__cdecl and __stdcall can be omitted.

Monitoring direction is an extra keyword to specify when parameters should be logged.

To add it, after you function description (in the same line) add |Direction where Direction is one of the following keywords :
   - In : parameters are logged before the function call
   - Out : parameters are logged after the function call
   - InNoRet : parameters are logged before the function call and the log information are sent to WinAPIOverride before the function is called. So using this you wont get returned values nor after call registers, but it's great advantage is that log is captured even if the funtion call make the process crash.
   - InOut : InNoRet+Out : two logs are sent. One with parameters before the call and another after the function call

Notice : If no direction is specified, the default direction is "In"

Examples

msvcrt.dll|char * strcat( char *strDestination, char *strSource )|In

msvcrt.dll|strcpy( char *strDestination, char *strSource )|Out

Explanation
You want to monitor the following function call:
   strcat("To ","you");
According to the direction, results will be

	Description
Parameters options
:DataSize=	Allow to Specify an amount of data in byte to log for unsopported structures. Use this keyword for structures or types that are more than 4 bytes length. For a struct defined by { DWORD dw1; DWORD dw2; DWORD dw3; }Foo; and a function func(Foo foo); as the size of Foo is 12 bytes, you can log all the foo data by using the following Lib.dll|func(Foo foo:DataSize= 12) User structures are fully supported, and size is computed, so if your structure is defined in "UserTypes" directory, you don't need to specify the struct size (See User Types for more information)
:PointedElementsCount=	This option has the same effect as the ":PointedDataSize" option multiplied by the size of the current type PointedElementsCount = PointedDataSize*sizeof(Type), where sizeof(Type) is auto computed according to Type definition. By the way if you are waiting for a 7 intergers array, you can write Lib.dll|funcArray(int* Array:PointedElementsCount=7) instead of Lib.dll|funcArray(int* Array:PointedDataSize=28) Like the ":PointedDataSize" option, This option as all the facilities of ArgX and basic operations (+-*/) SECURITY_STATUS WINAPI NCryptEnumAlgorithms(NCRYPT_PROV_HANDLE hProvider,DWORD dwAlgOperations,DWORD *pdwAlgCount,NCryptAlgorithmName **ppAlgList:PointerReference:ProcessorDependent:PointedElementsCount=Arg3,DWORD dwFlags);|Out
:PointedDataSize=	When parameter is a pointer, allow to specify an amount of data to log (value is in byte byte count) Use this keyword for array,buffer or pointer to unsupported types. With the same Foo structure and a function funcRef(Foo* pfoo) Lib.dll|func(Foo* pfoo:PointedDataSize=12) You can use this option for array too. By the way if you are waiting for a 7 intergers array, as sizeof(int)==4, pointed data size is 7*4=28, so you can write Lib.dll|funcArray(int* Array:PointedDataSize=28) Basics operations (+-*/) are supported, so you can write Lib.dll|funcArray(int* Array:PointedDataSize=7*(4+4)) You can also specify a parameter number defining the size. It is realy useful for all function writing or reading buffer. Syntax is :PointedDataSize=ArgU where U is one based parameter number. By the way you can write kernel32.dll|BOOL ReadFile( HANDLE hFile, LPVOID lpBuffer:PointedDataSize=Arg4, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)|Out kernel32.dll|BOOL WriteFile( HANDLE hFile, LPCVOID lpBuffer:PointedDataSize=Arg3, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)|Out Since version 5.3, for functions having Array and ArrayItemsCount as arguments, the ArgU has been extended so you can define a factor : you can write :PointedDataSize=ArgU*ItemSize where ItemSize is the size of a single item. For a function passing an array of dword in first parameter, and number of item in array in second parameter, as sizeof(DWORD)=4, we can write Mydll.dll|void MyFunction(DWORD* ArrayOfDword:PointedDataSize=Arg2*4, SIZE_T ArrayItemsCount) User structures are fully supported, and size is computed, so if your structure is defined in "UserTypes" directory, you don't need to specify the struct size (See User Types for more information) Static array are supported Mydll.dll|void MyFunction(int iArray[2][4][5],short sArray[5])
32 / 64 bit compatibility	With a view to have a single monitoring file for 32 bit and 64 bit software, as type size can be processor dependent, the following keywords have been introduced :
