Musa.Veil 1.11.0

Requires NuGet 2.5 or higher.

dotnet add package Musa.Veil --version 1.11.0

NuGet\Install-Package Musa.Veil -Version 1.11.0

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="Musa.Veil" Version="1.11.0" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="Musa.Veil" Version="1.11.0" />
                    

                            Directory.Packages.props

<PackageReference Include="Musa.Veil" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add Musa.Veil --version 1.11.0

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: Musa.Veil, 1.11.0"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package Musa.Veil@1.11.0

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=Musa.Veil&version=1.11.0
                    

                            Install as a Cake Addin

#tool nuget:?package=Musa.Veil&version=1.11.0
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Musa.Veil

简体中文

Musa.Veil is a collection of Native API definitions for Windows. The name "Veil" signifies lifting the veil of Windows to reveal what lies beneath.

This project contains the definitions for the Windows internal undocumented API from ntoskrnl.exe, ntdll.dll, kernelbase.dll.

This project is a fork based on systeminformer/phnt and Chuyu-Team/MINT, combining the strengths of both.

Both user-mode and kernel-mode are supported.
Compiling using the /W4 /WX option is supported.
Optimized for the Windows SDK.
The API is managed by Windows SDK version macros.

How to use

Method 1 (recommended)

Right click on the project, select "Manage NuGet Packages". Search for Musa.Veil, choose the version that suits you, and then click "Install".

If your project template uses Mile.Project.Windows, you can add the following code directly to your .vcxproj file:

  <ItemGroup>
    <PackageReference Include="Musa.Veil">
      
      <Version>1.0.0</Version>
    </PackageReference>
  </ItemGroup>

Method 2

First, make sure that your program is using the latest Windows SDK. Then clone this repository and add the include path to your project.

Method 3 (CMake FetchContent)

include(FetchContent)

FetchContent_Declare(
    Musa.Veil
    GIT_REPOSITORY https://github.com/MiroKaku/Musa.Veil.git
    GIT_TAG main
    GIT_SHALLOW TRUE
)
FetchContent_MakeAvailable(Musa.Veil)

add_library(Musa.Veil INTERFACE)
target_include_directories(Musa.Veil INTERFACE "${musa.veil_SOURCE_DIR}")

# Link to your target
target_link_libraries(YourTarget PRIVATE Musa.Veil)

Advanced Usage

// If you want to use a separate namespace, define the following macro.
#define VEIL_USE_SEPARATE_NAMESPACE

// Include Veil.h before any other headers
#include "Veil.h"

Product	Compatible and additional computed target framework versions.
native	native is compatible.

Compatible target framework(s)

Included target framework(s) (in package)

Learn more about Target Frameworks and .NET Standard.

- YY.NuGet.Import.Helper (>= 1.0.1)

NuGet packages (1)

Showing the top 1 NuGet packages that depend on Musa.Veil:

Package	Downloads
Musa.CoreLite Musa.CoreLite - 该项目旨在解决 Zw* 系统例程导出符号不完整的问题，使开发者能够在用户模式和内核模式下直接调用所有 Zw* 系统例程而无需担心符号缺失的问题。	7.0K

GitHub repositories

This package is not used by any popular GitHub repositories.

Version	Downloads	Last Updated
1.11.0	195	9/19/2026
1.10.0	517	5/30/2026
1.9.1	391	5/17/2026
1.9.0	345	5/16/2026
1.8.0	419	5/1/2026
1.7.0	461	3/29/2026
1.6.0	406	3/8/2026
1.5.0	1,064	8/26/2025
1.4.1	990	5/25/2025
1.4.0	608	5/25/2025
1.3.2	817	3/22/2025
1.3.1	659	3/21/2025
1.3.0	652	3/21/2025
1.2.6	883	10/26/2024
1.2.5	902	8/12/2024
1.2.4	682	8/2/2024
1.2.3	770	7/25/2024
1.2.2	744	7/18/2024
1.2.1	700	7/18/2024

v1.11.0: phnt sync to 2a0045bfc

Sync Veil headers to phnt commit 2a0045bfc572d1c9ea6d8843dc6cf6cae1e20fd7.
Covers both unreleased sync ranges, a284c82c9f0fd6afb1b7c215ad17fedd95d3525e and
2a0045bfc572d1c9ea6d8843dc6cf6cae1e20fd7.

