#ifndef _NTIOAPI_H
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3)

/**
 * The NtNotifyChangeDirectoryFileEx routine creates a change notification request for a directory.
 *
 * \param[in] FileHandle Handle to the directory.
 * \param[in, optional] Event Handle to an event.
 * \param[in, optional] ApcRoutine Pointer to an APC routine.
 * \param[in, optional] ApcContext Pointer to an APC context.
 * \param[out] IoStatusBlock Pointer to an IO_STATUS_BLOCK structure.
 * \param[out] Buffer Pointer to a buffer that receives change information.
 * \param[in] Length Size, in bytes, of the buffer.
 * \param[in] CompletionFilter Specifies the type of changes to notify.
 * \param[in] WatchTree If TRUE, the routine monitors the directory tree.
 * \param[in, optional] DirectoryNotifyInformationClass The type of information to return.
 * \return NTSTATUS Successful or errant status.
 * \sa https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-readdirectorychangesexw
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeDirectoryFileEx(
    _In_ HANDLE FileHandle,
    _In_opt_ HANDLE Event,
    _In_opt_ PIO_APC_ROUTINE ApcRoutine,
    _In_opt_ PVOID ApcContext,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ ULONG CompletionFilter,
    _In_ BOOLEAN WatchTree,
    _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwNotifyChangeDirectoryFileEx(
    _In_ HANDLE FileHandle,
    _In_opt_ HANDLE Event,
    _In_opt_ PIO_APC_ROUTINE ApcRoutine,
    _In_opt_ PVOID ApcContext,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ ULONG CompletionFilter,
    _In_ BOOLEAN WatchTree,
    _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass
    );

#endif
View code on GitHub