:ProcessorDependent	For a FOO type, when this keyword is specified,   - the FOO64 type will be search when monitoring file is loaded into a 64 bit process   - the FOO32 and if not found the FOO type will be searched when monitoring file is loaded into a 32 bit process Don't forget to provide the 2 structs in your User Defines directory Lib.dll|func(FOO* pfoo:ProcessorDependent) will act like Lib.dll|func(FOO64* pfoo) in a 64 bit process and Lib.dll|func(FOO32* pfoo) or Lib.dll|func(FOO* pfoo) in a 32 bit process
PointerSize and RegisterSize for the ":PointedDataSize" and ":DataSize" option	When using the ":PointedDataSize" of ":DataSize" option, you may will face some structures defined by { LPVOID Pointer; SIZE_T Data; DWORD dw3; }Foo; In such case, as sizeof(DWORD)=4, you can write Lib.dll|func(FOO* pfoo:PointedDataSize=PointerSize+RegisterSize+4) And if you get an array Lib.dll|func(FOO* pfoo:PointedDataSize=Arg2*(PointerSize+RegisterSize+4), DWORD NbItems)
Pointers passed by reference / Pointers to array / Pointers to string
:PointerReference	When functions are allocating objects, arrays or strings, you have to provide a reference to a pointer as parameter like Lib.dll|funcAllocateArray(IN DWORD NbItems,OUT DWORD** pArray)|Out This option do a deferencing before logging, so the content of DWORD** pArray, aka DWORD* Array will be logged instead All other options apply to the deferenced type (aka for T**, all options applies to T*) This is interesting for ":PointedDataSize=", ":PointedElementsCount=",... Lib.dll|funcAllocateArray(IN DWORD NbItems,OUT DWORD** pArray:PointerReference:PointedDataSize=Arg1*4)|Out Lib.dll|funcAllocateArray(IN DWORD NbItems,OUT DWORD** pArray:PointerReference:PointedElementsCount=Arg1)|Out kernel32.dll|DWORD GetFullPathNameW(LPCWSTR lpFileName,DWORD nBufferLength,LPWSTR lpBuffer,LPWSTR* lpFilePart:PointerReference)|Out This option do a single dereferencing, and don't manage multiple dimensions, so T** is logged as a T[0]* type even if there is more dimensions. For T** = new T*[16]; array, only T[0]* will be logged
Parameters User Define
:Define=	Allow to specify a file containing define values. (See User Defines for more information) Doing this, the detailed view will display defined flags instead of raw value. The file name is relative path from the "UserDefines" directory Example of results user32.dll|int MessageBoxW( HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType:Define=user32.dll/MessageBox_Type.txt) kernel32.dll|HANDLE CreateFileW( LPCWSTR lpFileName, DWORD dwDesiredAccess:Define=kernel32.dll/CreateFile_DesiredAccess.txt, DWORD dwShareMode:Define=kernel32.dll/CreateFile_ShareMode.txt, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition:Define=kernel32.dll/CreateFile_CreationDisposition.txt, DWORD dwFlagsAndAttributes:Define=kernel32.dll/CreateFile_FlagsAndAttributes.txt, HANDLE hTemplateFile)|FailureIfRetValue=0xFFFFFFFF
	Conditional logging options can be mixed together without troubles (they can be mixed with breaking options too) user32.dll|ChildWindowFromPoint(HWND hWndParent:LogValue=0xd, POINT Point:LogBufferValue=C8 00 00 00 2C 01 00 00)|LogIfNullRet
Parameters Conditional Logging
:LogValue=	Log calls only when the parameter(s) match the specified value(s). Use this keyword for types size less than register size (4 bytes lentgh in 32bit, 8 for 64bit). Value can be in decimal or hexadecimal To enable log for different values, just use this option with different values   SendMessageA monitored only with WM_GETTEXT or EM_GETSELTEXT messages User32.dll|SendMessageA(HWND hWnd,UINT Msg:LogValue=0xd:LogValue=0x462,WPARAM wParam,LPSTR lParam) Conditions on multiples parameters Lib.dll|Add(int x:LogValue=0xd:LogValue=0x462, int y:LogValue=12:LogValue=48)
:LogBufferValue=	Log calls only when the parameter(s) match the specified value(s). Use this keyword for structures or types that are more than register size (4 bytes lentgh in 32bit, 8 for 64bit). Take care of byte ordering for struct Point {0xC8,0x12C} is in little endian C8 00 00 00 2C 01 00 00   To watch only cos call when value is 2.0 , as double type is 8 bytes length, for 32bit ntdll.dll|cos(double:LogBufferValue=0000000000000040) To catch ChildWindowFromPoint only when Point is {0xC8,0x12C} user32.dll|ChildWindowFromPoint(HWND hWndParent, POINT Point:LogBufferValue=C8 00 00 00 2C 01 00 00)
:LogPointedValue=	Log calls only when the parameter(s) match the specified pointed value(s). Use this keyword for simple pointer, pointer to structures, or buffer. Simple pointer : if pointed value should be 0x4 or 0x6 Lib.dll|func(int *px:LogPointedValue=04 00 00 00:LogPointedValue=06 00 00 00) Pointer to buffer : To log all message boxes having the "Error" caption in UNICODE enter the following USER32.DLL|MessageBoxW(HWND,LPCWSTR,LPCWSTR:LogPointedValue=4500720072006F0072000000,UINT) Use the String Hex dialog for string to bytes buffer conversion
:LogValueSignedLessOrEqual=	Log calls only when the signed representation of parameter is <= at the specified value. Lib.dll|func(int i:LogValueSignedLessOrEqual=-21) Notice: float and double are currently not supported