From a284c82c9f0fd6afb1b7c215ad17fedd95d3525e:

- AGENTS: define source auditing, API conversion, version mapping, validation, and cache cleanup policy
- D3DKMT: add NTSYSAPI exports for process enumeration helpers
- Executive: update delay semantics, system information metadata, code-integrity structures, OSL RAM-disk address type, and Nt/Zw NLS signatures
- Etw: add PCW counter APIs and helpers plus byte-packed TCP/UDP WMI event layouts
- Loader: add the 32-bit LDRP_DEPENDENCY representation
- PowerManager: reconcile energy-tracker limits, flags, fields, ordering, and record offsets
- Win32: add GDI handle limits, pseudo-window ownership, message-pump, low-latency, and capture-buffer declarations; update FN_DISPATCH
- Zw declarations: normalize IRQL, NTSYSAPI, and NTAPI metadata with documented WDK kernel-mode adaptations

From 2a0045bfc572d1c9ea6d8843dc6cf6cae1e20fd7:

- ALPC: add ALPC_HANDLEFLG_INDIRECT and ALPC_INDIRECT_HANDLE_MAX, rebuild the ALPC_HANDLE_ATTR32 and ALPC_HANDLE_ATTR layouts as unions with bitfields
- Etw: add the byte-packed TCP/IP send-event layouts and connection-id/sequence fields, correct the UDP transfer-size width, add the PCW buffer structures and parsing helpers
- Executive: rename BOOT_ENTROPY_NT_RESULT.maxEntropySources, document the WHEA IPMI fields, fix the Nt/Zw NLS declarations
- Loader: correct the LdrControlFlowGuardEnforced guard and its documentation, keeping the Windows 10 baseline guard instead of the upstream RS3 threshold
- ObjectManager: add OBJECT_SET_REF_TRACE_INFORMATION
- Process: name the leap-second flag, union the global-flag and extended-feature-disable fields in PEB and TEB, move NtContinue after NtContinueEx
- RuntimeLibrary: define the RTL_RCU structures with their prototypes, add the RtlIsZeroMemory inline implementation, relax the locale file-mapping output parameter
- veil-update skill: map ntpebteb.h and ntxcapi.h, treat ntmisc.h as multi-domain, align the version token conversions with the synchronization policy

BREAKING CHANGE:

- BOOT_ENTROPY_NT_RESULT.maxEntropySources renamed to MaxEntropySources
- ALPC_HANDLE_ATTR is now a union of bitfields: SameAccess, SameAttributes, Indirect, Inherit, GrantedAccess and the reserved members are no longer directly addressable, and ALPC_HANDLE_ATTR32 drops its duplicated fields
- RTL_RCU_COOKIE is removed; RtlRcuReadLock takes PRTL_RCU_THREAD_ENTRY*, RtlRcuReadUnlock takes it by value, and RtlRcuFree and RtlRcuSynchronize return VOID
- NtGetNlsSectionPtr, NtInitializeNlsFiles and RtlGetLocaleFileMappingAddress change their parameters and annotations, and the Zw declarations follow
- WMI TCP/IP and UDP event structures are byte-packed and carry connection-id and sequence fields; WMI_UDP_V4 and WMI_UDP_V6 TransferSize widened to ULONG
- PEB.NtGlobalFlag2 is now a bitfield struct; the raw value is PEB.NtGlobalFlags2
- LdrControlFlowGuardEnforced stays available on the whole Windows 10 baseline in Veil, narrower than the current upstream guard