special folders enumeration used in SHGetSpecialFolderLocation

public enum CSIDL {

CSIDL_DESKTOP = 0x0000, // <desktop>

CSIDL_INTERNET = 0x0001, // Internet Explorer (icon on desktop)

CSIDL_PROGRAMS = 0x0002, // Start Menu\Programs

CSIDL_CONTROLS = 0x0003, // My Computer\Control Panel

CSIDL_PRINTERS = 0x0004, // My Computer\Printers

CSIDL_PERSONAL = 0x0005, // My Documents

CSIDL_FAVORITES = 0x0006, // <user name>\Favorites

CSIDL_STARTUP = 0x0007, // Start Menu\Programs\Startup

CSIDL_RECENT = 0x0008, // <user name>\Recent

CSIDL_SENDTO = 0x0009, // <user name>\SendTo

CSIDL_BITBUCKET = 0x000a, // <desktop>\Recycle Bin

CSIDL_STARTMENU = 0x000b, // <user name>\Start Menu

CSIDL_MYDOCUMENTS = 0x000c, // logical "My Documents" desktop icon

CSIDL_MYMUSIC = 0x000d, // "My Music" folder

CSIDL_MYVIDEO = 0x000e, // "My Videos" folder

CSIDL_DESKTOPDIRECTORY = 0x0010, // <user name>\Desktop

CSIDL_DRIVES = 0x0011, // My Computer

CSIDL_NETWORK = 0x0012, // Network Neighborhood (My Network Places)

CSIDL_NETHOOD = 0x0013, // <user name>\nethood

CSIDL_FONTS = 0x0014, // windows\fonts

CSIDL_TEMPLATES = 0x0015,

CSIDL_COMMON_STARTMENU = 0x0016, // All Users\Start Menu

CSIDL_COMMON_PROGRAMS = 0X0017, // All Users\Start Menu\Programs

CSIDL_COMMON_STARTUP = 0x0018, // All Users\Startup

CSIDL_COMMON_DESKTOPDIRECTORY = 0x0019, // All Users\Desktop

CSIDL_APPDATA = 0x001a, // <user name>\Application Data

CSIDL_PRINTHOOD = 0x001b, // <user name>\PrintHood

CSIDL_LOCAL_APPDATA = 0x001c, // <user name>\Local Settings\Applicaiton Data (non roaming)

CSIDL_ALTSTARTUP = 0x001d, // non localized startup

CSIDL_COMMON_ALTSTARTUP = 0x001e, // non localized common startup

CSIDL_COMMON_FAVORITES = 0x001f,

CSIDL_INTERNET_CACHE = 0x0020,

CSIDL_COOKIES = 0x0021,

CSIDL_HISTORY = 0x0022,

CSIDL_COMMON_APPDATA = 0x0023, // All Users\Application Data

CSIDL_WINDOWS = 0x0024, // GetWindowsDirectory()

CSIDL_SYSTEM = 0x0025, // GetSystemDirectory()

CSIDL_PROGRAM_FILES = 0x0026, // C:\Program Files

CSIDL_MYPICTURES = 0x0027, // C:\Program Files\My Pictures

CSIDL_PROFILE = 0x0028, // USERPROFILE

CSIDL_SYSTEMX86 = 0x0029, // x86 system directory on RISC

CSIDL_PROGRAM_FILESX86 = 0x002a, // x86 C:\Program Files on RISC

CSIDL_PROGRAM_FILES_COMMON = 0x002b, // C:\Program Files\Common

CSIDL_PROGRAM_FILES_COMMONX86 = 0x002c, // x86 Program Files\Common on RISC

CSIDL_COMMON_TEMPLATES = 0x002d, // All Users\Templates

CSIDL_COMMON_DOCUMENTS = 0x002e, // All Users\Documents

CSIDL_COMMON_ADMINTOOLS = 0x002f, // All Users\Start Menu\Programs\Administrative Tools

CSIDL_ADMINTOOLS = 0x0030, // <user name>\Start Menu\Programs\Administrative Tools

CSIDL_CONNECTIONS = 0x0031, // Network and Dial-up Connections

CSIDL_COMMON_MUSIC = 0x0035, // All Users\My Music

CSIDL_COMMON_PICTURES = 0x0036, // All Users\My Pictures

CSIDL_COMMON_VIDEO = 0x0037, // All Users\My Video

CSIDL_CDBURN_AREA = 0x003b // USERPROFILE\Local Settings\Application Data\Microsoft\CD Burning

Declare Function CSIDL Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

System.Enviroment.SpecialFolder

Please add some!

Sample Code:

Please add some!

Documentation

CSIDL @msdn on MSDN

Summary

CSIDL values provide a unique system-independent way to identify special folders used frequently by applications, but which may not have the same name or location on any given system. For example, the system folder may be "C:\Windows" on one system and "C:\Winnt" on another. These constants are defined in Shlobj.h and Shfolder.h.

/// CSIDL values provide a unique system-independent way to identify special folders used frequently by applications,

/// but which may not have the same name or location on any given system. For example, the system folder may be

/// "C:\Windows" on one system and "C:\Winnt" on another. These constants are defined in Shlobj.h and Shfolder.h.

/// These values supersede the use of environment variables for this purpose.

/// A CSIDL is used in conjunction with one of four Shell functions, SHGetFolderLocation, SHGetFolderPath,

/// SHGetSpecialFolderLocation, and SHGetSpecialFolderPath, to retrieve a special folder's path or pointer

/// to an item identifier list (PIDL).

/// Combine CSIDL_FLAG_CREATE with any of the other CSIDLs to force the creation of the associated folder.

/// The remaining CSIDLs correspond to either file system folders or virtual folders. Where the CSIDL

/// identifies a file system folder, a commonly used path is given as an example. Other paths may be used.