:LogValueSignedGreaterOrEqual=	Log calls only when the signed representation of parameter is >= at the specified value. Lib.dll|func(int i:LogValueSignedGreaterOrEqual=-21) Notice: float and double are currently not supported
:LogValueUnsignedLessOrEqual=	Log calls only when the unsigned representation of parameter is <= at the specified value. Lib.dll|func(DWORD dw:LogValueUnsignedLessOrEqual=0xfffffff7) Notice: float and double are currently not supported
:LogValueUnsignedGreaterOrEqual=	Log calls only when the unsigned representation of parameter is >= at the specified value. Lib.dll|func(DWORD dw:LogValueUnsignedGreaterOrEqual=0xfffffff7) Notice: float and double are currently not supported
Return Conditional Logging
|LogIfNullRet	Call is logged only if the returned value is null. Don't work for double or floating results Incompatible with the "InNoRet" direction spying Lib.dll|f(int a,int b) | LogIfNullRet
|LogIfNotNullRet	Call is logged only if the returned value is not null. Don't work for double or floating results Incompatible with the "InNoRet" direction spying   Lib.dll|f(int a,int b) | LogIfNotNullRet
Call Success Conditional Logging
|LogOnFailure	Check the failure of the function defined by Failure Options, and log the call only if function fails Incompatible with the "InNoRet" direction spying   Lib.dll|f(int a,int b) | LogOnFailure
|LogOnSuccess	Check the failure of the function defined by Failure Options, and log the call only if function doesn't fail Incompatible with the "InNoRet" direction spying   Lib.dll|f(int a,int b) | LogOnSuccess
Return Pointer supported since 6.1	When the return value points to an array or a struct By default you don't need to do anything, pointer to struct are automatically parsed according to your UserTypes directory content, If struct is not defined or for arrays, you can use the |ReturnPointedDataSize= option
|ReturnPointedDataSize=	When return is a pointer, allow to specify an amount of data to log (value is in byte count) Use this keyword for array,buffer or pointer to unsupported types. Same as parameter option :PointedDataSize= for return (See :PointedDataSize= parameter option syntax for more information) Lib.dll|f(int a,int b) | ReturnPointedDataSize=32 Lib.dll|f(int a,int b) | ReturnPointedDataSize=Arg1 Lib.dll|f(int a,int b) | ReturnPointedDataSize=Arg2*4
Large Return supported since 6.0	When the size of return type is larger than the size of register (struct larger than 4 bytes for 32bit, and 8 bytes for 64bit) This flag allow to get return content and avoid bad parameter parsing Use these options only for direct struct or type returns (like MSG MyFunction()) Do not use these options for pointers to array, pointers to struct or pointers to class (like MSG* MyFunction()) Since v6.1, pointer to struct are automatically parsed according to your UserTypes directory content, or you can use the |ReturnPointedDataSize= option
|LargeReturnType=	allow to specify a type supported by WinApiOverride or define in your "UserTypes" directory Only for static functions (use MethodLargeReturnType for methods) Lib.dll|f(int a,int b) | LargeReturnType=MSG
|LargeReturnSize=	allow to specify directly the size of return type Only for static functions (use MethodLargeReturnType for methods) Lib.dll|f(int a,int b) | |LargeReturnSize=0x40
|LargeReturn	If you are not interest by the return content, but just want a good parameter parsing Only for static functions (use MethodLargeReturnType for methods) Lib.dll|f(int a,int b) | LargeReturn
|MethodLargeReturnType=	allow to specify a type supported by WinApiOverride or define in your "UserTypes" directory Lib.dll|ClassName::f(int a,int b) | MethodLargeReturnType=MSG
|MethodLargeReturnSize=	allow to specify directly the size of return type Lib.dll|ClassName::f(int a,int b) | |MethodLargeReturnSize=0x40
|MethodLargeReturn	If you are not interest by the return content, but just want a good parameter parsing Lib.dll|ClassName::f(int a,int b) | MethodLargeReturn
Return User Define
|ReturnDefine=	Allow to specify a file containing define values. (See User Defines for more information) Doing this, the detailed view will display defined flags instead of raw value. The file name is relative path from the "UserDefines" directory This option works like the parameter :Define= option user32.dll|int MessageBoxW( HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType) |ReturnDefine=user32.dll/MessageBox_Return.txt Mixing this option with the parameter :Define= option, we get for MessageBox : user32.dll|int MessageBoxW( HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType:Define=user32.dll/MessageBox_Type.txt) |ReturnDefine=user32.dll/MessageBox_Return.txt

