The declaration of NtCreateEvent (and probably others) in the projects ntddk.h is not correct.
Current (and older) WinDDK sources declare NtCreateEvent(ZwCreateEvent as such:
__drv_maxIRQL(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateEvent (
__out PHANDLE EventHandle,
__in ACCESS_MASK DesiredAccess,
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
__in EVENT_TYPE EventType,
__in BOOLEAN InitialState
);
The last two parameters are the ones in question.
Hi, this is not a bug, this is a feature ;-) Since many of native calls are undocumented, we've replaced types of all doubtful parameters by a universal SIZE_T keyword.
How it works? It forces the compiler to use entire register while passing the parameter to the routine. This guarantees that any (unknown) data type will be passed correctly - independent from its actual size.
We have had already problems with wrong definitions where BOOLEAN has been used instead of EVENT_TYPE. This forced compiler to set only the lowest single bit in register while Windows expected an entire register to be correct.
So, this is absolutely safe to use SIZE_T data type when we have no assurance that some other data type is really used on all of the supported versions of Windows.
Though, later we'll adjust some prototypes including a mentioned one, we just would like to ensure that the new prototypes will work correctly on all systems before.
Dmitri