/// Some CSIDLs can be mapped to an equivalent %VariableName% environment variable. CSIDLs are more reliable,

/// however, and should be used if possible.

[Flags]

internal enum CSIDL :int

/// Version 5.0. Combine this CSIDL with any of the following CSIDLs to force the creation of the associated folder.

CSIDL_FLAG_CREATE = 0x8000,

/// Version 5.0. The file system directory that is used to store administrative tools for an individual user.

/// The Microsoft Management Console (MMC) will save customized consoles to this directory, and it will roam with the user.

CSIDL_ADMINTOOLS = 0x0030,

/// The file system directory that corresponds to the user's nonlocalized Startup program group.

CSIDL_ALTSTARTUP = 0x001d,

/// Version 4.71. The file system directory that serves as a common repository for application-specific data.

/// A typical path is C:\Documents and Settings\username\Application Data. This CSIDL is supported by the

/// redistributable Shfolder.dll for systems that do not have the Microsoft Internet Explorer 4.0 integrated Shell installed.

CSIDL_APPDATA = 0x001a,

CSIDL_BITBUCKET = 0x000a, // The virtual folder containing the objects in the user's Recycle Bin.

/// Version 6.0. The file system directory acting as a staging area for files waiting to be written to CD.

/// A typical path is C:\Documents and Settings\username\Local Settings\Application Data\Microsoft\CD Burning.

CSIDL_CDBURN_AREA = 0x003b,

/// Version 5.0. The file system directory containing administrative tools for all users of the computer.

CSIDL_COMMON_ADMINTOOLS = 0x002f,

/// The file system directory that corresponds to the nonlocalized Startup program group for all users.

/// Valid only for Microsoft Windows NT systems.

CSIDL_COMMON_ALTSTARTUP = 0x001e,

/// Version 5.0. The file system directory containing application data for all users. A typical path is

/// C:\Documents and Settings\All Users\Application Data.

CSIDL_COMMON_APPDATA = 0x0023,

/// The file system directory that contains files and folders that appear on the desktop for all users.

/// A typical path is C:\Documents and Settings\All Users\Desktop. Valid only for Windows NT systems.

CSIDL_COMMON_DESKTOPDIRECTORY = 0x0019,

/// The file system directory that contains documents that are common to all users. A typical paths is

/// C:\Documents and Settings\All Users\Documents. Valid for Windows NT systems and Microsoft Windows 95

/// and Windows 98 systems with Shfolder.dll installed.

CSIDL_COMMON_DOCUMENTS = 0x002e,

/// The file system directory that serves as a common repository for favorite items common to all users.

/// Valid only for Windows NT systems.

CSIDL_COMMON_FAVORITES = 0x001f,

/// Version 6.0. The file system directory that serves as a repository for music files common to all users.

/// A typical path is C:\Documents and Settings\All Users\Documents\My Music.

CSIDL_COMMON_MUSIC = 0x0035,

/// Version 6.0. The file system directory that serves as a repository for image files common to all users.

/// A typical path is C:\Documents and Settings\All Users\Documents\My Pictures.

CSIDL_COMMON_PICTURES = 0x0036,

/// The file system directory that contains the directories for the common program groups that appear on the

/// Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs.

/// Valid only for Windows NT systems.

CSIDL_COMMON_PROGRAMS = 0x0017,

/// The file system directory that contains the programs and folders that appear on the Start menu for all users.

/// A typical path is C:\Documents and Settings\All Users\Start Menu. Valid only for Windows NT systems.

CSIDL_COMMON_STARTMENU = 0x0016,

/// The file system directory that contains the programs that appear in the Startup folder for all users.

/// A typical path is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. Valid only for Windows NT systems.

CSIDL_COMMON_STARTUP = 0x0018,

/// The file system directory that contains the templates that are available to all users. A typical path is

/// C:\Documents and Settings\All Users\Templates. Valid only for Windows NT systems.

CSIDL_COMMON_TEMPLATES = 0x002d,

/// Version 6.0. The file system directory that serves as a repository for video files common to all users.

/// A typical path is C:\Documents and Settings\All Users\Documents\My Videos.

CSIDL_COMMON_VIDEO = 0x0037,

CSIDL_CONTROLS = 0x0003, // The virtual folder containing icons for the Control Panel applications.

/// The file system directory that serves as a common repository for Internet cookies. A typical path is

CSIDL_COOKIES = 0x0021,

CSIDL_DESKTOP = 0x0000, // The virtual folder representing the Windows desktop, the root of the namespace.

/// The file system directory used to physically store file objects on the desktop (not to be confused with

/// the desktop folder itself). A typical path is C:\Documents and Settings\username\Desktop.

CSIDL_DESKTOPDIRECTORY = 0x0010,

/// The virtual folder representing My Computer, containing everything on the local computer: storage devices,

/// printers, and Control Panel. The folder may also contain mapped network drives.

CSIDL_DRIVES = 0x0011,

/// The file system directory that serves as a common repository for the user's favorite items. A typical path is

CSIDL_FAVORITES = 0x0006,

CSIDL_FONTS = 0x0014, // A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

CSIDL_HISTORY = 0x0022, // The file system directory that serves as a common repository for Internet history items.

CSIDL_INTERNET = 0x0001, // A virtual folder representing the Internet.

/// Version 4.72. The file system directory that serves as a common repository for temporary Internet files.

/// A typical path is C:\Documents and Settings\username\Local Settings\Temporary Internet Files.

CSIDL_INTERNET_CACHE = 0x0020,

/// Version 5.0. The file system directory that serves as a data repository for local (nonroaming) applications.

/// A typical path is C:\Documents and Settings\username\Local Settings\Application Data.