    // function standard begin
    mov dword ptr [rsp+20h],r9d // <-- first hook can be put here
    mov qword ptr [rsp+18h],r8
    mov qword ptr [rsp+10h],rdx
    mov qword ptr [rsp+8],rcx
    push rsi
    push rdi
    sub rsp,538h
    // function body
    ...
    ...
    ...
    // function standard end
    call __security_check_cookie // <-- second hook can be put here : return value is in Rax
    add rsp,538h
    pop rdi
    pop rsi
    ret  

These options are very powerfull : no loss of message and speedest algorithm; but you have to be sure you can use them . To see how to find first functions bytes without a dissassembler refer to faq : Get first functions bytes without a dissassembler

First bytes of function may change at each software/dll version. So using these options generally make your monitoring file not compatible with other version of the software/dll

Example

msvcrt.dll|char * strcat( char *strDestination, const char *strSource )

is the same as

msvcrt.dll|char * strcat( char *strDestination, char *strSource )

Particular cases : function pointer and "..."

Function pointer :

Since version 5.0, function parameters like lib.dll|func(int (__cdecl*)(unsigned int)) are fully supported.
On previous versions, Instead of describing the whole function description, you have to use FARPROC keyword

Example:

Instead of

lib.dll|func(int (__cdecl*)(unsigned int))

use

lib.dll|func(FARPROC pFunc)

"..." :

  1) If you want to make a generic monitoring, you have to remove them to avoid trying reading invalid memory.
By the way the printf function will by defined by :

msvcrt.dll|int printf( const char *format)

  2) If you want to make a particular monitoring on one call, adjust the amount of parameters to the specific function call you want to watch.
By the way if you want to monitor the call printf("hello my name is %s, I am %d years old", strName, nYears), just use the following monitoring description

msvcrt.dll|int printf( const char *format, char* Name, int Years)

You may will catch some other noisy printf calls, but ordering logs by caller address will allow you to find the good ones. (Click the "Caller Address" column header to order logs)


Fully Supported Parameters Types

If a type of parameter is not fully supported, it will be display like an unsigned long To monitor not supported types or structures you can     a) use :DataSize= and :PointedDataSize= logging options (see the above Logging options in the advanced syntax) or     b) define your user structs and types. In this case size is computed, so if you struct is defined in "UserTypes" directory, you don't need to specify the struct size (See User Types for more information)

All types are not case sensitive (you can use PSTR or pstr).

