WIN32K_SYSCALL_FILTER - NtDoc

#ifndef _NTPSAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The WIN32K_SYSCALL_FILTER structure is used to specify filtering options for Win32k system calls.
 */
typedef struct _WIN32K_SYSCALL_FILTER
{
    ULONG FilterState; // The state of the Win32k syscall filter (e.g., enable, audit).
    ULONG FilterSet;   // The set of Win32k syscalls to be filtered.
} WIN32K_SYSCALL_FILTER, *PWIN32K_SYSCALL_FILTER;

#endif
#endif
View code on GitHub