CSIDL_LOCAL_APPDATA = 0x001c,

CSIDL_MYDOCUMENTS = 0x000c, // Version 6.0. The virtual folder representing the My Documents desktop item.

/// The file system directory that serves as a common repository for music files. A typical path is

CSIDL_MYMUSIC = 0x000d,

/// Version 5.0. The file system directory that serves as a common repository for image files.

/// A typical path is C:\Documents and Settings\username\My Documents\My Pictures.

CSIDL_MYPICTURES = 0x0027,

/// Version 6.0. The file system directory that serves as a common repository for video files.

/// A typical path is C:\Documents and Settings\username\My Documents\My Videos.

CSIDL_MYVIDEO = 0x000e,

/// A file system directory containing the link objects that may exist in the My Network Places virtual folder.

/// It is not the same as CSIDL_NETWORK, which represents the network namespace root.

/// A typical path is C:\Documents and Settings\username\NetHood.

CSIDL_NETHOOD = 0x0013,

/// A virtual folder representing Network Neighborhood, the root of the network namespace hierarchy.

CSIDL_NETWORK = 0x0012,

/// Version 6.0. The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

/// Previous to Version 6.0. The file system directory used to physically store a user's common repository of documents.

/// A typical path is C:\Documents and Settings\username\My Documents. This should be distinguished from the virtual

/// My Documents folder in the namespace. To access that virtual folder, use SHGetFolderLocation, which returns the

/// ITEMIDLIST for the virtual location, or refer to the technique described in Managing the File System.

CSIDL_PERSONAL = 0x0005,

CSIDL_PRINTERS = 0x0004, // The virtual folder containing installed printers.

/// The file system directory that contains the link objects that can exist in the Printers virtual folder.

/// A typical path is C:\Documents and Settings\username\PrintHood.

CSIDL_PRINTHOOD = 0x001b,

/// Version 5.0. The user's profile folder. A typical path is C:\Documents and Settings\username. Applications should

/// not create files or folders at this level; they should put their data under the locations referred to by

/// CSIDL_APPDATA or CSIDL_LOCAL_APPDATA.

CSIDL_PROFILE = 0x0028,

/// Version 6.0. The file system directory containing user profile folders. A typical path is C:\Documents and Settings.

CSIDL_PROFILES = 0x003e,

CSIDL_PROGRAM_FILES = 0x0026, // Version 5.0. The Program Files folder. A typical path is C:\Program Files.

/// Version 5.0. A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

/// Valid only for Windows NT, Windows 2000, and Windows XP systems. Not valid for Windows Millennium Edition (Windows Me).

CSIDL_PROGRAM_FILES_COMMON = 0x002b,

/// The file system directory that contains the user's program groups (which are themselves file system directories).

/// A typical path is C:\Documents and Settings\username\Start Menu\Programs.

CSIDL_PROGRAMS = 0x0002,

/// The file system directory that contains shortcuts to the user's most recently used documents. A typical path is

/// C:\Documents and Settings\username\My Recent Documents. To create a shortcut in this folder, use SHAddToRecentDocs.

/// In addition to creating the shortcut, this function updates the Shell's list of recent documents and adds the shortcut

CSIDL_RECENT = 0x0008,

/// The file system directory that contains Send To menu items. A typical path is C:\Documents and Settings\username\SendTo.

CSIDL_SENDTO = 0x0009,

/// The file system directory containing Start menu items. A typical path is C:\Documents and Settings\username\Start Menu.

CSIDL_STARTMENU = 0x000b,

/// The file system directory that corresponds to the user's Startup program group. The system starts these programs

/// whenever any user logs onto Windows NT or starts Windows 95.

/// A typical path is C:\Documents and Settings\username\Start Menu\Programs\Startup.

CSIDL_STARTUP = 0x0007,

CSIDL_SYSTEM = 0x0025, // Version 5.0. The Windows System folder. A typical path is C:\Windows\System32.

/// The file system directory that serves as a common repository for document templates. A typical path is

/// C:\Documents and Settings\username\Templates.

CSIDL_TEMPLATES = 0x0015,

/// Version 5.0. The Windows directory or SYSROOT. This corresponds to the %windir% or %SYSTEMROOT% environment variables.

/// A typical path is C:\Windows.

CSIDL_WINDOWS = 0x0024

Declare Function CSIDL Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[CSIDL] on MSDN

Clones a full, or absolute, ITEMIDLIST structure (i.e. a PIDL/IntPtr).

[DllImport("shell32.dll", SetLastError=true)]

static extern TODO dll ILCLONEFULL(TODO);

I couldn't make the import work,

Public Shared Function IlCloneFull(ItemIDList As IntPtr) As IntPtr

If Not IntPtr.Zero.Equals( ItemIDList ) Then Return New IntPtr(If(IntPtr.Size = 4, ItemIDList.ToInt32, ItemIDList.ToInt64))

Declare Function dll ILCLONEFULL Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

dll [ILCLONEFULL] on MSDN

http://msdn.microsoft.com/en-us/library/windows/desktop/bb776436(v=vs.85).aspx

[StructLayout(LayoutKind.Sequential)]

private struct DLLVERSIONINFO {

public int cbSize;

public int dwMajorVersion;

public int dwMinorVersion;

public int dwBuildNumber;

public int dwPlatformID;

Private Structure DLLVERSIONINFO

Dim dwBuildNumber As Integer

Dim dwPlatformID As Integer

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[DLLVERSIONINFO] on MSDN

[StructLayout(LayoutKind.Sequential)]

private struct DLLVERSIONINFO {

public int cbSize;

public int dwMajorVersion;

public int dwMinorVersion;

public int dwBuildNumber;

public int dwPlatformID;

Private Structure DLLVERSIONINFO

Dim dwBuildNumber As Integer

Dim dwPlatformID As Integer

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[DLLGETVERSIONINFO] on MSDN

this is already deprecated in win32, you should use ExpandEnvironmentStrings

or better yet, use the dotnet function "System.Environment.ExpandEnvironmentVariables"

[DllImport("shell32.dll")]

static extern uint DoEnvironmentSubst(StringBuilder pszString, uint cbSize);

Private Declare Function DoEnvironmentSubst Lib "shell32.dll" Alias "DoEnvironmentSubstW" (ByVal szString As String, ByVal cbString As Long) As Long

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

System.Environment.ExpandEnvironmentVariables

Do you know one? Please contribute it!