Static array are supported f(int iArray[2][4][5],short sArray[5])

PSTR, PCSTR, LPSTR, LPCSTR, CHAR*, SEC_CHAR*, PCHAR, LPCHAR,
PWSTR, PCWSTR, LPWSTR, LPCWSTR, LPCWSTR, WCHAR*, PWCHAR, LPWCHAR, wchar_t*, SEC_WCHAR*, BSTR, OLECHAR, LPOLESTR
VOID*, PVOID, LPVOID, LPCVOID, VOID**, PVOID*, LPVOID*, LPCVOID*,
CHAR, SEC_CHAR, UCHAR, BOOLEAN, BYTE, BYTE*, PBYTE, LPBYTE, BOOLEAN*, PBOOLEAN, LPBOOLEAN, UCHAR*, PUCHAR, LPUCHAR,
WCHAR, SEC_WCHAR, wchar_t, wctrans_t, WORD, short, SHORT, USHORT, u_short, wint_t, wctype_t, WPARAM,
short*, SHORT*, PSHORT, LPSHORT, USHORT*, PUSHORT, LPUSHORT, WORD*, PWORD, LPWORD, u_short*,
BOOL, BOOL*, PBOOL, LPBOOL,
SIZE_T, _fsize_t, SIZE_T*, PSIZE_T, LPSIZE_T,
INT, INT*, PINT, LPINT, UINT, UINT*, PUINT, LPUINT,
LONG, NTSTATUS, LONG_PTR, LPARAM, LONG*, PLONG, LPLONG, LONG_PTR*, PLONG_PTR, LPLONG_PTR,
ULONG_PTR, UINT_PTR, SOCKET, ULONG, u_long, DWORD, ULONG*, PULONG, LPULONG, SOCKET*, u_long*,
DWORD*, PDWORD, LPDWORD, ULONG_PTR*, PULONG_PTR, LPULONG_PTR, LSA_HANDLE, LSA_HANDLE*,
PLSA_HANDLE, LPLSA_HANDLE,
HKEY, PHKEY, HKEY*, COLORREF, COLORREF*, LPCOLORREF, PFNCALLBACK, LCID,
SYSTEMTIME, SYSTEMTIME*, PSYSTEMTIME, LPSYSTEMTIME, FILETIME, FILETIME*, PFILETIME, LPFILETIME,
ACCESS_MASK, ACCESS_MASK*, PACCESS_MASK,
HANDLE, HINSTANCE, HWND, HMODULE, HMODULE*, PHMODULE, LPHMODULE, HANDLE*, PHANDLE, LPHANDLE,
HDESK, HBRUSH, HRGN, HDPA, HDSA, HDC, HICON, HICON*, WNDPROC, HMENU, HIMAGELIST,
DLGPROC, FARPROC, LPWSAOVERLAPPED_COMPLETION_ROUTINE,
HPALETTE, HFONT, HMETAFILE, HGDIOBJ, HCOLORSPACE, HBITMAP, HCONV, HSZ, HDDEDATA, SC_HANDLE,
HCERTSTORE, HGLOBAL, PSID, PSID*, PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR*, SECURITY_INFORMATION,
REGSAM, SECURITY_ATTRIBUTES, SECURITY_ATTRIBUTES*, PSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES,
ACL, ACL*, PACL, LPCDLGTEMPLATE,
WNDCLASS, WNDCLASS*, PWNDCLASS, LPWNDCLASS, WNDCLASSEX, WNDCLASSEX*, PWNDCLASSEX, LPWNDCLASSEX,
POINT, POINT*, PPOINT, LPPOINT, POINTL, POINTL*, PPOINTL,
SIZE, SIZE*, PSIZE, LPSIZE, RECT, RECT*, PRECT, LPRECT, RECTL, RECTL, PRECTL, LPRECTL,
CRITICAL_SECTION, CRITICAL_SECTION*, PCRITICAL_SECTION, LPCRITICAL_SECTION,
sockaddr, sockaddr*, PSOCKADDR, LPSOCKADDR, sockaddr_in, sockaddr_in*, hostent, hostent*,
timeval*, FILE*, LPSTARTUPINFO, LPSTARTUPINFOW, LPSHELLEXECUTEINFO, LPSHELLEXECUTEINFOW,
LARGE_INTEGER, LARGE_INTEGER*, PLARGE_INTEGER, ULARGE_INTEGER, ULARGE_INTEGER*, PULARGE_INTEGER,
GUID, GUID*, PGUID, LPGUID, REFGUID, IID, IID*, PIID, LPIID, REFIID, CLSID, CLSID*, PCLSID, LPCLSID, REFCLSID,
FMTID, FMTID*, PFMTID, LPFMTID, REFFMTID, MSG*, PMSG, LPMSG,
HCRYPTPROV, HCRYPTKEY, HCRYPTHASH,
PUNICODE_STRING, UNICODE_STRING*, PANSI_STRING, ANSI_STRING*,
PSecHandle, PCtxtHandle, PCredHandle,
MEMORY_BASIC_INFORMATION, MEMORY_BASIC_INFORMATION*, PMEMORY_BASIC_INFORMATION,
PROCESSENTRY32*, LPPROCESSENTRY32, PPROCESSENTRY32, PROCESSENTRY32W*, LPPROCESSENTRY32W, PPROCESSENTRY32W,
MODULEENTRY32*, LPMODULEENTRY32, PMODULEENTRY32, MODULEENTRY32W*, PMODULEENTRY32W, LPMODULEENTRY32W,
HEAPENTRY32*, PHEAPENTRY32, LPHEAPENTRY32, THREADENTRY32*, PTHREADENTRY32, LPTHREADENTRY32,
PROCESS_HEAP_ENTRY*, PPROCESS_HEAP_ENTRY, LPPROCESS_HEAP_ENTRY,
WIN32_FIND_DATA*, PWIN32_FIND_DATA, LPWIN32_FIND_DATA, WIN32_FIND_DATAW*, PWIN32_FIND_DATAW, LPWIN32_FIND_DATAW,
IO_STATUS_BLOCK*, PIO_STATUS_BLOCK,
PRINTDLG*, LPPRINTDLG, LPPRINTDLGA, LPPRINTDLGW, PRINTDLGEX*, LPPRINTDLGEX, LPPRINTDLGEXA, LPPRINTDLGEXW,
PAGESETUPDLG*, LPPAGESETUPDLG, LPPAGESETUPDLGA, LPPAGESETUPDLGW,
OPENFILENAME*, LPOPENFILENAME, LPOPENFILENAMEA, LPOPENFILENAMEW,
CHOOSEFONT*, LPCHOOSEFONT, LPCHOOSEFONTA, LPCHOOSEFONTW,
FINDREPLACE*, LPFINDREPLACE, LPFINDREPLACEA, LPFINDREPLACEW,
BROWSEINFO*, PBROWSEINFO, LPBROWSEINFO, LPBROWSEINFOA, LPBROWSEINFOW,
SHFILEINFOA*, PSHFILEINFOA, SHFILEINFOW*, PSHFILEINFOW,
NOTIFYICONDATA*, PNOTIFYICONDATA, NOTIFYICONDATAA*, PNOTIFYICONDATAA, NOTIFYICONDATAW*, PNOTIFYICONDATAW,
fd_set*, WSABUF*, PWSABUF, LPWSABUF,
ADDRINFO*, PADDRINFO, LPADDRINFO,
WSADATA*, PWSADATA, LPWSADATA,
LPWSAPROTOCOL_INFOA, LPWSAPROTOCOL_INFOW,
OVERLAPPED*, POVERLAPPED, LPOVERLAPPED, WSAOVERLAPPED*, PWSAOVERLAPPED, LPWSAOVERLAPPED,
float, float*, PFLOAT, LPFLOAT, double, double*, PDOUBLE, LPDOUBLE,
__int64, INT64, INT64*, PINT64, LPINT64, ULONG64, ULONG64*, PULONG64, LPULONG64,
DWORD64, DWORD64*, PDWORD64, LPDWORD64, ULONGLONG, ULONGLONG*, PULONGLONG, DWORDLONG, DWORDLONG*, PDWORDLONG,
TRACEHANDLE, TRACEHANDLE*, PTRACEHANDLE, DCB*, PDCB, LPDCB, COMMTIMEOUTS*, PCOMMTIMEOUTS, LPCOMMTIMEOUTS,
COMMCONFIG*, PCOMMCONFIG, LPCOMMCONFIG
SAFEARRAY, SAFEARRAY*, LPSAFEARRAY, SAFEARRAYBOUND, SAFEARRAYBOUND*, LPSAFEARRAYBOUND
VARIANTARG, LPVARIANT, VARIANTARG*, VARIANT*
DECIMAL, DECIMAL*, LPDECIMAL
MULTI_QI, MUTLI_QI*, LPMUTLI_QI
EXCEPINFO, EXCEPINFO*, LPEXCEPINFO
DISPPARAMS, DISPPARAMS*, PDISPPARAMS, LPDISPPARAMS
LOGFONTA, LOGFONTA*, PLOGFONTA, LPLOGFONTA, LOGFONTW, LOGFONTW*, PLOGFONTW, LPLOGFONTW