Summary

The DragAcceptFiles API

[DllImport("shell32.dll")]

static extern void DragAcceptFiles(IntPtr hwnd, bool fAccept);

Declare Sub DragAcceptFiles Lib "shell32.dll" ( _

ByVal hwnd As Long, _

ByVal fAccept As Long)

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[DragAcceptFiles] on MSDN

[DllImport("shell32.dll")]

Declare Sub DragFinish Lib "shell32.dll" ( _

ByVal hDrop As Long)

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Summary

The DragQueryFile API

[DllImport("shell32.dll")]

static extern uint DragQueryFile(IntPtr hDrop, uint iFile,

[Out] StringBuilder lpszFile, uint cch);

Declare Function DragQueryFile Lib "shell32.dll" Alias "DragQueryFileW" ( _

ByVal HDROP As Long, _

ByVal UINT As Long, _

ByVal lpStr As String, _

ByVal ch As Long) As Long

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[DragQueryFile] on MSDN

[DllImport("shell32.dll")]

static extern bool DragQueryPoint(IntPtr hDrop, out POINT lppt);

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Summary

The DuplicateIcon API

[DllImport("shell32.dll")]

static extern IntPtr DuplicateIcon(IntPtr hInst, IntPtr hIcon);

Sample Code:

Please add some!

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[DuplicateIcon] on MSDN

[DllImport("shell32.dll", SetLastError=true)]

static extern TODO ExtendedFileInfo(TODO);

Declare Function ExtendedFileInfo Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[ExtendedFileInfo] on MSDN

[DllImport("shell32.dll")]

static extern IntPtr ExtractAssociatedIcon(IntPtr hInst, StringBuilder lpIconPath,

out ushort lpiIcon);

<DllImport("shell32.dll", CharSet:=CharSet.Auto)> _

(ByVal hInst As IntPtr, _

ByVal iconPath As StringBuilder, _

Both the ExtractAssociatedIcon and 'System.Drawing.Icon.ExtractAssociatedIcon' extract only a 32x32 pixels icon.

The ExtractAssociatedIcon function also does not execute as documented. The documentation states that

If the icon is extracted from an associated executable file, the function stores the full path and file name of the executable file in the string pointed to by lpIconPath, and stores the icon's identifier in the WORD pointed to by lpiIcon.

However, tests indicates that the upon return, the contents of both iconPath and index parameters are the same after the function returns successfully.

in Specifies the instance of the application calling the function.

lpIconPath

in Pointer to a string that specifies the full path and file name of the file that contains the icon. The function extracts the icon handle from that file, or from an executable file associated with that file. If the icon handle is obtained from an executable file, the function stores the full path and file name of that executable in the string pointed to by lpIconPath.

lpiIcon

in, out Pointer to a WORD that specifies the index of the icon whose handle is to be obtained. If the icon handle is obtained from an executable file, the function stores the icon's identifier in the WORD pointed to by lpiIcon.

Please add some!

Sample Code:

Consider a Winform application with a OpenFileDialog that helps pick some file. This is then passed to the ExtractAssociatedIcon method to get the icon and display in a picture box.

public partial class IconTest : Form

[DllImport("shell32.dll")]

static extern IntPtr ExtractAssociatedIcon(IntPtr hInst, StringBuilder lpIconPath,

out ushort lpiIcon);

[DllImport("shell32.dll")]

static extern IntPtr ExtractIcon(IntPtr hInst, string lpszExeFileName, int nIconIndex);

public IconTest()

InitializeComponent();

private void btnBrowse_Click(object sender, EventArgs e)

openFileDialog1.ShowDialog();

StringBuilder strB = new StringBuilder(openFileDialog1.FileName);

IntPtr handle = ExtractAssociatedIcon(this.Handle, strB, out uicon);

Icon ico = Icon.FromHandle(handle);

Alternative Managed API:

Use static method 'System.Drawing.Icon.ExtractAssociatedIcon(string filePath)' in assembly 'System.Drawing.dll' (.net 2)

[DllImport("shell32.dll", CharSet=CharSet.Auto)]

static extern uint ExtractIconEx(string szFileName, int nIconIndex,

IntPtr[] phiconLarge, IntPtr[] phiconSmall, uint nIcons);

<DllImport("shell32.dll", CharSet:=CharSet.Auto)> _

Shared Function ExtractIconEx(ByVal szFileName As String, _

ByVal nIconIndex As Integer, _

ByVal phiconLarge() As IntPtr, _

ByVal phiconSmall() As IntPtr, _

ByVal nIcons As UInteger) As UInteger

Declare Function ExtractIconEx _

Lib "shell32.dll" _

Alias "ExtractIconExA" _

(ByVal lpszFile As String, _

ByVal nIconIndex As Integer, _

ByRef phiconLarge As Integer, _

ByRef phiconSmall As Integer, _

ByVal nIcons As Long) As Integer

szFile

in A null-terminated string specifying the name of an executable file, DLL, or icon file from which icons will be extracted.

in Specifies the zero-based index of the first icon to extract. For example, if this value is zero, the function extracts the first icon in the specified file.

If this value is –1 and phiconLarge and phiconSmall are both NULL, the function returns the total number of icons in the specified file. If the file is an executable file or DLL, the return value is the number of RT_GROUP_ICON resources. If the file is an .ico file, the return value is 1.

Windows 95/98/Me, Windows NT 4.0 and later: If this value is a negative number and either phiconLarge or phiconSmall is not NULL, the function begins by extracting the icon whose resource identifier is equal to the absolute value of nIconIndex. For example, use -3 to extract the icon whose resource identifier is 3.

phiconLarge

out Pointer to an array of icon handles that receives handles to the large icons extracted from the file. If this parameter is NULL, no large icons are extracted from the file.

phiconSmall

out Pointer to an array of icon handles that receives handles to the small icons extracted from the file. If this parameter is NULL, no small icons are extracted from the file.

in Specifies the number of icons to extract from the file.

For Windows CE: import coredll.dll not shell32.dll

For Windows CE 2.10 and later: the nIconIndex parameter must be zero or –N, where N is a specified resource identifier. The nIcons parameter must be 1.

For Windows CE 1.0 through 2.10: the function returns the total number of icons in the specified file if nIconIndex is –1 and phIconLarge and phiconSmall are both NULL. If the file is an executable file or DLL, the return value is the number of RT_GROUP_ICON resources. If the file is an .ICO file, the return value is 1.

To get other sizes of an icon, check sample at http://pinvoke.net/default.aspx/user32/LoadImage.html

Sample Code:

namespace Martin.Hyldahl.Examples.ExtractIconEx

* Example using ExtractIconEx

* Created by Martin Hyldahl (alanadin@post8.tele.dk)

* http://www.hyldahlnet.dk

/// Example using ExtractIconEx

public class ExtractIconExample

static ExtractIconExample()

private ExtractIconExample()

[DllImport("Shell32", CharSet=CharSet.Auto)]

string lpszFile,

IntPtr[] phIconLarge,

IntPtr[] phIconSmall,

[DllImport("user32.dll", EntryPoint="DestroyIcon", SetLastError=true)]

public static Icon ExtractIconFromExe(string file, bool large)

if(large)

readIconCount = ExtractIconEx(file,0, hIconEx, hDummy, 1);

else

readIconCount = ExtractIconEx(file,0, hDummy, hIconEx, 1);

Icon extractedIcon = (Icon)Icon.FromHandle(hIconEx[0]).Clone();

else // NO ICONS READ

return null;

// BUBBLE UP

throw new ApplicationException("Could not extract icon", ex);

finally

// RELEASE RESOURCES

Sample Code (VB Version of above):

Module IconExtract

<DllImport("shell32.dll", CharSet:=CharSet.Auto)> _

Function ExtractIconEx(ByVal szFileName As String, _

ByVal nIconIndex As Integer, _

ByVal phiconLarge() As IntPtr, _

ByVal phiconSmall() As IntPtr, _

ByVal nIcons As Integer) As Integer

<DllImport("user32.dll", EntryPoint:="DestroyIcon", SetLastError:=True)> _

Function DestroyIcon(ByVal hIcon As IntPtr) As Integer

Public Function WriteIconOut(ByVal iconsrcpath As String, ByVal icondestpath As String)

iconsrc.Save(System.IO.File.OpenWrite(icondestpath))

Public Function ExtractIconFromExe(ByVal f As String, ByVal large As Boolean) As Icon

If (large) Then

Else

If (readIconCount > 0 AndAlso Not hIconEx(0).Equals(IntPtr.Zero)) Then

Dim extractedIcon As Icon = Icon.FromHandle(hIconEx(0)).Clone()

Else ' NO ICONS READ

' BUBBLE UP

Throw New ApplicationException("Could not extract icon", ex)

Finally

'RELEASE RESOURCES

If (Not ptr.Equals(IntPtr.Zero)) Then

If Not (ptr.Equals(IntPtr.Zero)) Then

End Module

Alternative Managed API:

Icon.ExtractAssociatedIcon(sFile)

[DllImport("shell32.dll", CharSet=CharSet.Auto)]

static extern uint ExtractIconEx(string szFileName, int nIconIndex,

IntPtr[] phiconLarge, IntPtr[] phiconSmall, uint nIcons);

<DllImport("shell32.dll", CharSet:=CharSet.Auto)> _

Shared Function ExtractIconEx(ByVal szFileName As String, _

ByVal nIconIndex As Integer, _

ByRef phiconLarge() As IntPtr, _

ByRef phiconSmall() As IntPtr, _

ByVal nIcons As UInteger) As UInteger

Declare Function ExtractIconEx _

Lib "shell32.dll" _

Alias "ExtractIconExA" _

(ByVal lpszFile As String, _

ByVal nIconIndex As Integer, _

ByRef phiconLarge As Integer, _

ByRef phiconSmall As Integer, _

ByVal nIcons As Long) As Integer

szFile

in A null-terminated string specifying the name of an executable file, DLL, or icon file from which icons will be extracted.

in Specifies the zero-based index of the first icon to extract. For example, if this value is zero, the function extracts the first icon in the specified file.

If this value is –1 and phiconLarge and phiconSmall are both NULL, the function returns the total number of icons in the specified file. If the file is an executable file or DLL, the return value is the number of RT_GROUP_ICON resources. If the file is an .ico file, the return value is 1.

Windows 95/98/Me, Windows NT 4.0 and later: If this value is a negative number and either phiconLarge or phiconSmall is not NULL, the function begins by extracting the icon whose resource identifier is equal to the absolute value of nIconIndex. For example, use -3 to extract the icon whose resource identifier is 3.

phiconLarge

out Pointer to an array of icon handles that receives handles to the large icons extracted from the file. If this parameter is NULL, no large icons are extracted from the file.

phiconSmall

out Pointer to an array of icon handles that receives handles to the small icons extracted from the file. If this parameter is NULL, no small icons are extracted from the file.

in Specifies the number of icons to extract from the file.

For Windows CE: import coredll.dll not shell32.dll

For Windows CE 2.10 and later: the nIconIndex parameter must be zero or –N, where N is a specified resource identifier. The nIcons parameter must be 1.

For Windows CE 1.0 through 2.10: the function returns the total number of icons in the specified file if nIconIndex is –1 and phIconLarge and phiconSmall are both NULL. If the file is an executable file or DLL, the return value is the number of RT_GROUP_ICON resources. If the file is an .ICO file, the return value is 1.

To get other sizes of an icon, check sample at http://pinvoke.net/default.aspx/user32/LoadImage.html

Sample Code:

namespace Martin.Hyldahl.Examples.ExtractIconEx

* Example using ExtractIconEx

* Created by Martin Hyldahl (alanadin@post8.tele.dk)

* http://www.hyldahlnet.dk

/// Example using ExtractIconEx

public class ExtractIconExample

static ExtractIconExample()

private ExtractIconExample()

[DllImport("Shell32", CharSet=CharSet.Auto)]

string lpszFile,

IntPtr[] phIconLarge,

IntPtr[] phIconSmall,

[DllImport("user32.dll", EntryPoint="DestroyIcon", SetLastError=true)]

public static Icon ExtractIconFromExe(string file, bool large)

if(large)

readIconCount = ExtractIconEx(file,0, hIconEx, hDummy, 1);

else

readIconCount = ExtractIconEx(file,0, hDummy, hIconEx, 1);

Icon extractedIcon = (Icon)Icon.FromHandle(hIconEx[0]).Clone();

else // NO ICONS READ

return null;

// BUBBLE UP

throw new ApplicationException("Could not extract icon", ex);

finally

// RELEASE RESOURCES

Sample Code (VB Version of above):

Module IconExtract

<DllImport("shell32.dll", CharSet:=CharSet.Auto)> _

Function ExtractIconEx(ByVal szFileName As String, _

ByVal nIconIndex As Integer, _

ByVal phiconLarge() As IntPtr, _

ByVal phiconSmall() As IntPtr, _

ByVal nIcons As Integer) As Integer

<DllImport("user32.dll", EntryPoint:="DestroyIcon", SetLastError:=True)> _

Function DestroyIcon(ByVal hIcon As IntPtr) As Integer

Public Function WriteIconOut(ByVal iconsrcpath As String, ByVal icondestpath As String)

iconsrc.Save(System.IO.File.OpenWrite(icondestpath))

Public Function ExtractIconFromExe(ByVal f As String, ByVal large As Boolean) As Icon

If (large) Then

Else

If (readIconCount > 0 AndAlso Not hIconEx(0).Equals(IntPtr.Zero)) Then

Dim extractedIcon As Icon = Icon.FromHandle(hIconEx(0)).Clone()

Else ' NO ICONS READ

' BUBBLE UP

Throw New ApplicationException("Could not extract icon", ex)

Finally

'RELEASE RESOURCES

If (Not ptr.Equals(IntPtr.Zero)) Then

If Not (ptr.Equals(IntPtr.Zero)) Then

End Module

Alternative Managed API:

Icon.ExtractAssociatedIcon(sFile)

[DllImport("shell32.dll", SetLastError=true)]

static extern TODO FileSystemWatcher(TODO);

Declare Function FileSystemWatcher Lib "shell32.dll" (TODO) As TODO

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[FileSystemWatcher] on MSDN

Drag FileSystemWatcher control in your form from toolbox and add the events for created,deletion and renaming.

this.fileSystemWatcher.EnableRaisingEvents = true;

this.fileSystemWatcher.IncludeSubdirectories = true;

this.fileSystemWatcher.SynchronizingObject = this;

this.fileSystemWatcher.Created += new System.IO.FileSystemEventHandler(this.fileSystemWatcher_Created);

this.fileSystemWatcher.Deleted += new System.IO.FileSystemEventHandler(this.fileSystemWatcher_Deleted);

this.fileSystemWatcher.Renamed += new System.IO.RenamedEventHandler(this.fileSystemWatcher_Renamed);

public System.IO.FileSystemWatcher fileSystemWatcher;

Create three bool variables to set true or false :-

private bool _fileDeleted = false;

private bool _fileRenamed = false;

private bool _fileCreated = false;

public bool FileDeleted

_fileDeleted = value;

return _fileDeleted;

public bool FileRenamed

_fileRenamed = value;

return _fileRenamed;

pblic bool FileCreated

_fileCreated = value;

return _fileCreated;

#region EventHandlers

private void fileSystemWatcher_Renamed(object sender, RenamedEventArgs e)

_fileRenamed = true;

MessageBox.Show(e.Name " Renamed in " e.FullPath);

private void fileSystemWatcher_Deleted(object sender, FileSystemEventArgs e)

_fileDeleted = true;

MessageBox.Show(e.Name " Deleted in " e.FullPath);

private void fileSystemWatcher_Created(object sender, FileSystemEventArgs e)

_fileCreated = true;

MessageBox.Show(e.Name " created in " e.FullPath);

By this property if you want to check file has been removed ,deleted from physical path then this will be true and you can check like if you have a tree view and you dont want to repopulate your tree view then use filesystemwatcher and repopulate the tree only when files have been changed,delete or rename. or you can throw a messagebox like above.

Summary

The FindExecutable API

[DllImport("shell32.dll")]

static extern IntPtr FindExecutable(string lpFile, string lpDirectory, [Out] StringBuilder lpResult);

<DllImport("shell32.dll")> _

Private Shared Function FindExecutable(ByVal lpFile As String, ByVal lpDirectory As String, ByRef lpResult As StringBuilder) As IntPtr

1) When using VB, one cannot place the declaration for FindExecutable within

the code portion of a form. If one needs to search for an executable from

within a form, though, it is easy enough to open a module and place the

declaration there. From the form code, make a call to a function in the

module. Within the module function, execute FindExecutable and return any

results to the form routine. steveapub@pineclifftech.com

2) Make sure the following references are available:

Public Enum FindExecutableErrorCodes

''' <summary>The specified file was not found.</summary>

''' <summary>There is no application associated with the given file name extension. This error will also be returned if you attempt to print a file that is not printable. </summary>

''' <summary>There was not enough memory to complete the operation.</summary>

Sample Code:

Please add some!!

Alternative Managed API:

Do you know one? Please contribute it!

Documentation

[FindExecutable] on MSDN

namespace QuickTool

public class Win32API

[DllImport("shell32.dll", EntryPoint="FindExecutable")]

public static extern long FindExecutableA(

string lpFile, string lpDirectory, StringBuilder lpResult);

public static string FindExecutable(

string pv_strFilename)

StringBuilder objResultBuffer =

new StringBuilder(1024);

long lngResult = 0;

lngResult =

FindExecutableA(pv_strFilename,

string.Empty, objResultBuffer);

if(lngResult >= 32)

return objResultBuffer.ToString();

"Error: ({0})", lngResult);

private void mnuDynamic_Click(object sender, System.EventArgs e)

MessageBox.Show(Win32API.FindExecutable(theMenuItem.Text));

[DllImport("Kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]

static extern uint GetFinalPathNameByHandle(IntPtr hFile, [MarshalAs(UnmanagedType.LPTStr)] StringBuilder lpszFilePath, uint cchFilePath, uint dwFlags);

private const uint FILE_NAME_NORMALIZED = 0x0;

Documentation

http://msdn.microsoft.com/en-us/library/windows/desktop/aa364962(v=vs.85).aspx

Summary

Describes the event that has occurred. Typically, only one event is specified at a time. If more than one event is specified, the values contained in the dwItem1 and dwItem2 parameters must be the same, respectively, for all specified events. This parameter can be one or more of the following values.

/// Typically, only one event is specified at a time.

/// If more than one event is specified, the values contained

/// parameters must be the same, respectively, for all specified events.

/// This parameter can be one or more of the following values.

/// in the system image list that has changed.

/// dwItem1 is not used and should be <see langword="null"/>.</para>

/// in the system image list that has changed.

/// dwItem2 is not used and should be <see langword="null"/>.</para>

[Flags]

/// All events have occurred.

SHCNE_ALLEVENTS = 0x7FFFFFFF,

/// A file type association has changed. <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/>

/// must be specified in the uFlags parameter.

/// dwItem1 and dwItem2 are not used and must be <see langword="null"/>.

/// The attributes of an item or folder have changed.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the item or folder that has changed.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A nonfolder item has been created.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A nonfolder item has been deleted.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the item that was deleted.

/// dwItem2 is not used and should be <see langword="null"/>.

SHCNE_DELETE = 0x00000004,

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A drive has been added and the Shell should create a new window for the drive.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A drive has been removed. <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// Not currently used.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A folder has been created. <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/>

/// or <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the folder that was created.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A folder on the local computer is being shared via the network.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the folder that is being shared.

/// dwItem2 is not used and should be <see langword="null"/>.

/// A folder on the local computer is no longer being shared via the network.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the folder that is no longer being shared.

/// dwItem2 is not used and should be <see langword="null"/>.

/// The name of a folder has changed.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the previous pointer to an item identifier list (PIDL) or name of the folder.

/// dwItem2 contains the new PIDL or name of the folder.

SHCNE_RENAMEFOLDER = 0x00020000,

/// The name of a nonfolder item has changed.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the previous PIDL or name of the item.

/// dwItem2 contains the new PIDL or name of the item.

/// A folder has been removed.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the folder that was removed.

/// dwItem2 is not used and should be <see langword="null"/>.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem2 is not used and should be <see langword="null"/>.

/// The contents of an existing folder have changed,

/// but the folder still exists and has not been renamed.

/// <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

/// <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

/// dwItem1 contains the folder that has changed.

/// dwItem2 is not used and should be <see langword="null"/>.

/// If a folder has been created, deleted, or renamed, use SHCNE_MKDIR, SHCNE_RMDIR, or

/// SHCNE_RENAMEFOLDER, respectively, instead.

/// An image in the system image list has changed.

/// <see cref="HChangeNotifyFlags.SHCNF_DWORD"/> must be specified in uFlags.

<Flags()> _

Public Enum HChangeNotifyEventID

' All events have occurred.

SHCNE_ALLEVENTS = &H7FFFFFFF

' A file type association has changed. <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/>

' must be specified in the uFlags parameter.

' dwItem1 and dwItem2 are not used and must be <see langword="null"/>.

' The attributes of an item or folder have changed.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the item or folder that has changed.

' dwItem2 is not used and should be <see langword="null"/>.

' A nonfolder item has been created.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' A nonfolder item has been deleted.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the item that was deleted.

' dwItem2 is not used and should be <see langword="null"/>.

SHCNE_DELETE = &H4

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' A drive has been added and the Shell should create a new window for the drive.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' A drive has been removed. <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' Not currently used.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' A folder has been created. <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/>

' or <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the folder that was created.

' dwItem2 is not used and should be <see langword="null"/>.

' A folder on the local computer is being shared via the network.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the folder that is being shared.

' dwItem2 is not used and should be <see langword="null"/>.

' A folder on the local computer is no longer being shared via the network.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the folder that is no longer being shared.

' dwItem2 is not used and should be <see langword="null"/>.

' The name of a folder has changed.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the previous pointer to an item identifier list (PIDL) or name of the folder.

' dwItem2 contains the new PIDL or name of the folder.

SHCNE_RENAMEFOLDER = &H20000

' The name of a nonfolder item has changed.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the previous PIDL or name of the item.

' dwItem2 contains the new PIDL or name of the item.

' A folder has been removed.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the folder that was removed.

' dwItem2 is not used and should be <see langword="null"/>.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem2 is not used and should be <see langword="null"/>.

' The contents of an existing folder have changed

' but the folder still exists and has not been renamed.

' <see cref="HChangeNotifyFlags.SHCNF_IDLIST"/> or

' <see cref="HChangeNotifyFlags.SHCNF_PATH"/> must be specified in uFlags.

' dwItem1 contains the folder that has changed.

' dwItem2 is not used and should be <see langword="null"/>.

' If a folder has been created deleted or renamed use SHCNE_MKDIR SHCNE_RMDIR or

' SHCNE_RENAMEFOLDER respectively instead.

' An image in the system image list has changed.

' <see cref="HChangeNotifyFlags.SHCNF_DWORD"/> must be specified in uFlags.

Alternative Managed API:

Do you know one? Please contribute it!

Notes: See SHChangeNotify, HChangeNotifyFlags

Please add some!

Sample Code:

Please add some!

Documentation

[HChangeNotifyEventID] on MSDN or http://msdn.microsoft.com/library/en-us/shellcc/platform/shell/reference/functions/shchangenotify.asp

Summary

Flags that indicate the meaning of the dwItem1 and dwItem2 parameters. The uFlags parameter must be one of the following values.

#region public enum HChangeNotifyFlags

/// Flags that indicate the meaning of the dwItem1 and dwItem2 parameters.

/// The uFlags parameter must be one of the following values.

[Flags]

public enum HChangeNotifyFlags

/// The dwItem1 and dwItem2 parameters are DWORD values.

/// dwItem1 and dwItem2 are the addresses of ITEMIDLIST structures that

/// Each ITEMIDLIST must be relative to the desktop folder.

SHCNF_IDLIST = 0x0000,

/// dwItem1 and dwItem2 are the addresses of null-terminated strings of

/// maximum length MAX_PATH that contain the full path names

/// dwItem1 and dwItem2 are the addresses of null-terminated strings of

/// maximum length MAX_PATH that contain the full path names

/// dwItem1 and dwItem2 are the addresses of null-terminated strings that

/// represent the friendly names of the printer(s) affected by the change.

/// dwItem1 and dwItem2 are the addresses of null-terminated strings that

/// represent the friendly names of the printer(s) affected by the change.

/// The function should not return until the notification

/// has been delivered to all affected components.

/// As this flag modifies other data-type flags, it cannot by used by itself.

SHCNF_FLUSH = 0x1000,

/// The function should begin delivering notifications to all affected components

/// but should return as soon as the notification process has begun.

/// As this flag modifies other data-type flags, it cannot by used by itself.

SHCNF_FLUSHNOWAIT = 0x2000

#endregion // enum HChangeNotifyFlags

<Flags()> _

Public Enum HChangeNotifyFlags

' The dwItem1 and dwItem2 parameters are DWORD values.

' dwItem1 and dwItem2 are the addresses of ITEMIDLIST structures that

' Each ITEMIDLIST must be relative to the desktop folder.

SHCNF_IDLIST = &H0

' dwItem1 and dwItem2 are the addresses of null-terminated strings of

' maximum length MAX_PATH that contain the full path names

' dwItem1 and dwItem2 are the addresses of null-terminated strings of

' maximum length MAX_PATH that contain the full path names

' dwItem1 and dwItem2 are the addresses of null-terminated strings that

' represent the friendly names of the printer(s) affected by the change.

' dwItem1 and dwItem2 are the addresses of null-terminated strings that

' represent the friendly names of the printer(s) affected by the change.

' The function should not return until the notification

' has been delivered to all affected components.

' As this flag modifies other data-type flags it cannot by used by itself.

SHCNF_FLUSH = &H1000

' The function should begin delivering notifications to all affected components

' but should return as soon as the notification process has begun.

' As this flag modifies other data-type flags it cannot by used by itself.

SHCNF_FLUSHNOWAIT = &H2000

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[HChangeNotifyFlags] on MSDN or http://msdn.microsoft.com/library/en-us/shellcc/platform/shell/reference/functions/shchangenotify.asp

Summary

TODO - Exposes a method that obtains an icon index for an IShellFolder object.

public interface IShellIcon

uint GetIconOf(IntPtr pidl, uint flags, out uint lpIconIndex);

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Documentation

[IShellIcon] on MSDN

/// An integer that indicates which drive letter you want to test.

[DllImport("shell32.dll", SetLastError = True)]

[return: MarshalAs(UnmanagedType.I4)]

''' An integer that indicates which drive letter you want to test.

<DllImport("shell32.dll", SetLastError:=True, CharSet:=CharSet.Unicode)> _

Public Function IsNetDrive(iDrive as Integer) As <MarshalAs(UnmanagedType.I4)> NetDriveTypes

Public Declare Function IsNetDrive Lib "shell32" _

(ByVal iDrive As Long) As NetDriveTypes

Alternative Managed API:

Do you know one? Please contribute it!

Please add some!

Sample Code:

Please add some!

Search Results for "l" in [All]

ntdll

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

shell32

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code:

Alternative Managed API:

Sample Code: