ReactOS  0.4.13-dev-39-g8b6696f
ps.h File Reference
#include "ps_x.h"
Include dependency graph for ps.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes

struct  _GET_SET_CTX_CONTEXT
 

Macros

#define _PS_DEBUG_   0x00
 
#define PS_THREAD_DEBUG   0x01
 
#define PS_PROCESS_DEBUG   0x02
 
#define PS_SECURITY_DEBUG   0x04
 
#define PS_JOB_DEBUG   0x08
 
#define PS_NOTIFICATIONS_DEBUG   0x10
 
#define PS_WIN32K_DEBUG   0x20
 
#define PS_STATE_DEBUG   0x40
 
#define PS_QUOTA_DEBUG   0x80
 
#define PS_KILL_DEBUG   0x100
 
#define PS_REF_DEBUG   0x200
 
#define PSTRACE(x, fmt, ...)   DPRINT(fmt, ##__VA_ARGS__)
 
#define PSREFTRACE(x)
 
#define PSP_MAX_CREATE_THREAD_NOTIFY   8
 
#define PSP_MAX_LOAD_IMAGE_NOTIFY   8
 
#define PSP_MAX_CREATE_PROCESS_NOTIFY   8
 
#define PSP_JOB_SCHEDULING_CLASSES   10
 

Typedefs

typedef struct _GET_SET_CTX_CONTEXT GET_SET_CTX_CONTEXT
 
typedef struct _GET_SET_CTX_CONTEXTPGET_SET_CTX_CONTEXT
 

Functions

VOID NTAPI PspShutdownProcessManager (VOID)
 
INIT_FUNCTION BOOLEAN NTAPI PsInitSystem (IN PLOADER_PARAMETER_BLOCK LoaderBlock)
 
PETHREAD NTAPI PsGetNextProcessThread (IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
 
PEPROCESS NTAPI PsGetNextProcess (IN PEPROCESS OldProcess OPTIONAL)
 
NTSTATUS NTAPI PspMapSystemDll (IN PEPROCESS Process, OUT PVOID *DllBase, IN BOOLEAN UseLargePages)
 
INIT_FUNCTION NTSTATUS NTAPI PsLocateSystemDll (VOID)
 
NTSTATUS NTAPI PspGetSystemDllEntryPoints (VOID)
 
VOID NTAPI PsChangeQuantumTable (IN BOOLEAN Immediate, IN ULONG PrioritySeparation)
 
NTSTATUS NTAPI PsReferenceProcessFilePointer (IN PEPROCESS Process, OUT PFILE_OBJECT *FileObject)
 
NTSTATUS NTAPI PspCreateProcess (OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess OPTIONAL, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
 
PACCESS_TOKEN NTAPI PsReferenceEffectiveToken (IN PETHREAD Thread, OUT IN PTOKEN_TYPE TokenType, OUT PBOOLEAN EffectiveOnly, OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
 
NTSTATUS NTAPI PsOpenTokenOfProcess (IN HANDLE ProcessHandle, OUT PACCESS_TOKEN *Token)
 
NTSTATUS NTAPI PspSetPrimaryToken (IN PEPROCESS Process, IN HANDLE TokenHandle OPTIONAL, IN PACCESS_TOKEN Token OPTIONAL)
 
NTSTATUS NTAPI PspInitializeProcessSecurity (IN PEPROCESS Process, IN PEPROCESS Parent OPTIONAL)
 
VOID NTAPI PspDeleteProcessSecurity (IN PEPROCESS Process)
 
VOID NTAPI PspDeleteThreadSecurity (IN PETHREAD Thread)
 
VOID NTAPI PsExitSpecialApc (PKAPC Apc, PKNORMAL_ROUTINE *NormalRoutine, PVOID *NormalContext, PVOID *SystemArgument1, PVOID *SystemArgument2)
 
VOID NTAPI PspReapRoutine (IN PVOID Context)
 
VOID NTAPI PspExitThread (IN NTSTATUS ExitStatus)
 
NTSTATUS NTAPI PspTerminateThreadByPointer (IN PETHREAD Thread, IN NTSTATUS ExitStatus, IN BOOLEAN bSelf)
 
VOID NTAPI PspExitProcess (IN BOOLEAN LastThread, IN PEPROCESS Process)
 
NTSTATUS NTAPI PsTerminateProcess (IN PEPROCESS Process, IN NTSTATUS ExitStatus)
 
VOID NTAPI PspDeleteProcess (IN PVOID ObjectBody)
 
VOID NTAPI PspDeleteThread (IN PVOID ObjectBody)
 
VOID NTAPI PspSystemThreadStartup (PKSTART_ROUTINE StartRoutine, PVOID StartContext)
 
VOID NTAPI PsIdleThreadMain (IN PVOID Context)
 
VOID NTAPI PspInheritQuota (IN PEPROCESS Process, IN PEPROCESS ParentProcess)
 
VOID NTAPI PspDestroyQuotaBlock (IN PEPROCESS Process)
 
NTSTATUS NTAPI PspSetQuotaLimits (_In_ PEPROCESS Process, _In_ ULONG Unused, _In_ PVOID QuotaLimits, _In_ ULONG QuotaLimitsLength, _In_ KPROCESSOR_MODE PreviousMode)
 
VOID NTAPI PspExitProcessFromJob (IN PEJOB Job, IN PEPROCESS Process)
 
VOID NTAPI PspRemoveProcessFromJob (IN PEPROCESS Process, IN PEJOB Job)
 
INIT_FUNCTION VOID NTAPI PspInitializeJobStructures (VOID)
 
VOID NTAPI PspDeleteJob (IN PVOID ObjectBody)
 
NTSTATUS NTAPI PsResumeThread (IN PETHREAD Thread, OUT PULONG PreviousCount OPTIONAL)
 
NTSTATUS NTAPI PsSuspendThread (IN PETHREAD Thread, OUT PULONG PreviousCount OPTIONAL)
 
VOID NTAPI PspGetOrSetContextKernelRoutine (IN PKAPC Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine, IN OUT PVOID *NormalContext, IN OUT PVOID *SystemArgument1, IN OUT PVOID *SystemArgument2)
 
NTSTATUS NTAPI PsReturnProcessPageFileQuota (IN PEPROCESS Process, IN SIZE_T Amount)
 
NTSTATUS NTAPI PsChargeProcessPageFileQuota (IN PEPROCESS Process, IN SIZE_T Amount)
 
BOOLEAN NTAPI PspIsProcessExiting (IN PEPROCESS Process)
 
INIT_FUNCTION NTSTATUS NTAPI ApphelpCacheInitialize (VOID)
 
VOID NTAPI ApphelpCacheShutdown (VOID)
 

Variables

ULONG PspTraceLevel
 
LCID PsDefaultThreadLocaleId
 
LCID PsDefaultSystemLocaleId
 
LIST_ENTRY PspReaperListHead
 
WORK_QUEUE_ITEM PspReaperWorkItem
 
BOOLEAN PspReaping
 
PEPROCESS PsIdleProcess
 
LIST_ENTRY PsActiveProcessHead
 
KGUARDED_MUTEX PspActiveProcessMutex
 
LARGE_INTEGER ShortPsLockDelay
 
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
 
PHANDLE_TABLE PspCidTable
 
EX_CALLBACK PspThreadNotifyRoutine [PSP_MAX_CREATE_THREAD_NOTIFY]
 
EX_CALLBACK PspProcessNotifyRoutine [PSP_MAX_CREATE_PROCESS_NOTIFY]
 
EX_CALLBACK PspLoadImageNotifyRoutine [PSP_MAX_LOAD_IMAGE_NOTIFY]
 
PLEGO_NOTIFY_ROUTINE PspLegoNotifyRoutine
 
ULONG PspThreadNotifyRoutineCount
 
ULONG PspProcessNotifyRoutineCount
 
BOOLEAN PsImageNotifyEnabled
 
PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout
 
PKWIN32_THREAD_CALLOUT PspW32ThreadCallout
 
PVOID PspSystemDllEntryPoint
 
PVOID PspSystemDllBase
 
BOOLEAN PspUseJobSchedulingClasses
 
CHAR PspJobSchedulingClasses [PSP_JOB_SCHEDULING_CLASSES]
 
ULONG PsRawPrioritySeparation
 
ULONG PsPrioritySeparation
 
POBJECT_TYPE _PsThreadType
 
POBJECT_TYPE _PsProcessType
 
PTOKEN PspBootAccessToken
 
GENERIC_MAPPING PspJobMapping
 
POBJECT_TYPE PsJobType
 
UNICODE_STRING PsNtDllPathName
 
LIST_ENTRY PsLoadedModuleList
 
KSPIN_LOCK PsLoadedModuleSpinLock
 
ERESOURCE PsLoadedModuleResource
 
ULONG_PTR PsNtosImageBase
 

Macro Definition Documentation

◆ _PS_DEBUG_

#define _PS_DEBUG_   0x00

Definition at line 12 of file ps.h.

◆ PS_JOB_DEBUG

#define PS_JOB_DEBUG   0x08

Definition at line 20 of file ps.h.

◆ PS_KILL_DEBUG

#define PS_KILL_DEBUG   0x100

Definition at line 25 of file ps.h.

◆ PS_NOTIFICATIONS_DEBUG

#define PS_NOTIFICATIONS_DEBUG   0x10

Definition at line 21 of file ps.h.

◆ PS_PROCESS_DEBUG

#define PS_PROCESS_DEBUG   0x02

Definition at line 18 of file ps.h.

◆ PS_QUOTA_DEBUG

#define PS_QUOTA_DEBUG   0x80

Definition at line 24 of file ps.h.

◆ PS_REF_DEBUG

#define PS_REF_DEBUG   0x200

Definition at line 26 of file ps.h.

◆ PS_SECURITY_DEBUG

#define PS_SECURITY_DEBUG   0x04

Definition at line 19 of file ps.h.

◆ PS_STATE_DEBUG

#define PS_STATE_DEBUG   0x40

Definition at line 23 of file ps.h.

◆ PS_THREAD_DEBUG

#define PS_THREAD_DEBUG   0x01

Definition at line 17 of file ps.h.

◆ PS_WIN32K_DEBUG

#define PS_WIN32K_DEBUG   0x20

Definition at line 22 of file ps.h.

◆ PSP_JOB_SCHEDULING_CLASSES

#define PSP_JOB_SCHEDULING_CLASSES   10

Definition at line 71 of file ps.h.

◆ PSP_MAX_CREATE_PROCESS_NOTIFY

#define PSP_MAX_CREATE_PROCESS_NOTIFY   8

Definition at line 66 of file ps.h.

◆ PSP_MAX_CREATE_THREAD_NOTIFY

#define PSP_MAX_CREATE_THREAD_NOTIFY   8

Definition at line 64 of file ps.h.

◆ PSP_MAX_LOAD_IMAGE_NOTIFY

#define PSP_MAX_LOAD_IMAGE_NOTIFY   8

Definition at line 65 of file ps.h.

◆ PSREFTRACE

#define PSREFTRACE (   x)

Definition at line 58 of file ps.h.

◆ PSTRACE

#define PSTRACE (   x,
  fmt,
  ... 
)    DPRINT(fmt, ##__VA_ARGS__)

Definition at line 57 of file ps.h.

Typedef Documentation

◆ GET_SET_CTX_CONTEXT

◆ PGET_SET_CTX_CONTEXT

Function Documentation

◆ ApphelpCacheInitialize()

INIT_FUNCTION NTSTATUS NTAPI ApphelpCacheInitialize ( VOID  )

Definition at line 440 of file apphelp.c.

441 {
442  DPRINT("SHIMS: ApphelpCacheInitialize\n");
443  /* If we are booting in safemode we do not want to use the apphelp cache */
444  if (InitSafeBootMode)
445  {
446  DPRINT1("SHIMS: Safe mode detected, disabling cache.\n");
448  }
449  else
450  {
456  NULL);
459  }
460  DPRINT("SHIMS: ApphelpCacheInitialize: %d\n", ApphelpCacheEnabled);
461  return STATUS_SUCCESS;
462 }
PVOID NTAPI ApphelpShimCacheAllocateRoutine(_In_ struct _RTL_AVL_TABLE *Table, _In_ CLONG ByteSize)
Definition: apphelp.c:235
static RTL_AVL_TABLE ApphelpShimCache
Definition: apphelp.c:31
NTSTATUS ExInitializeResourceLite(PULONG res)
Definition: env_spec_w32.h:641
BOOLEAN ApphelpCacheRead(VOID)
Definition: apphelp.c:307
smooth NULL
Definition: ftsmooth.c:416
void DPRINT(...)
Definition: polytest.cpp:61
ULONG InitSafeBootMode
Definition: init.c:68
static BOOLEAN ApphelpCacheEnabled
Definition: apphelp.c:29
VOID NTAPI ApphelpShimCacheFreeRoutine(_In_ struct _RTL_AVL_TABLE *Table, _In_ PVOID Buffer)
Definition: apphelp.c:244
static LIST_ENTRY ApphelpShimCacheAge
Definition: apphelp.c:32
VOID NTAPI RtlInitializeGenericTableAvl(IN OUT PRTL_AVL_TABLE Table, IN PRTL_AVL_COMPARE_ROUTINE CompareRoutine, IN PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine, IN PRTL_AVL_FREE_ROUTINE FreeRoutine, IN PVOID TableContext)
Definition: avltable.c:26
RTL_GENERIC_COMPARE_RESULTS NTAPI ApphelpShimCacheCompareRoutine(_In_ struct _RTL_AVL_TABLE *Table, _In_ PVOID FirstStruct, _In_ PVOID SecondStruct)
Definition: apphelp.c:210
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
#define DPRINT1
Definition: precomp.h:8
static ERESOURCE ApphelpCacheLock
Definition: apphelp.c:30
return STATUS_SUCCESS
Definition: btrfs.c:2725

Referenced by IoInitSystem().

◆ ApphelpCacheShutdown()

VOID NTAPI ApphelpCacheShutdown ( VOID  )

Definition at line 466 of file apphelp.c.

467 {
469  {
471  }
472 }
BOOLEAN ApphelpCacheWrite(VOID)
Definition: apphelp.c:363
static BOOLEAN ApphelpCacheEnabled
Definition: apphelp.c:29

Referenced by PopGracefulShutdown().

◆ PsChangeQuantumTable()

VOID NTAPI PsChangeQuantumTable ( IN BOOLEAN  Immediate,
IN ULONG  PrioritySeparation 
)

Definition at line 235 of file process.c.

237 {
239  ULONG i;
240  UCHAR Quantum;
241  PCHAR QuantumTable;
242  PAGED_CODE();
244  "%lx PrioritySeparation: %lx\n", Immediate, PrioritySeparation);
245 
246  /* Write the current priority separation */
248 
249  /* Normalize it if it was too high */
251 
252  /* Get the quantum table to use */
253  if (PspQuantumTypeFromMask(PrioritySeparation) == PSP_VARIABLE_QUANTUMS)
254  {
255  /* Use a variable table */
256  QuantumTable = PspVariableQuantums;
257  }
258  else if (PspQuantumTypeFromMask(PrioritySeparation) == PSP_FIXED_QUANTUMS)
259  {
260  /* Use fixed table */
261  QuantumTable = PspFixedQuantums;
262  }
263  else
264  {
265  /* Use default for the type of system we're on */
267  }
268 
269  /* Now check if we should use long or short */
270  if (PspQuantumLengthFromMask(PrioritySeparation) == PSP_LONG_QUANTUMS)
271  {
272  /* Use long quantums */
273  QuantumTable += 3;
274  }
275  else if (PspQuantumLengthFromMask(PrioritySeparation) == PSP_SHORT_QUANTUMS)
276  {
277  /* Keep existing table */
278  NOTHING;
279  }
280  else
281  {
282  /* Use default for the type of system we're on */
283  QuantumTable += MmIsThisAnNtAsSystem() ? 3 : 0;
284  }
285 
286  /* Check if we're using long fixed quantums */
287  if (QuantumTable == &PspFixedQuantums[3])
288  {
289  /* Use Job scheduling classes */
291  }
292  else
293  {
294  /* Otherwise, we don't */
296  }
297 
298  /* Copy the selected table into the Foreground Quantum table */
300  QuantumTable,
301  sizeof(PspForegroundQuantum));
302 
303  /* Check if we should apply these changes real-time */
304  if (Immediate)
305  {
306  /* We are...loop every process */
308  while (Process)
309  {
310  /* Use the priority separation if this is a foreground process */
311  i = (Process->Vm.Flags.MemoryPriority ==
314 
315  /* Make sure that the process isn't idle */
316  if (Process->PriorityClass != PROCESS_PRIORITY_CLASS_IDLE)
317  {
318  /* Does the process have a job? */
319  if ((Process->Job) && (PspUseJobSchedulingClasses))
320  {
321  /* Use job quantum */
322  Quantum = PspJobSchedulingClasses[Process->Job->SchedulingClass];
323  }
324  else
325  {
326  /* Use calculated quantum */
327  Quantum = PspForegroundQuantum[i];
328  }
329  }
330  else
331  {
332  /* Process is idle, use default quantum */
333  Quantum = 6;
334  }
335 
336  /* Now set the quantum */
337  KeSetQuantumProcess(&Process->Pcb, Quantum);
338 
339  /* Get the next process */
341  }
342  }
343 }
signed char * PCHAR
Definition: retypes.h:7
#define TRUE
Definition: types.h:120
NTSYSAPI VOID NTAPI RtlCopyMemory(VOID UNALIGNED *Destination, CONST VOID UNALIGNED *Source, ULONG Length)
CHAR PspForegroundQuantum[3]
Definition: process.c:29
CHAR PspFixedQuantums[6]
Definition: process.c:32
#define PSP_VARIABLE_QUANTUMS
Definition: pstypes.h:132
#define PAGED_CODE()
Definition: video.h:57
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
Definition: glfuncs.h:248
ULONG PsPrioritySeparation
Definition: process.c:28
CHAR PspJobSchedulingClasses[PSP_JOB_SCHEDULING_CLASSES]
Definition: job.c:27
smooth NULL
Definition: ftsmooth.c:416
#define PSP_LONG_QUANTUMS
Definition: pstypes.h:134
BOOLEAN NTAPI MmIsThisAnNtAsSystem(VOID)
Definition: mmsup.c:246
#define MEMORY_PRIORITY_BACKGROUND
Definition: pstypes.h:124
unsigned char UCHAR
Definition: xmlstorage.h:181
#define PspQuantumLengthFromMask(Mask)
Definition: ps_x.h:19
#define PspPrioritySeparationFromMask(Mask)
Definition: ps_x.h:13
#define PSP_FIXED_QUANTUMS
Definition: pstypes.h:133
#define NOTHING
Definition: env_spec_w32.h:461
#define PS_PROCESS_DEBUG
Definition: ps.h:18
#define PSP_SHORT_QUANTUMS
Definition: pstypes.h:135
CHAR PspVariableQuantums[6]
Definition: process.c:46
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess)
Definition: process.c:128
BOOLEAN PspUseJobSchedulingClasses
Definition: job.c:25
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
unsigned int ULONG
Definition: retypes.h:1
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
VOID NTAPI KeSetQuantumProcess(IN PKPROCESS Process, IN UCHAR Quantum)
Definition: procobj.c:229
#define PROCESS_PRIORITY_CLASS_IDLE
Definition: pstypes.h:107
#define PspQuantumTypeFromMask(Mask)
Definition: ps_x.h:16

Referenced by PspInitPhase0(), and SSI_DEF().

◆ PsChargeProcessPageFileQuota()

NTSTATUS NTAPI PsChargeProcessPageFileQuota ( IN PEPROCESS  Process,
IN SIZE_T  Amount 
)

Definition at line 161 of file quota.c.

163 {
164  /* Don't do anything for the system process */
166 
168 }
_Must_inspect_result_ _In_ LONGLONG _In_ LONGLONG Amount
Definition: fsrtlfuncs.h:550
PEPROCESS PsInitialSystemProcess
Definition: psmgr.c:50
NTSTATUS NTAPI PspChargeProcessQuotaSpecifiedPool(IN PEPROCESS Process, IN UCHAR PoolIndex, IN SIZE_T Amount)
Definition: quota.c:39
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
return STATUS_SUCCESS
Definition: btrfs.c:2725

◆ PsExitSpecialApc()

VOID NTAPI PsExitSpecialApc ( PKAPC  Apc,
PKNORMAL_ROUTINE NormalRoutine,
PVOID NormalContext,
PVOID SystemArgument1,
PVOID SystemArgument2 
)

Referenced by KiInsertQueueApc().

◆ PsGetNextProcess()

PEPROCESS NTAPI PsGetNextProcess ( IN PEPROCESS OldProcess  OPTIONAL)

Definition at line 128 of file process.c.

129 {
131  PEPROCESS FoundProcess = NULL;
132  PAGED_CODE();
133  PSTRACE(PS_PROCESS_DEBUG, "Process: %p\n", OldProcess);
134 
135  /* Acquire the Active Process Lock */
137 
138  /* Check if we're already starting somewhere */
139  if (OldProcess)
140  {
141  /* Start where we left off */
142  Entry = OldProcess->ActiveProcessLinks.Flink;
143  }
144  else
145  {
146  /* Start at the beginning */
148  }
149 
150  /* Loop the process list */
151  while (Entry != &PsActiveProcessHead)
152  {
153  /* Get the process */
154  FoundProcess = CONTAINING_RECORD(Entry, EPROCESS, ActiveProcessLinks);
155 
156  /* Reference the process */
157  if (ObReferenceObjectSafe(FoundProcess)) break;
158 
159  /* Nothing found, keep trying */
160  FoundProcess = NULL;
161  Entry = Entry->Flink;
162  }
163 
164  /* Release the lock */
166 
167  /* Dereference the Process we had referenced earlier */
168  if (OldProcess) ObDereferenceObject(OldProcess);
169  return FoundProcess;
170 }
struct _Entry Entry
Definition: kefuncs.h:640
VOID FASTCALL KeAcquireGuardedMutex(IN PKGUARDED_MUTEX GuardedMutex)
Definition: gmutex.c:42
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
Definition: obref.c:24
LIST_ENTRY PsActiveProcessHead
Definition: process.c:22
smooth NULL
Definition: ftsmooth.c:416
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:119
Definition: typedefs.h:117
#define PS_PROCESS_DEBUG
Definition: ps.h:18
KGUARDED_MUTEX PspActiveProcessMutex
Definition: process.c:23
VOID FASTCALL KeReleaseGuardedMutex(IN OUT PKGUARDED_MUTEX GuardedMutex)
Definition: gmutex.c:53
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
base of all file and directory entries
Definition: entries.h:82

Referenced by DbgkpCloseObject(), ExpDebuggerWorker(), PopGracefulShutdown(), PsChangeQuantumTable(), PspShutdownProcessManager(), and QSI_DEF().

◆ PsGetNextProcessThread()

PETHREAD NTAPI PsGetNextProcessThread ( IN PEPROCESS  Process,
IN PETHREAD Thread  OPTIONAL 
)

Definition at line 75 of file process.c.

77 {
78  PETHREAD FoundThread = NULL;
79  PLIST_ENTRY ListHead, Entry;
80  PAGED_CODE();
82  "Process: %p Thread: %p\n", Process, Thread);
83 
84  /* Lock the process */
86  ExAcquirePushLockShared(&Process->ProcessLock);
87 
88  /* Check if we're already starting somewhere */
89  if (Thread)
90  {
91  /* Start where we left off */
93  }
94  else
95  {
96  /* Start at the beginning */
97  Entry = Process->ThreadListHead.Flink;
98  }
99 
100  /* Set the list head and start looping */
101  ListHead = &Process->ThreadListHead;
102  while (ListHead != Entry)
103  {
104  /* Get the Thread */
105  FoundThread = CONTAINING_RECORD(Entry, ETHREAD, ThreadListEntry);
106 
107  /* Safe reference the thread */
108  if (ObReferenceObjectSafe(FoundThread)) break;
109 
110  /* Nothing found, keep looping */
111  FoundThread = NULL;
112  Entry = Entry->Flink;
113  }
114 
115  /* Unlock the process */
116  ExReleasePushLockShared(&Process->ProcessLock);
118 
119  /* Check if we had a starting thread, and dereference it */
121 
122  /* Return what we found */
123  return FoundThread;
124 }
LIST_ENTRY ThreadListEntry
Definition: pstypes.h:1089
struct _Entry Entry
Definition: kefuncs.h:640
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
Definition: obref.c:24
smooth NULL
Definition: ftsmooth.c:416
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:119
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
#define KeEnterCriticalRegion()
Definition: ke_x.h:83
Definition: typedefs.h:117
#define PS_PROCESS_DEBUG
Definition: ps.h:18
FORCEINLINE VOID ExAcquirePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1091
#define KeLeaveCriticalRegion()
Definition: ke_x.h:114
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
FORCEINLINE VOID ExReleasePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1199
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
base of all file and directory entries
Definition: entries.h:82

Referenced by DbgkpPostFakeThreadMessages(), DbgkpSetProcessDebugObject(), ExSwapinWorkerThreads(), NtSetInformationThread(), NtTerminateProcess(), PspTerminateProcess(), PsResumeProcess(), and PsSuspendProcess().

◆ PsIdleThreadMain()

VOID NTAPI PsIdleThreadMain ( IN PVOID  Context)

◆ PsInitSystem()

INIT_FUNCTION BOOLEAN NTAPI PsInitSystem ( IN PLOADER_PARAMETER_BLOCK  LoaderBlock)

Definition at line 626 of file psmgr.c.

627 {
628  /* Check the initialization phase */
629  switch (ExpInitializationPhase)
630  {
631  case 0:
632 
633  /* Do Phase 0 */
634  return PspInitPhase0(LoaderBlock);
635 
636  case 1:
637 
638  /* Do Phase 1 */
639  return PspInitPhase1();
640 
641  default:
642 
643  /* Don't know any other phase! Bugcheck! */
644  KeBugCheckEx(UNEXPECTED_INITIALIZATION_CALL,
645  1,
647  0,
648  0);
649  return FALSE;
650  }
651 }
INIT_FUNCTION BOOLEAN NTAPI PspInitPhase1(VOID)
Definition: psmgr.c:398
INIT_FUNCTION BOOLEAN NTAPI PspInitPhase0(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
Definition: psmgr.c:408
ULONG ExpInitializationPhase
Definition: init.c:65
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
Definition: rtlcompat.c:107

Referenced by ExpInitializeExecutive(), and Phase1InitializationDiscard().

◆ PsLocateSystemDll()

INIT_FUNCTION NTSTATUS NTAPI PsLocateSystemDll ( VOID  )

Definition at line 279 of file psmgr.c.

280 {
283  HANDLE FileHandle, SectionHandle;
285  ULONG_PTR HardErrorParameters;
286  ULONG HardErrorResponse;
287 
288  /* Locate and open NTDLL to determine ImageBase and LdrStartup */
291  0,
292  NULL,
293  NULL);
297  &IoStatusBlock,
299  0);
300  if (!NT_SUCCESS(Status))
301  {
302  /* Failed, bugcheck */
303  KeBugCheckEx(PROCESS1_INITIALIZATION_FAILED, Status, 2, 0, 0);
304  }
305 
306  /* Check if the image is valid */
309  {
310  /* Raise a hard error */
311  HardErrorParameters = (ULONG_PTR)&PsNtDllPathName;
313  1,
314  1,
315  &HardErrorParameters,
316  OptionOk,
317  &HardErrorResponse);
318  return Status;
319  }
320 
321  /* Create a section for NTDLL */
322  Status = ZwCreateSection(&SectionHandle,
324  NULL,
325  NULL,
326  PAGE_EXECUTE,
327  SEC_IMAGE,
328  FileHandle);
330  if (!NT_SUCCESS(Status))
331  {
332  /* Failed, bugcheck */
333  KeBugCheckEx(PROCESS1_INITIALIZATION_FAILED, Status, 3, 0, 0);
334  }
335 
336  /* Reference the Section */
337  Status = ObReferenceObjectByHandle(SectionHandle,
340  KernelMode,
342  NULL);
343  ZwClose(SectionHandle);
344  if (!NT_SUCCESS(Status))
345  {
346  /* Failed, bugcheck */
347  KeBugCheckEx(PROCESS1_INITIALIZATION_FAILED, Status, 4, 0, 0);
348  }
349 
350  /* Map it */
352  if (!NT_SUCCESS(Status))
353  {
354  /* Failed, bugcheck */
355  KeBugCheckEx(PROCESS1_INITIALIZATION_FAILED, Status, 5, 0, 0);
356  }
357 
358  /* Return status */
359  return Status;
360 }
#define FILE_READ_ACCESS
Definition: nt_native.h:610
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:35
#define TRUE
Definition: types.h:120
UNICODE_STRING PsNtDllPathName
Definition: psmgr.c:45
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
Definition: harderr.c:553
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
LONG NTSTATUS
Definition: precomp.h:26
#define FILE_SHARE_READ
Definition: compat.h:125
uint32_t ULONG_PTR
Definition: typedefs.h:63
HANDLE FileHandle
Definition: stats.c:38
#define SECTION_ALL_ACCESS
Definition: nt_native.h:1293
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
PVOID PspSystemDllBase
Definition: psmgr.c:41
#define PsGetCurrentProcess
Definition: psfuncs.h:17
smooth NULL
Definition: ftsmooth.c:416
#define PAGE_EXECUTE
Definition: nt_native.h:1306
#define STATUS_IMAGE_CHECKSUM_MISMATCH
Definition: ntstatus.h:663
NTSTATUS NTAPI MmCheckSystemImage(IN HANDLE ImageHandle, IN BOOLEAN PurgeSection)
Definition: sysldr.c:2643
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
POBJECT_TYPE MmSectionObjectType
Definition: section.c:136
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
Status
Definition: gdiplustypes.h:24
PVOID PspSystemDllSection
Definition: psmgr.c:42
static OUT PIO_STATUS_BLOCK IoStatusBlock
Definition: pipe.c:75
unsigned int ULONG
Definition: retypes.h:1
#define ULONG_PTR
Definition: config.h:101
#define SEC_IMAGE
Definition: mmtypes.h:96
#define InitializeObjectAttributes(p, n, a, r, s)
Definition: reg.c:106
NTSTATUS NTAPI PspMapSystemDll(IN PEPROCESS Process, IN PVOID *DllBase, IN BOOLEAN UseLargePages)
Definition: psmgr.c:245
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
Definition: rtlcompat.c:107

Referenced by IoInitSystem().

◆ PsOpenTokenOfProcess()

NTSTATUS NTAPI PsOpenTokenOfProcess ( IN HANDLE  ProcessHandle,
OUT PACCESS_TOKEN Token 
)

Definition at line 463 of file security.c.

465 {
468  PAGED_CODE();
469  PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", ProcessHandle);
470 
471  /* Get the Token */
476  (PVOID*)&Process,
477  NULL);
478  if (NT_SUCCESS(Status))
479  {
480  /* Reference the token and dereference the process */
483  }
484 
485  /* Return */
486  return Status;
487 }
#define PROCESS_QUERY_INFORMATION
Definition: pstypes.h:158
LONG NTSTATUS
Definition: precomp.h:26
_IRQL_requires_same_ _In_ PLSA_STRING _In_ SECURITY_LOGON_TYPE _In_ ULONG _In_ ULONG _In_opt_ PTOKEN_GROUPS _In_ PTOKEN_SOURCE _Out_ PVOID _Out_ PULONG _Inout_ PLUID _Out_ PHANDLE Token
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:2966
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
smooth NULL
Definition: ftsmooth.c:416
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define PS_SECURITY_DEBUG
Definition: ps.h:19
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
Definition: security.c:432
Status
Definition: gdiplustypes.h:24
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
_In_ HANDLE ProcessHandle
Definition: mmfuncs.h:403
POBJECT_TYPE PsProcessType
Definition: process.c:20

Referenced by NtOpenProcessTokenEx().

◆ PspCreateProcess()

NTSTATUS NTAPI PspCreateProcess ( OUT PHANDLE  ProcessHandle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes  OPTIONAL,
IN HANDLE ParentProcess  OPTIONAL,
IN ULONG  Flags,
IN HANDLE SectionHandle  OPTIONAL,
IN HANDLE DebugPort  OPTIONAL,
IN HANDLE ExceptionPort  OPTIONAL,
IN BOOLEAN  InJob 
)

Definition at line 347 of file process.c.

356 {
359  PVOID ExceptionPortObject;
360  PDEBUG_OBJECT DebugObject;
363  ULONG_PTR DirectoryTableBase[2] = {0,0};
365  HANDLE_TABLE_ENTRY CidEntry;
366  PETHREAD CurrentThread = PsGetCurrentThread();
369  ULONG MinWs, MaxWs;
370  ACCESS_STATE LocalAccessState;
371  PACCESS_STATE AccessState = &LocalAccessState;
372  AUX_ACCESS_DATA AuxData;
373  UCHAR Quantum;
374  BOOLEAN Result, SdAllocated;
377  BOOLEAN NeedsPeb = FALSE;
378  INITIAL_PEB InitialPeb;
379  PAGED_CODE();
381  "ProcessHandle: %p Parent: %p\n", ProcessHandle, ParentProcess);
382 
383  /* Validate flags */
385 
386  /* Check for parent */
387  if (ParentProcess)
388  {
389  /* Reference it */
390  Status = ObReferenceObjectByHandle(ParentProcess,
393  PreviousMode,
394  (PVOID*)&Parent,
395  NULL);
396  if (!NT_SUCCESS(Status)) return Status;
397 
398  /* If this process should be in a job but the parent isn't */
399  if ((InJob) && (!Parent->Job))
400  {
401  /* This is illegal. Dereference the parent and fail */
404  }
405 
406  /* Inherit Parent process's Affinity. */
407  Affinity = Parent->Pcb.Affinity;
408  }
409  else
410  {
411  /* We have no parent */
412  Parent = NULL;
414  }
415 
416  /* Save working set data */
417  MinWs = PsMinimumWorkingSet;
418  MaxWs = PsMaximumWorkingSet;
419 
420  /* Create the Object */
424  PreviousMode,
425  NULL,
426  sizeof(EPROCESS),
427  0,
428  0,
429  (PVOID*)&Process);
430  if (!NT_SUCCESS(Status)) goto Cleanup;
431 
432  /* Clean up the Object */
433  RtlZeroMemory(Process, sizeof(EPROCESS));
434 
435  /* Initialize pushlock and rundown protection */
436  ExInitializeRundownProtection(&Process->RundownProtect);
437  Process->ProcessLock.Value = 0;
438 
439  /* Setup the Thread List Head */
440  InitializeListHead(&Process->ThreadListHead);
441 
442  /* Set up the Quota Block from the Parent */
444 
445  /* Set up Dos Device Map from the Parent */
447 
448  /* Check if we have a parent */
449  if (Parent)
450  {
451  /* Inherit PID and hard-error processing */
452  Process->InheritedFromUniqueProcessId = Parent->UniqueProcessId;
453  Process->DefaultHardErrorProcessing = Parent->DefaultHardErrorProcessing;
454  }
455  else
456  {
457  /* Use default hard-error processing */
458  Process->DefaultHardErrorProcessing = SEM_FAILCRITICALERRORS;
459  }
460 
461  /* Check for a section handle */
462  if (SectionHandle)
463  {
464  /* Get a pointer to it */
465  Status = ObReferenceObjectByHandle(SectionHandle,
468  PreviousMode,
469  (PVOID*)&SectionObject,
470  NULL);
471  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
472  }
473  else
474  {
475  /* Assume no section object */
477 
478  /* Is the parent the initial process?
479  * Check for NULL also, as at initialization PsInitialSystemProcess is NULL */
480  if (Parent != PsInitialSystemProcess && (Parent != NULL))
481  {
482  /* It's not, so acquire the process rundown */
483  if (ExAcquireRundownProtection(&Parent->RundownProtect))
484  {
485  /* If the parent has a section, use it */
486  SectionObject = Parent->SectionObject;
488 
489  /* Release process rundown */
490  ExReleaseRundownProtection(&Parent->RundownProtect);
491  }
492 
493  /* If we don't have a section object */
494  if (!SectionObject)
495  {
496  /* Then the process is in termination, so fail */
498  goto CleanupWithRef;
499  }
500  }
501  }
502 
503  /* Save the pointer to the section object */
504  Process->SectionObject = SectionObject;
505 
506  /* Check for the debug port */
507  if (DebugPort)
508  {
509  /* Reference it */
510  Status = ObReferenceObjectByHandle(DebugPort,
513  PreviousMode,
514  (PVOID*)&DebugObject,
515  NULL);
516  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
517 
518  /* Save the debug object */
519  Process->DebugPort = DebugObject;
520 
521  /* Check if the caller doesn't want the debug stuff inherited */
523  {
524  /* Set the process flag */
526  }
527  }
528  else
529  {
530  /* Do we have a parent? Copy his debug port */
532  }
533 
534  /* Now check for an exception port */
535  if (ExceptionPort)
536  {
537  /* Reference it */
538  Status = ObReferenceObjectByHandle(ExceptionPort,
541  PreviousMode,
542  (PVOID*)&ExceptionPortObject,
543  NULL);
544  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
545 
546  /* Save the exception port */
547  Process->ExceptionPort = ExceptionPortObject;
548  }
549 
550  /* Save the pointer to the section object */
551  Process->SectionObject = SectionObject;
552 
553  /* Set default exit code */
554  Process->ExitStatus = STATUS_PENDING;
555 
556  /* Check if this is the initial process being built */
557  if (Parent)
558  {
559  /* Create the address space for the child */
560  if (!MmCreateProcessAddressSpace(MinWs,
561  Process,
562  DirectoryTableBase))
563  {
564  /* Failed */
566  goto CleanupWithRef;
567  }
568  }
569  else
570  {
571  /* Otherwise, we are the boot process, we're already semi-initialized */
572  Process->ObjectTable = CurrentProcess->ObjectTable;
573  Status = MmInitializeHandBuiltProcess(Process, DirectoryTableBase);
574  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
575  }
576 
577  /* We now have an address space */
579 
580  /* Set the maximum WS */
581  Process->Vm.MaximumWorkingSetSize = MaxWs;
582 
583  /* Now initialize the Kernel Process */
586  Affinity,
587  DirectoryTableBase,
588  BooleanFlagOn(Process->DefaultHardErrorProcessing,
590 
591  /* Duplicate Parent Token */
593  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
594 
595  /* Set default priority class */
596  Process->PriorityClass = PROCESS_PRIORITY_CLASS_NORMAL;
597 
598  /* Check if we have a parent */
599  if (Parent)
600  {
601  /* Check our priority class */
602  if (Parent->PriorityClass == PROCESS_PRIORITY_CLASS_IDLE ||
604  {
605  /* Normalize it */
606  Process->PriorityClass = Parent->PriorityClass;
607  }
608 
609  /* Initialize object manager for the process */
611  Parent : NULL,
612  Process);
613  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
614  }
615  else
616  {
617  /* Do the second part of the boot process memory setup */
619  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
620  }
621 
622  /* Set success for now */
624 
625  /* Check if this is a real user-mode process */
626  if (SectionHandle)
627  {
628  /* Initialize the address space */
630  NULL,
632  &Flags,
633  &Process->
634  SeAuditProcessCreationInfo.
635  ImageFileName);
636  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
637 
638  //
639  // We need a PEB
640  //
641  NeedsPeb = TRUE;
642  }
643  else if (Parent)
644  {
645  /* Check if this is a child of the system process */
647  {
648  //
649  // We need a PEB
650  //
651  NeedsPeb = TRUE;
652 
653  /* This is a clone! */
654  ASSERTMSG("No support for cloning yet\n", FALSE);
655  }
656  else
657  {
658  /* This is the initial system process */
661  NULL,
662  NULL,
663  &Flags,
664  NULL);
665  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
666 
667  /* Create a dummy image file name */
668  Process->SeAuditProcessCreationInfo.ImageFileName =
670  sizeof(OBJECT_NAME_INFORMATION),
671  TAG_SEPA);
672  if (!Process->SeAuditProcessCreationInfo.ImageFileName)
673  {
674  /* Fail */
676  goto CleanupWithRef;
677  }
678 
679  /* Zero it out */
680  RtlZeroMemory(Process->SeAuditProcessCreationInfo.ImageFileName,
681  sizeof(OBJECT_NAME_INFORMATION));
682  }
683  }
684 
685 #if MI_TRACE_PFNS
686  /* Copy the process name now that we have it */
687  memcpy(MiGetPfnEntry(Process->Pcb.DirectoryTableBase[0] >> PAGE_SHIFT)->ProcessName, Process->ImageFileName, 16);
688  if (Process->Pcb.DirectoryTableBase[1]) memcpy(MiGetPfnEntry(Process->Pcb.DirectoryTableBase[1] >> PAGE_SHIFT)->ProcessName, Process->ImageFileName, 16);
689  if (Process->WorkingSetPage) memcpy(MiGetPfnEntry(Process->WorkingSetPage)->ProcessName, Process->ImageFileName, 16);
690 #endif
691 
692  /* Check if we have a section object and map the system DLL */
694 
695  /* Create a handle for the Process */
696  CidEntry.Object = Process;
697  CidEntry.GrantedAccess = 0;
698  Process->UniqueProcessId = ExCreateHandle(PspCidTable, &CidEntry);
699  if (!Process->UniqueProcessId)
700  {
701  /* Fail */
703  goto CleanupWithRef;
704  }
705 
706  /* Set the handle table PID */
707  Process->ObjectTable->UniqueProcessId = Process->UniqueProcessId;
708 
709  /* Check if we need to audit */
711 
712  /* Check if the parent had a job */
713  if ((Parent) && (Parent->Job))
714  {
715  /* FIXME: We need to insert this process */
716  DPRINT1("Jobs not yet supported\n");
717  }
718 
719  /* Create PEB only for User-Mode Processes */
720  if ((Parent) && (NeedsPeb))
721  {
722  //
723  // Set up the initial PEB
724  //
725  RtlZeroMemory(&InitialPeb, sizeof(INITIAL_PEB));
726  InitialPeb.Mutant = (HANDLE)-1;
727  InitialPeb.ImageUsesLargePages = 0; // FIXME: Not yet supported
728 
729  //
730  // Create it only if we have an image section
731  //
732  if (SectionHandle)
733  {
734  //
735  // Create it
736  //
737  Status = MmCreatePeb(Process, &InitialPeb, &Process->Peb);
738  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
739  }
740  else
741  {
742  //
743  // We have to clone it
744  //
745  ASSERTMSG("No support for cloning yet\n", FALSE);
746  }
747 
748  }
749 
750  /* The process can now be activated */
752  InsertTailList(&PsActiveProcessHead, &Process->ActiveProcessLinks);
754 
755  /* Create an access state */
756  Status = SeCreateAccessStateEx(CurrentThread,
757  ((Parent) &&
760  &LocalAccessState,
761  &AuxData,
764  if (!NT_SUCCESS(Status)) goto CleanupWithRef;
765 
766  /* Insert the Process into the Object Directory */
768  AccessState,
770  1,
771  NULL,
772  &hProcess);
773 
774  /* Free the access state */
776 
777  /* Cleanup on failure */
778  if (!NT_SUCCESS(Status)) goto Cleanup;
779 
780  /* Compute Quantum and Priority */
781  ASSERT(IsListEmpty(&Process->ThreadListHead) == TRUE);
782  Process->Pcb.BasePriority =
785  &Quantum);
786  Process->Pcb.QuantumReset = Quantum;
787 
788  /* Check if we have a parent other then the initial system process */
789  Process->GrantedAccess = PROCESS_TERMINATE;
790  if ((Parent) && (Parent != PsInitialSystemProcess))
791  {
792  /* Get the process's SD */
795  &SdAllocated);
796  if (!NT_SUCCESS(Status))
797  {
798  /* We failed, close the handle and clean up */
800  goto CleanupWithRef;
801  }
802 
803  /* Create the subject context */
804  SubjectContext.ProcessAuditId = Process;
806  SubjectContext.ClientToken = NULL;
807 
808  /* Do the access check */
811  FALSE,
813  0,
814  NULL,
816  PreviousMode,
817  &Process->GrantedAccess,
818  &AccessStatus);
819 
820  /* Dereference the token and let go the SD */
822  SubjectContext.PrimaryToken);
824 
825  /* Remove access if it failed */
826  if (!Result) Process->GrantedAccess = 0;
827 
828  /* Give the process some basic access */
829  Process->GrantedAccess |= (PROCESS_VM_OPERATION |
840  }
841  else
842  {
843  /* Set full granted access */
844  Process->GrantedAccess = PROCESS_ALL_ACCESS;
845  }
846 
847  /* Set the Creation Time */
848  KeQuerySystemTime(&Process->CreateTime);
849 
850  /* Protect against bad user-mode pointer */
851  _SEH2_TRY
852  {
853  /* Hacky way of returning the PEB to the user-mode creator */
854  if ((Process->Peb) && (CurrentThread->Tcb.Teb))
855  {
856  CurrentThread->Tcb.Teb->NtTib.ArbitraryUserPointer = Process->Peb;
857  }
858 
859  /* Save the process handle */
861  }
863  {
864  /* Get the exception code */
866  }
867  _SEH2_END;
868 
869  /* Run the Notification Routines */
871 
872  /* If 12 processes have been created, enough of user-mode is ready */
873  if (++ProcessCount == 12) Ki386PerfEnd();
874 
875 CleanupWithRef:
876  /*
877  * Dereference the process. For failures, kills the process and does
878  * cleanup present in PspDeleteProcess. For success, kills the extra
879  * reference added by ObInsertObject.
880  */
882 
883 Cleanup:
884  /* Dereference the parent */
886 
887  /* Return status to caller */
888  return Status;
889 }
#define KeQuerySystemTime(t)
Definition: env_spec_w32.h:570
_Must_inspect_result_ _Outptr_ PVOID * SectionObject
Definition: fsrtlfuncs.h:860
#define MAXIMUM_ALLOWED
Definition: nt_native.h:83
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:35
BOOLEAN NTAPI SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges, IN PGENERIC_MAPPING GenericMapping, IN KPROCESSOR_MODE AccessMode, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
Definition: accesschk.c:340
#define PAGE_SHIFT
Definition: env_spec_w32.h:45
VOID NTAPI PspInheritQuota(IN PEPROCESS Process, IN PEPROCESS ParentProcess)
#define PROCESS_CREATE_FLAGS_LEGAL_MASK
Definition: pstypes.h:97
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
Definition: fltkernel.h:2239
#define TRUE
Definition: types.h:120
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
#define PROCESS_ALL_ACCESS
Definition: nt_native.h:1324
#define SEM_FAILCRITICALERRORS
Definition: rtltypes.h:69
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
#define PROCESS_QUERY_INFORMATION
Definition: pstypes.h:158
VOID FASTCALL KeAcquireGuardedMutex(IN PKGUARDED_MUTEX GuardedMutex)
Definition: gmutex.c:42
#define SEM_NOALIGNMENTFAULTEXCEPT
Definition: rtltypes.h:71
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK _Out_ PNTSTATUS AccessStatus
Definition: sefuncs.h:13
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
Definition: wsk.h:182
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define BooleanFlagOn(F, SF)
Definition: ext2fs.h:183
INIT_FUNCTION NTSTATUS NTAPI MmInitializeHandBuiltProcess(IN PEPROCESS Process, IN PULONG_PTR DirectoryTableBase)
Definition: procsup.c:1034
LONG NTSTATUS
Definition: precomp.h:26
KTHREAD Tcb
Definition: pstypes.h:1034
#define ExAcquireRundownProtection
Definition: ex.h:130
_In_ BOOL _In_ HANDLE hProcess
Definition: mapping.h:70
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:2966
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
PHANDLE_TABLE PspCidTable
Definition: psmgr.c:48
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn BOOLEAN Physical UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE Parent
Definition: acpixf.h:716
#define PROCESS_CREATE_FLAGS_LARGE_PAGES
Definition: pstypes.h:95
#define InsertTailList(ListHead, Entry)
NTSTATUS NTAPI PspMapSystemDll(IN PEPROCESS Process, OUT PVOID *DllBase, IN BOOLEAN UseLargePages)
ULONG PsMinimumWorkingSet
Definition: psmgr.c:54
NTKERNELAPI VOID FASTCALL ExInitializeRundownProtection(_Out_ PEX_RUNDOWN_REF RunRef)
VOID NTAPI KeInitializeProcess(struct _KPROCESS *Process, KPRIORITY Priority, KAFFINITY Affinity, PULONG_PTR DirectoryTableBase, IN BOOLEAN Enable)
_Must_inspect_result_ FORCEINLINE BOOLEAN IsListEmpty(_In_ const LIST_ENTRY *ListHead)
Definition: rtlfuncs.h:57
#define PAGED_CODE()
Definition: video.h:57
ULONG ProcessCount
Definition: perfdata.c:37
#define PROCESS_CREATE_THREAD
Definition: pstypes.h:150
_SEH2_TRY
Definition: create.c:4250
LIST_ENTRY PsActiveProcessHead
Definition: process.c:22
uint32_t ULONG_PTR
Definition: typedefs.h:63
HANDLE NTAPI ExCreateHandle(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
Definition: handle.c:791
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
PEPROCESS PsInitialSystemProcess
Definition: psmgr.c:50
KPRIORITY NTAPI PspComputeQuantumAndPriority(IN PEPROCESS Process, IN PSPROCESSPRIORITYMODE Mode, OUT PUCHAR Quantum)
Definition: process.c:174
#define ASSERTMSG(msg, exp)
Definition: nt_native.h:431
#define PROCESS_DUP_HANDLE
#define PROCESS_PRIORITY_NORMAL
Definition: pstypes.h:118
#define PsGetCurrentProcess
Definition: psfuncs.h:17
Definition: extypes.h:595
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
VOID NTAPI ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
Definition: obsecure.c:709
unsigned char BOOLEAN
BOOLEAN ImageUsesLargePages
Definition: pstypes.h:655
smooth NULL
Definition: ftsmooth.c:416
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
Definition: wsk.h:426
FORCEINLINE VOID Ki386PerfEnd(VOID)
Definition: ke.h:893
#define PROCESS_PRIORITY_CLASS_NORMAL
Definition: pstypes.h:108
#define PROCESS_SET_QUOTA
Definition: pstypes.h:156
#define PSF_HAS_ADDRESS_SPACE_BIT
Definition: pstypes.h:274
NTSTATUS NTAPI ObGetObjectSecurity(IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
Definition: obsecure.c:611
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
Definition: oblife.c:952
POBJECT_TYPE LpcPortObjectType
Definition: port.c:17
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
INIT_FUNCTION NTSTATUS NTAPI MmInitializeHandBuiltProcess2(IN PEPROCESS Process)
Definition: procsup.c:1059
ULONG CurrentProcess
Definition: shell.c:125
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES
Definition: pstypes.h:93
#define PROCESS_VM_WRITE
Definition: pstypes.h:154
VOID NTAPI DbgkCopyProcessDebugPort(IN PEPROCESS Process, IN PEPROCESS Parent)
Definition: dbgkobj.c:276
NTSTATUS NTAPI MmCreatePeb(IN PEPROCESS Process, IN PINITIAL_PEB InitialPeb, OUT PPEB *BasePeb)
Definition: procsup.c:501
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define STATUS_PENDING
Definition: ntstatus.h:82
#define PSF_NO_DEBUG_INHERIT_BIT
Definition: pstypes.h:258
NTSTATUS NTAPI MmInitializeProcessAddressSpace(IN PEPROCESS Process, IN PEPROCESS Clone OPTIONAL, IN PVOID Section OPTIONAL, IN OUT PULONG Flags, IN POBJECT_NAME_INFORMATION *AuditName OPTIONAL)
#define STATUS_PROCESS_IS_TERMINATING
Definition: ntstatus.h:488
ULONG GrantedAccess
Definition: extypes.h:606
FORCEINLINE VOID PspRunCreateProcessNotifyRoutines(IN PEPROCESS CurrentProcess, IN BOOLEAN Create)
Definition: ps_x.h:62
signed char SCHAR
Definition: sqltypes.h:14
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
Definition: halfuncs.h:170
#define PROCESS_CREATE_PROCESS
Definition: pstypes.h:155
POBJECT_TYPE MmSectionObjectType
Definition: section.c:136
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
static HANDLE(WINAPI *pCreateJobObjectW)(LPSECURITY_ATTRIBUTES sa
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel) ?(CompletionRoutine !=NULL) :TRUE)
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
Definition: sefuncs.h:414
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
unsigned char UCHAR
Definition: xmlstorage.h:181
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3376
#define memcpy(s1, s2, n)
Definition: mkisofs.h:878
VOID NTAPI SeAuditProcessCreate(IN PEPROCESS Process)
Definition: audit.c:33
#define InterlockedOr
Definition: interlocked.h:224
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
Definition: security.c:432
static const WCHAR Cleanup[]
Definition: register.c:80
OBJECT_TYPE_INITIALIZER TypeInfo
Definition: obtypes.h:390
#define PS_PROCESS_DEBUG
Definition: ps.h:18
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT
Definition: pstypes.h:92
KAFFINITY KeActiveProcessors
Definition: krnlinit.c:23
FORCEINLINE PMMPFN MiGetPfnEntry(IN PFN_NUMBER Pfn)
Definition: mm.h:940
BOOLEAN NTAPI MmCreateProcessAddressSpace(IN ULONG MinWs, IN PEPROCESS Dest, IN PULONG_PTR DirectoryTableBase)
Status
Definition: gdiplustypes.h:24
#define DbgkDebugObjectType
Definition: ObTypes.c:125
HANDLE Mutant
Definition: pstypes.h:668
_SEH2_END
Definition: create.c:4424
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
Definition: obhandle.c:2932
GENERIC_MAPPING GenericMapping
Definition: obtypes.h:358
#define STANDARD_RIGHTS_ALL
Definition: nt_native.h:69
#define PROCESS_TERMINATE
Definition: pstypes.h:149
ULONG_PTR KAFFINITY
Definition: compat.h:75
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
VOID NTAPI SeDeleteAccessState(IN PACCESS_STATE AccessState)
Definition: access.c:460
KGUARDED_MUTEX PspActiveProcessMutex
Definition: process.c:23
VOID FASTCALL KeReleaseGuardedMutex(IN OUT PKGUARDED_MUTEX GuardedMutex)
Definition: gmutex.c:53
ULONG PsMaximumWorkingSet
Definition: psmgr.c:54
PVOID Teb
Definition: ketypes.h:1697
#define DPRINT1
Definition: precomp.h:8
#define PROCESS_VM_READ
Definition: pstypes.h:153
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: obref.c:169
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define PORT_ALL_ACCESS
Definition: lpctypes.h:47
#define DEBUG_OBJECT_ADD_REMOVE_PROCESS
Definition: dbgktypes.h:32
#define ObReferenceObject
Definition: obfuncs.h:204
unsigned int ULONG
Definition: retypes.h:1
#define SECTION_MAP_EXECUTE
Definition: nt_native.h:1290
NTSTATUS NTAPI ObInitProcess(IN PEPROCESS Parent OPTIONAL, IN PEPROCESS Process)
Definition: obhandle.c:2087
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:261
PVOID Object
Definition: extypes.h:599
#define PROCESS_VM_OPERATION
Definition: pstypes.h:152
NTSTATUS NTAPI PspInitializeProcessSecurity(IN PEPROCESS Process, IN PEPROCESS Parent OPTIONAL)
Definition: security.c:71
#define PROCESS_SET_INFORMATION
Definition: pstypes.h:157
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL
Definition: pstypes.h:111
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define TAG_SEPA
Definition: tag.h:187
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
NTSTATUS NTAPI SeCreateAccessStateEx(IN PETHREAD Thread, IN PEPROCESS Process, IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
Definition: access.c:378
BOOLEAN NTAPI SeDetailedAuditingWithToken(IN PTOKEN Token)
Definition: audit.c:25
#define PROCESS_PRIORITY_CLASS_IDLE
Definition: pstypes.h:107
_In_ HANDLE ProcessHandle
Definition: mmfuncs.h:403
return STATUS_SUCCESS
Definition: btrfs.c:2725
signed int * PLONG
Definition: retypes.h:5
POBJECT_TYPE PsProcessType
Definition: process.c:20
VOID NTAPI ObInheritDeviceMap(IN PEPROCESS Parent, IN PEPROCESS Process)
Definition: devicemap.c:151

Referenced by NtCreateProcessEx(), PsCreateSystemProcess(), and PspInitPhase0().

◆ PspDeleteJob()

VOID NTAPI PspDeleteJob ( IN PVOID  ObjectBody)

Referenced by PspInitPhase0().

◆ PspDeleteProcess()

VOID NTAPI PspDeleteProcess ( IN PVOID  ObjectBody)

Definition at line 256 of file kill.c.

257 {
258  PEPROCESS Process = (PEPROCESS)ObjectBody;
260  PAGED_CODE();
261  PSTRACE(PS_KILL_DEBUG, "ObjectBody: %p\n", ObjectBody);
263 
264  /* Check if it has an Active Process Link */
265  if (Process->ActiveProcessLinks.Flink)
266  {
267  /* Remove it from the Active List */
269  RemoveEntryList(&Process->ActiveProcessLinks);
270  Process->ActiveProcessLinks.Flink = NULL;
271  Process->ActiveProcessLinks.Blink = NULL;
273  }
274 
275  /* Check for Auditing information */
276  if (Process->SeAuditProcessCreationInfo.ImageFileName)
277  {
278  /* Free it */
279  ExFreePoolWithTag(Process->SeAuditProcessCreationInfo.ImageFileName,
280  TAG_SEPA);
281  Process->SeAuditProcessCreationInfo.ImageFileName = NULL;
282  }
283 
284  /* Check if we have a job */
285  if (Process->Job)
286  {
287  /* Remove the process from the job */
289 
290  /* Dereference it */
292  Process->Job = NULL;
293  }
294 
295  /* Increase the stack count */
296  Process->Pcb.StackCount++;
297 
298  /* Check if we have a debug port */
299  if (Process->DebugPort)
300  {
301  /* Deference the Debug Port */
302  ObDereferenceObject(Process->DebugPort);
303  Process->DebugPort = NULL;
304  }
305 
306  /* Check if we have an exception port */
307  if (Process->ExceptionPort)
308  {
309  /* Deference the Exception Port */
310  ObDereferenceObject(Process->ExceptionPort);
311  Process->ExceptionPort = NULL;
312  }
313 
314  /* Check if we have a section object */
315  if (Process->SectionObject)
316  {
317  /* Deference the Section Object */
318  ObDereferenceObject(Process->SectionObject);
319  Process->SectionObject = NULL;
320  }
321 
322 #if defined(_X86_)
323  /* Clean Ldt and Vdm objects */
326 #endif
327 
328  /* Delete the Object Table */
329  if (Process->ObjectTable)
330  {
331  /* Attach to the process */
333 
334  /* Kill the Object Info */
336 
337  /* Detach */
339  }
340 
341  /* Check if we have an address space, and clean it */
342  if (Process->HasAddressSpace)
343  {
344  /* Attach to the process */
346 
347  /* Clean the Address Space */
349 
350  /* Detach */
352 
353  /* Completely delete the Address Space */
355  }
356 
357  /* See if we have a PID */
358  if (Process->UniqueProcessId)
359  {
360  /* Delete the PID */
361  if (!(ExDestroyHandle(PspCidTable, Process->UniqueProcessId, NULL)))
362  {
363  /* Something wrong happened, bugcheck */
364  KeBugCheck(CID_HANDLE_DELETION);
365  }
366  }
367 
368  /* Cleanup security information */
370 
371  /* Check if we have kept information on the Working Set */
372  if (Process->WorkingSetWatch)
373  {
374  /* Free it */
375  ExFreePool(Process->WorkingSetWatch);
376 
377  /* And return the quota it was taking up */
379  }
380 
381  /* Dereference the Device Map */
383 
384  /* Destroy the Quota Block */
386 }
VOID NTAPI ObKillProcess(IN PEPROCESS Process)
Definition: obhandle.c:2157
KAPC_STATE
Definition: ketypes.h:1273
VOID NTAPI PspDeleteVdmObjects(PEPROCESS Process)
Definition: psldt.c:27
BOOLEAN NTAPI ExDestroyHandle(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle, IN PHANDLE_TABLE_ENTRY HandleTableEntry OPTIONAL)
Definition: handle.c:948
VOID FASTCALL KeAcquireGuardedMutex(IN PKGUARDED_MUTEX GuardedMutex)
Definition: gmutex.c:42
struct _EPROCESS * PEPROCESS
Definition: nt_native.h:30
VOID NTAPI PspExitProcess(IN BOOLEAN LastThread, IN PEPROCESS Process)
Definition: kill.c:1074
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
PHANDLE_TABLE PspCidTable
Definition: psmgr.c:48
#define PAGED_CODE()
Definition: video.h:57
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
Definition: rtlfuncs.h:105
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
Definition: procobj.c:701
#define PSREFTRACE(x)
Definition: ps.h:58
smooth NULL
Definition: ftsmooth.c:416
VOID NTAPI KeBugCheck(ULONG BugCheckCode)
Definition: bug.c:1469
#define PS_KILL_DEBUG
Definition: ps.h:25
VOID NTAPI PspDeleteLdt(PEPROCESS Process)
Definition: psldt.c:19
VOID NTAPI ObDereferenceDeviceMap(IN PEPROCESS Process)
Definition: devicemap.c:72
VOID NTAPI PspDeleteProcessSecurity(IN PEPROCESS Process)
Definition: security.c:30
VOID NTAPI PsReturnProcessNonPagedPoolQuota(IN PEPROCESS Process, IN SIZE_T Amount)
Definition: quota.c:253
VOID NTAPI PspRemoveProcessFromJob(IN PEPROCESS Process, IN PEJOB Job)
Definition: job.c:138
NTSTATUS NTAPI MmDeleteProcessAddressSpace(IN PEPROCESS Process)
VOID NTAPI PspDestroyQuotaBlock(IN PEPROCESS Process)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
Definition: procobj.c:753
KGUARDED_MUTEX PspActiveProcessMutex
Definition: process.c:23
_Out_ PKAPC_STATE ApcState
Definition: mm.h:1484
VOID FASTCALL KeReleaseGuardedMutex(IN OUT PKGUARDED_MUTEX GuardedMutex)
Definition: gmutex.c:53
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
#define TAG_SEPA
Definition: tag.h:187
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1099
#define ExFreePool(addr)
Definition: env_spec_w32.h:352

Referenced by PspInitPhase0().

◆ PspDeleteProcessSecurity()

VOID NTAPI PspDeleteProcessSecurity ( IN PEPROCESS  Process)

Definition at line 30 of file security.c.

31 {
32  PAGED_CODE();
33  PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
34 
35  /* Check if we have a token */
36  if (Process->Token.Object)
37  {
38  /* Deassign it */
40  Process->Token.Object = NULL;
41  }
42 }
VOID NTAPI SeDeassignPrimaryToken(struct _EPROCESS *Process)
#define PAGED_CODE()
Definition: video.h:57
smooth NULL
Definition: ftsmooth.c:416
#define PS_SECURITY_DEBUG
Definition: ps.h:19
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define PSTRACE(x, fmt,...)
Definition: ps.h:57

Referenced by PspDeleteProcess().

◆ PspDeleteThread()

VOID NTAPI PspDeleteThread ( IN PVOID  ObjectBody)

Definition at line 390 of file kill.c.

391 {
392  PETHREAD Thread = (PETHREAD)ObjectBody;
393  PEPROCESS Process = Thread->ThreadsProcess;
394  PAGED_CODE();
395  PSTRACE(PS_KILL_DEBUG, "ObjectBody: %p\n", ObjectBody);
398 
399  /* Check if we have a stack */
400  if (Thread->Tcb.InitialStack)
401  {
402  /* Release it */
404  Thread->Tcb.LargeStack);
405  }
406 
407  /* Check if we have a CID Handle */
408  if (Thread->Cid.UniqueThread)
409  {
410  /* Delete the CID Handle */
412  {
413  /* Something wrong happened, bugcheck */
414  KeBugCheck(CID_HANDLE_DELETION);
415  }
416  }
417 
418  /* Cleanup impersionation information */
420 
421  /* Make sure the thread was inserted, before continuing */
422  if (!Process) return;
423 
424  /* Check if the thread list is valid */
426  {
427  /* Lock the thread's process */
429  ExAcquirePushLockExclusive(&Process->ProcessLock);
430 
431  /* Remove us from the list */
433 
434  /* Release the lock */
435  ExReleasePushLockExclusive(&Process->ProcessLock);
437  }
438 
439  /* Dereference the Process */
441 }
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1022
LIST_ENTRY ThreadListEntry
Definition: pstypes.h:1089
BOOLEAN NTAPI ExDestroyHandle(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle, IN PHANDLE_TABLE_ENTRY HandleTableEntry OPTIONAL)
Definition: handle.c:948
VOID NTAPI MmDeleteKernelStack(PVOID Stack, BOOLEAN GuiStack)
KTHREAD Tcb
Definition: pstypes.h:1034
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
PHANDLE_TABLE PspCidTable
Definition: psmgr.c:48
#define PAGED_CODE()
Definition: video.h:57
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
Definition: rtlfuncs.h:105
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1238
#define PSREFTRACE(x)
Definition: ps.h:58
smooth NULL
Definition: ftsmooth.c:416
VOID NTAPI KeBugCheck(ULONG BugCheckCode)
Definition: bug.c:1469
#define PS_KILL_DEBUG
Definition: ps.h:25
struct _LIST_ENTRY * Flink
Definition: typedefs.h:119
CLIENT_ID Cid
Definition: pstypes.h:1059
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
HANDLE UniqueThread
Definition: compat.h:475
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel) ?(CompletionRoutine !=NULL) :TRUE)
#define KeEnterCriticalRegion()
Definition: ke_x.h:83
VOID NTAPI PspDeleteThreadSecurity(IN PETHREAD Thread)
Definition: security.c:46
PVOID StackBase
Definition: ketypes.h:1556
#define KeLeaveCriticalRegion()
Definition: ke_x.h:114
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
PVOID Win32Thread
Definition: ketypes.h:1756
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
struct _ETHREAD * PETHREAD
Definition: nt_native.h:29
PVOID InitialStack
Definition: ketypes.h:1554

Referenced by PspInitPhase0().

◆ PspDeleteThreadSecurity()

VOID NTAPI PspDeleteThreadSecurity ( IN PETHREAD  Thread)

Definition at line 46 of file security.c.

47 {
49  PAGED_CODE();
50  PSTRACE(PS_SECURITY_DEBUG, "Thread: %p\n", Thread);
51 
52  /* Check if we have active impersonation info */
54  {
55  /* Dereference its token */
56  ObDereferenceObject(ImpersonationInfo->Token);
57  }
58 
59  /* Check if we have impersonation info */
60  if (ImpersonationInfo)
61  {
62  /* Free it */
63  ExFreePool(ImpersonationInfo);
66  }
67 }
#define PspClearCrossThreadFlag(Thread, Flag)
Definition: ps_x.h:27
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PAGED_CODE()
Definition: video.h:57
PPS_IMPERSONATION_INFORMATION ImpersonationInfo
Definition: pstypes.h:1074
smooth NULL
Definition: ftsmooth.c:416
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
#define PS_SECURITY_DEBUG
Definition: ps.h:19
ULONG ActiveImpersonationInfo
Definition: pstypes.h:1112
#define CT_ACTIVE_IMPERSONATION_INFO_BIT
Definition: pstypes.h:225
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
#define ExFreePool(addr)
Definition: env_spec_w32.h:352

Referenced by PspDeleteThread().

◆ PspDestroyQuotaBlock()

VOID NTAPI PspDestroyQuotaBlock ( IN PEPROCESS  Process)

Referenced by PspDeleteProcess().

◆ PspExitProcess()

VOID NTAPI PspExitProcess ( IN BOOLEAN  LastThread,
IN PEPROCESS  Process 
)

Definition at line 1074 of file kill.c.

1076 {
1077  ULONG Actual;
1078  PAGED_CODE();
1080  "LastThread: %u Process: %p\n", LastThread, Process);
1082 
1083  /* Set Process Exit flag */
1085 
1086  /* Check if we are the last thread */
1087  if (LastThread)
1088  {
1089  /* Notify the WMI Process Callback */
1090  //WmiTraceProcess(Process, FALSE);
1091 
1092  /* Run the Notification Routines */
1094  }
1095 
1096  /* Cleanup the power state */
1097  PopCleanupPowerState((PPOWER_STATE)&Process->Pcb.PowerState);
1098 
1099  /* Clear the security port */
1100  if (!Process->SecurityPort)
1101  {
1102  /* So we don't double-dereference */
1103  Process->SecurityPort = (PVOID)1;
1104  }
1105  else if (Process->SecurityPort != (PVOID)1)
1106  {
1107  /* Dereference it */
1108  ObDereferenceObject(Process->SecurityPort);
1109  Process->SecurityPort = (PVOID)1;
1110  }
1111 
1112  /* Check if we are the last thread */
1113  if (LastThread)
1114  {
1115  /* Check if we have to set the Timer Resolution */
1116  if (Process->SetTimerResolution)
1117  {
1118  /* Set it to default */
1120  }
1121 
1122  /* Check if we are part of a Job that has a completion port */
1123  if ((Process->Job) && (Process->Job->CompletionPort))
1124  {
1125  /* FIXME: Check job status code and do I/O completion if needed */
1126  }
1127 
1128  /* FIXME: Notify the Prefetcher */
1129  }
1130  else
1131  {
1132  /* Clear process' address space here */
1134  }
1135 }
ULONG KeMaximumIncrement
Definition: clock.c:20
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define PSF_PROCESS_EXITING_BIT
Definition: pstypes.h:259
#define PAGED_CODE()
Definition: video.h:57
#define PSREFTRACE(x)
Definition: ps.h:58
void * PVOID
Definition: retypes.h:9
#define PS_KILL_DEBUG
Definition: ps.h:25
VOID NTAPI MmCleanProcessAddressSpace(IN PEPROCESS Process)
Definition: procsup.c:1236
NTSYSAPI NTSTATUS NTAPI ZwSetTimerResolution(_In_ ULONG RequestedResolution, _In_ BOOLEAN SetOrUnset, _Out_ PULONG ActualResolution)
FORCEINLINE VOID PspRunCreateProcessNotifyRoutines(IN PEPROCESS CurrentProcess, IN BOOLEAN Create)
Definition: ps_x.h:62
VOID NTAPI PopCleanupPowerState(IN PPOWER_STATE PowerState)
Definition: power.c:63
#define InterlockedOr
Definition: interlocked.h:224
PETHREAD LastThread
Definition: pinsup.c:109
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
unsigned int ULONG
Definition: retypes.h:1
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
signed int * PLONG
Definition: retypes.h:5

Referenced by PspDeleteProcess(), and PspExitThread().

◆ PspExitProcessFromJob()

VOID NTAPI PspExitProcessFromJob ( IN PEJOB  Job,
IN PEPROCESS  Process 
)

Definition at line 146 of file job.c.

148 {
149  /* FIXME */
150 }

Referenced by PspExitThread().

◆ PspExitThread()

VOID NTAPI PspExitThread ( IN NTSTATUS  ExitStatus)

Definition at line 449 of file kill.c.

450 {
451  CLIENT_DIED_MSG TerminationMsg;
453  PTEB Teb;
455  PETHREAD Thread, OtherThread, PreviousThread = NULL;
456  PVOID DeallocationStack;
457  SIZE_T Dummy;
458  BOOLEAN Last = FALSE;
459  PTERMINATION_PORT TerminationPort, NextPort;
460  PLIST_ENTRY FirstEntry, CurrentEntry;
461  PKAPC Apc;
462  PTOKEN PrimaryToken;
463  PAGED_CODE();
464  PSTRACE(PS_KILL_DEBUG, "ExitStatus: %d\n", ExitStatus);
465 
466  /* Get the Current Thread and Process */
468  CurrentProcess = Thread->ThreadsProcess;
470 
471  /* Can't terminate a thread if it attached another process */
472  if (KeIsAttachedProcess())
473  {
474  /* Bugcheck */
475  KeBugCheckEx(INVALID_PROCESS_ATTACH_ATTEMPT,
477  (ULONG_PTR)Thread->Tcb.ApcState.Process,
479  (ULONG_PTR)Thread);
480  }
481 
482  /* Lower to Passive Level */
484 
485  /* Can't be a worker thread */
486  if (Thread->ActiveExWorker)
487  {
488  /* Bugcheck */
489  KeBugCheckEx(ACTIVE_EX_WORKER_THREAD_TERMINATION,
490  (ULONG_PTR)Thread,
491  0,
492  0,
493  0);
494  }
495 
496  /* Can't have pending APCs */
497  if (Thread->Tcb.CombinedApcDisable != 0)
498  {
499  /* Bugcheck */
500  KeBugCheckEx(KERNEL_APC_PENDING_DURING_EXIT,
501  0,
503  0,
504  1);
505  }
506 
507  /* Lock the thread */
509 
510  /* Cleanup the power state */
512 
513  /* Call the WMI Callback for Threads */
514  //WmiTraceThread(Thread, NULL, FALSE);
515 
516  /* Run Thread Notify Routines before we desintegrate the thread */
518 
519  /* Lock the Process before we modify its thread entries */
522 
523  /* Decrease the active thread count, and check if it's 0 */
524  if (!(--CurrentProcess->ActiveThreads))
525  {
526  /* Set the delete flag */
528 
529  /* Remember we are last */
530  Last = TRUE;
531 
532  /* Check if this termination is due to the thread dying */
534  {
535  /* Check if the last thread was pending */
536  if (CurrentProcess->ExitStatus == STATUS_PENDING)
537  {
538  /* Use the last exit status */
539  CurrentProcess->ExitStatus = CurrentProcess->
540  LastThreadExitStatus;
541  }
542  }
543  else
544  {
545  /* Just a normal exit, write the code */
546  CurrentProcess->ExitStatus = ExitStatus;
547  }
548 
549  /* Loop all the current threads */
550  FirstEntry = &CurrentProcess->ThreadListHead;
551  CurrentEntry = FirstEntry->Flink;
552  while (FirstEntry != CurrentEntry)
553  {
554  /* Get the thread on the list */
555  OtherThread = CONTAINING_RECORD(CurrentEntry,
556  ETHREAD,
557  ThreadListEntry);
558 
559  /* Check if it's a thread that's still alive */
560  if ((OtherThread != Thread) &&
561  !(KeReadStateThread(&OtherThread->Tcb)) &&
562  (ObReferenceObjectSafe(OtherThread)))
563  {
564  /* It's a live thread and we referenced it, unlock process */
567 
568  /* Wait on the thread */
569  KeWaitForSingleObject(OtherThread,
570  Executive,
571  KernelMode,
572  FALSE,
573  NULL);
574 
575  /* Check if we had a previous thread to dereference */
576  if (PreviousThread) ObDereferenceObject(PreviousThread);
577 
578  /* Remember the thread and re-lock the process */
579  PreviousThread = OtherThread;
582  }
583 
584  /* Go to the next thread */
585  CurrentEntry = CurrentEntry->Flink;
586  }
587  }
589  {
590  /* Write down the exit status of the last thread to get killed */
591  CurrentProcess->LastThreadExitStatus = ExitStatus;
592  }
593 
594  /* Unlock the Process */
597 
598  /* Check if we had a previous thread to dereference */
599  if (PreviousThread) ObDereferenceObject(PreviousThread);
600 
601  /* Check if the process has a debug port and if this is a user thread */
602  if ((CurrentProcess->DebugPort) && !(Thread->SystemThread))
603  {
604  /* Notify the Debug API. */
605  Last ? DbgkExitProcess(CurrentProcess->ExitStatus) :
607  }
608 
609  /* Check if this is a Critical Thread */
611  {
612  /* Break to debugger */
613  PspCatchCriticalBreak("Critical thread 0x%p (in %s) exited\n",
614  Thread,
615  CurrentProcess->ImageFileName);
616  }
617 
618  /* Check if it's the last thread and this is a Critical Process */
619  if ((Last) && (CurrentProcess->BreakOnTermination))
620  {
621  /* Check if a debugger is here to handle this */
622  if (KdDebuggerEnabled)
623  {
624  /* Break to debugger */
625  PspCatchCriticalBreak("Critical process 0x%p (in %s) exited\n",
627  CurrentProcess->ImageFileName);
628  }
629  else
630  {
631  /* Bugcheck, we can't allow this */
632  KeBugCheckEx(CRITICAL_PROCESS_DIED,
634  0,
635  0,
636  0);
637  }
638  }
639 
640  /* Sanity check */
642 
643  /* Process the Termination Ports */
644  TerminationPort = Thread->TerminationPort;
645  if (TerminationPort)
646  {
647  /* Setup the message header */
648  TerminationMsg.h.u2.ZeroInit = 0;
649  TerminationMsg.h.u2.s2.Type = LPC_CLIENT_DIED;
650  TerminationMsg.h.u1.s1.TotalLength = sizeof(TerminationMsg);
651  TerminationMsg.h.u1.s1.DataLength = sizeof(TerminationMsg) -
652  sizeof(PORT_MESSAGE);
653 
654  /* Loop each port */
655  do
656  {
657  /* Save the Create Time */
658  TerminationMsg.CreateTime = Thread->CreateTime;
659 
660  /* Loop trying to send message */
661  while (TRUE)
662  {
663  /* Send the LPC Message */
664  Status = LpcRequestPort(TerminationPort->Port,
665  &TerminationMsg.h);
666  if ((Status == STATUS_NO_MEMORY) ||
668  {
669  /* Wait a bit and try again */
671  continue;
672  }
673  break;
674  }
675 
676  /* Dereference this LPC Port */
677  ObDereferenceObject(TerminationPort->Port);
678 
679  /* Move to the next one */
680  NextPort = TerminationPort->Next;
681 
682  /* Free the Termination Port Object */
683  ExFreePoolWithTag(TerminationPort, '=TsP');
684 
685  /* Keep looping as long as there is a port */
686  TerminationPort = NextPort;
687  } while (TerminationPort);
688  }
689  else if (((ExitStatus == STATUS_THREAD_IS_TERMINATING) &&
690  (Thread->DeadThread)) ||
691  !(Thread->DeadThread))
692  {
693  /*
694  * This case is special and deserves some extra comments. What
695  * basically happens here is that this thread doesn't have a termination
696  * port, which means that it died before being fully created. Since we
697  * still have to notify an LPC Server, we'll use the exception port,
698  * which we know exists. However, we need to know how far the thread
699  * actually got created. We have three possibilities:
700  *
701  * - NtCreateThread returned an error really early: DeadThread is set.
702  * - NtCreateThread managed to create the thread: DeadThread is off.
703  * - NtCreateThread was creating the thread (with DeadThread set,
704  * but the thread got killed prematurely: STATUS_THREAD_IS_TERMINATING
705  * is our exit code.)
706  *
707  * For the 2 & 3rd scenarios, the thread has been created far enough to
708  * warrant notification to the LPC Server.
709  */
710 
711  /* Setup the message header */
712  TerminationMsg.h.u2.ZeroInit = 0;
713  TerminationMsg.h.u2.s2.Type = LPC_CLIENT_DIED;
714  TerminationMsg.h.u1.s1.TotalLength = sizeof(TerminationMsg);
715  TerminationMsg.h.u1.s1.DataLength = sizeof(TerminationMsg) -
716  sizeof(PORT_MESSAGE);
717 
718  /* Make sure the process has an exception port */
719  if (CurrentProcess->ExceptionPort)
720  {
721  /* Save the Create Time */
722  TerminationMsg.CreateTime = Thread->CreateTime;
723 
724  /* Loop trying to send message */
725  while (TRUE)
726  {
727  /* Send the LPC Message */
728  Status = LpcRequestPort(CurrentProcess->ExceptionPort,
729  &TerminationMsg.h);
730  if ((Status == STATUS_NO_MEMORY) ||
732  {
733  /* Wait a bit and try again */
735  continue;
736  }
737  break;
738  }
739  }
740  }
741 
742  /* Rundown Win32 Thread if there is one */
745 
746  /* If we are the last thread and have a W32 Process */
747  if ((Last) && (CurrentProcess->Win32Process))
748  {
749  /* Run it down too */
751  }
752 
753  /* Make sure Stack Swap is enabled */
754  if (!Thread->Tcb.EnableStackSwap)
755  {
756  /* Stack swap really shouldn't be disabled during exit! */
757  KeBugCheckEx(KERNEL_STACK_LOCKED_AT_EXIT, 0, 0, 0, 0);
758  }
759 
760  /* Cancel I/O for the thread. */
762 
763  /* Rundown Timers */
764  ExTimerRundown();
765 
766  /* FIXME: Rundown Registry Notifications (NtChangeNotify)
767  CmNotifyRunDown(Thread); */
768 
769  /* Rundown Mutexes */
770  KeRundownThread();
771 
772  /* Check if we have a TEB */
773  Teb = Thread->Tcb.Teb;
774  if (Teb)
775  {
776  /* Check if the thread is still alive */
777  if (!Thread->DeadThread)
778  {
779  /* Check if we need to free its stack */
780  if (Teb->FreeStackOnTermination)
781  {
782  /* Set the TEB's Deallocation Stack as the Base Address */
783  Dummy = 0;
784  DeallocationStack = Teb->DeallocationStack;
785 
786  /* Free the Thread's Stack */
787  ZwFreeVirtualMemory(NtCurrentProcess(),
788  &DeallocationStack,
789  &Dummy,
790  MEM_RELEASE);
791  }
792 
793  /* Free the debug handle */
794  if (Teb->DbgSsReserved[1]) ObCloseHandle(Teb->DbgSsReserved[1],
795  UserMode);
796  }
797 
798  /* Decommit the TEB */
800  Thread->Tcb.Teb = NULL;
801  }
802 
803  /* Free LPC Data */
805 
806  /* Save the exit status and exit time */
809 
810  /* Sanity check */
812 
813  /* Check if this is the final thread or not */
814  if (Last)
815  {
816  /* Set the process exit time */
817  CurrentProcess->ExitTime = Thread->ExitTime;
818 
819  /* Exit the process */
821 
822  /* Get the process token and check if we need to audit */
823  PrimaryToken = PsReferencePrimaryToken(CurrentProcess);
824  if (SeDetailedAuditingWithToken(PrimaryToken))
825  {
826  /* Audit the exit */
828  }
829 
830  /* Dereference the process token */
831  ObFastDereferenceObject(&CurrentProcess->Token, PrimaryToken);
832 
833  /* Check if this is a VDM Process and rundown the VDM DPCs if so */
834  if (CurrentProcess->VdmObjects) { /* VdmRundownDpcs(CurrentProcess); */ }
835 
836  /* Kill the process in the Object Manager */
838 
839  /* Check if we have a section object */
840  if (CurrentProcess->SectionObject)
841  {
842  /* Dereference and clear the Section Object */
843  ObDereferenceObject(CurrentProcess->SectionObject);
844  CurrentProcess->SectionObject = NULL;
845  }
846 
847  /* Check if the process is part of a job */
848  if (CurrentProcess->Job)
849  {
850  /* Remove the process from the job */
852  }
853  }
854 
855  /* Disable APCs */
857 
858  /* Disable APC queueing, force a resumption */
861 
862  /* Re-enable APCs */
864 
865  /* Flush the User APCs */
866  FirstEntry = KeFlushQueueApc(&Thread->Tcb, UserMode);
867  if (FirstEntry)
868  {
869  /* Start with the first entry */
870  CurrentEntry = FirstEntry;
871  do
872  {
873  /* Get the APC */
874  Apc = CONTAINING_RECORD(CurrentEntry, KAPC, ApcListEntry);
875 
876  /* Move to the next one */
877  CurrentEntry = CurrentEntry->Flink;
878 
879  /* Rundown the APC or de-allocate it */
880  if (Apc->RundownRoutine)
881  {
882  /* Call its own routine */
883  Apc->RundownRoutine(Apc);
884  }
885  else
886  {
887  /* Do it ourselves */
888  ExFreePool(Apc);
889  }
890  }
891  while (CurrentEntry != FirstEntry);
892  }
893 
894  /* Clean address space if this was the last thread */
896 
897  /* Call the Lego routine */
899 
900  /* Flush the APC queue, which should be empty */
901  FirstEntry = KeFlushQueueApc(&Thread->Tcb, KernelMode);
902  if ((FirstEntry) || (Thread->Tcb.CombinedApcDisable != 0))
903  {
904  /* Bugcheck time */
905  KeBugCheckEx(KERNEL_APC_PENDING_DURING_EXIT,
906  (ULONG_PTR)FirstEntry,
909  0);
910  }
911 
912  /* Signal the process if this was the last thread */
913  if (Last) KeSetProcess(&CurrentProcess->Pcb, 0, FALSE);
914 
915  /* Terminate the Thread from the Scheduler */
917 }
#define KeQuerySystemTime(t)
Definition: env_spec_w32.h:570
VOID NTAPI ObKillProcess(IN PEPROCESS Process)
Definition: obhandle.c:2157
#define KeGetCurrentIrql()
Definition: env_spec_w32.h:706
PLIST_ENTRY NTAPI KeFlushQueueApc(IN PKTHREAD Thread, IN KPROCESSOR_MODE PreviousMode)
Definition: apc.c:793
VOID NTAPI KeRundownThread(VOID)
Definition: thrdobj.c:439
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1022
LARGE_INTEGER ExitTime
Definition: pstypes.h:1038
#define TRUE
Definition: types.h:120
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
#define KeLowerIrql(oldIrql)
Definition: env_spec_w32.h:602
VOID NTAPI IoCancelThreadIo(IN PETHREAD Thread)
Definition: irp.c:1146
ULONG EnableStackSwap
Definition: ketypes.h:1619
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
VOID NTAPI ExTimerRundown(VOID)
Definition: timer.c:43
ULONG CombinedApcDisable
Definition: ketypes.h:1773
LARGE_INTEGER CreateTime
Definition: lpctypes.h:270
#define STATUS_THREAD_IS_TERMINATING
Definition: ntstatus.h:297
LARGE_INTEGER CreateTime
Definition: pstypes.h:1035
LONG NTSTATUS
Definition: precomp.h:26
EX_RUNDOWN_REF RundownProtect
Definition: pstypes.h:1090
KTHREAD Tcb
Definition: pstypes.h:1034
PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout
Definition: win32.c:18
VOID NTAPI PspCatchCriticalBreak(IN PCHAR Message, IN PVOID ProcessOrThread, IN PCHAR ImageName)
Definition: kill.c:27
VOID NTAPI PspExitProcess(IN BOOLEAN LastThread, IN PEPROCESS Process)
Definition: kill.c:1074
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
VOID NTAPI SeAuditProcessExit(IN PEPROCESS Process)
Definition: audit.c:40
struct _TERMINATION_PORT * Next
Definition: pstypes.h:1011
VOID NTAPI MmDeleteTeb(struct _EPROCESS *Process, PTEB Teb)
NTSTATUS NTAPI KeWaitForSingleObject(IN PVOID Object, IN KWAIT_REASON WaitReason, IN KPROCESSOR_MODE WaitMode, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL)
Definition: wait.c:416
#define PAGED_CODE()
Definition: video.h:57
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
Definition: obref.c:24
uint32_t ULONG_PTR
Definition: typedefs.h:63
ULONG NTAPI KeSetProcess(struct _KPROCESS *Process, KPRIORITY Increment, BOOLEAN InWait)
PKWIN32_THREAD_CALLOUT PspW32ThreadCallout
Definition: win32.c:19
KAPC_STATE ApcState
Definition: ketypes.h:1668
ULONG ActiveExWorker
Definition: pstypes.h:1131
NTSTATUS NTAPI KeDelayExecutionThread(IN KPROCESSOR_MODE WaitMode, IN BOOLEAN Alertable, IN PLARGE_INTEGER Interval OPTIONAL)
Definition: wait.c:283
BOOLEAN NTAPI KeIsAttachedProcess(VOID)
Definition: procobj.c:690
BOOLEAN NTAPI KeReadStateThread(IN PKTHREAD Thread)
Definition: thrdobj.c:51
VOID NTAPI PspExitProcessFromJob(IN PEJOB Job, IN PEPROCESS Process)
Definition: job.c:146
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1238
unsigned char BOOLEAN
smooth NULL
Definition: ftsmooth.c:416
BOOLEAN KdDebuggerEnabled
Definition: kdmain.c:16
NTKERNELAPI VOID FASTCALL ExWaitForRundownProtectionRelease(_Inout_ PEX_RUNDOWN_REF RunRef)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _TERMINATION_PORT * TerminationPort
Definition: pstypes.h:1050
#define NtCurrentProcess()
Definition: nt_native.h:1657
VOID NTAPI KeTerminateThread(IN KPRIORITY Increment)
Definition: thrdobj.c:1375
NTSTATUS NTAPI LpcRequestPort(IN PVOID PortObject, IN PPORT_MESSAGE LpcMessage)
Definition: send.c:22
#define PS_KILL_DEBUG
Definition: ps.h:25
struct _LIST_ENTRY * Flink
Definition: typedefs.h:119
VOID NTAPI MmCleanProcessAddressSpace(IN PEPROCESS Process)
Definition: procsup.c:1236
ULONG CurrentProcess
Definition: shell.c:125
LARGE_INTEGER ShortTime
Definition: kill.c:21
PVOID DeallocationStack
Definition: compat.h:527
#define STATUS_PENDING
Definition: ntstatus.h:82
PVOID DbgSsReserved[2]
Definition: compat.h:532
#define PSF_PROCESS_DELETE_BIT
Definition: pstypes.h:260
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
ULONG BreakOnTermination
Definition: pstypes.h:1115
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel) ?(CompletionRoutine !=NULL) :TRUE)
VOID NTAPI PopCleanupPowerState(IN PPOWER_STATE PowerState)
Definition: power.c:63
VOID NTAPI DbgkExitProcess(IN NTSTATUS ExitStatus)
Definition: dbgkutil.c:304
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3376
PORT_MESSAGE h
Definition: lpctypes.h:269
#define KeEnterCriticalRegion()
Definition: ke_x.h:83
Definition: ketypes.h:535
#define InterlockedOr
Definition: interlocked.h:224
Definition: typedefs.h:117
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
Definition: security.c:432
#define PASSIVE_LEVEL
Definition: env_spec_w32.h:693
ULONG SystemThread
Definition: pstypes.h:1113
Status
Definition: gdiplustypes.h:24
ULONG_PTR SIZE_T
Definition: typedefs.h:78
Definition: compat.h:484
FORCEINLINE VOID PspRunCreateThreadNotifyRoutines(IN PETHREAD CurrentThread, IN BOOLEAN Create)
Definition: ps_x.h:40
NTSTATUS ExitStatus
Definition: pstypes.h:1044
#define KeLeaveCriticalRegion()
Definition: ke_x.h:114
#define STATUS_NO_MEMORY
Definition: ntstatus.h:246
_In_ NTSTATUS ExitStatus
Definition: psfuncs.h:861
FORCEINLINE VOID PspRunLegoRoutine(IN PKTHREAD Thread)
Definition: ps_x.h:103
PVOID Teb
Definition: ketypes.h:1697
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: obref.c:169
#define MEM_RELEASE
Definition: nt_native.h:1316
PVOID LegoData
Definition: ketypes.h:1887
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
Definition: thrdobj.c:276
PVOID Win32Thread
Definition: ketypes.h:1756
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
UCHAR ApcStateIndex
Definition: ketypes.h:1832
VOID NTAPI LpcExitThread(IN PETHREAD Thread)
Definition: close.c:19
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1099
ULONG ApcQueueable
Definition: ketypes.h:1601
BOOLEAN NTAPI SeDetailedAuditingWithToken(IN PTOKEN Token)
Definition: audit.c:25
signed int * PLONG
Definition: retypes.h:5
VOID NTAPI DbgkExitThread(IN NTSTATUS ExitStatus)
Definition: dbgkutil.c:340
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
Definition: rtlcompat.c:107
#define ExFreePool(addr)
Definition: env_spec_w32.h:352

Referenced by PsExitSpecialApc(), and PspTerminateThreadByPointer().

◆ PspGetOrSetContextKernelRoutine()

VOID NTAPI PspGetOrSetContextKernelRoutine ( IN PKAPC  Apc,
IN OUT PKNORMAL_ROUTINE NormalRoutine,
IN OUT PVOID NormalContext,
IN OUT PVOID SystemArgument1,
IN OUT PVOID SystemArgument2 
)

Definition at line 45 of file psctx.c.

50 {
51  PGET_SET_CTX_CONTEXT GetSetContext;
52  PKEVENT Event;
56  PKTRAP_FRAME TrapFrame = NULL;
57  PAGED_CODE();
58 
59  /* Get the Context Structure */
60  GetSetContext = CONTAINING_RECORD(Apc, GET_SET_CTX_CONTEXT, Apc);
61  Context = &GetSetContext->Context;
62  Event = &GetSetContext->Event;
63  Mode = GetSetContext->Mode;
64  Thread = Apc->SystemArgument2;
65 
66  /* If this is a kernel-mode request, grab the saved trap frame */
67  if (Mode == KernelMode) TrapFrame = Thread->TrapFrame;
68 
69  /* If we don't have one, grab it from the stack */
70  if (!TrapFrame)
71  {
72  DPRINT1("FIXME!!!!\n");
73  /* Trap frame is right under our initial stack */
74 // TrapFrame = (PKTRAP_FRAME)((ULONG_PTR)Thread->InitialStack -
75 // ROUND_UP(sizeof(KTRAP_FRAME), KTRAP_FRAME_ALIGN) -
76 // sizeof(FX_SAVE_AREA));
77  }
78 
79  /* Check if it's a set or get */
80  if (Apc->SystemArgument1)
81  {
82  /* Get the Context */
83  PspSetContext(TrapFrame, NULL, Context, Mode);
84  }
85  else
86  {
87  /* Set the Context */
88  PspGetContext(TrapFrame, NULL, Context);
89  }
90 
91  /* Notify the Native API that we are done */
93 }
_In_ ULONG Mode
Definition: hubbusif.h:303
LONG NTAPI KeSetEvent(IN PKEVENT Event, IN KPRIORITY Increment, IN BOOLEAN Wait)
Definition: eventobj.c:159
#define PAGED_CODE()
Definition: video.h:57
VOID NTAPI PspGetContext(IN PKTRAP_FRAME TrapFrame, IN PVOID NonVolatileContext, IN OUT PCONTEXT Context)
Definition: psctx.c:20
_In_ PVOID _In_ ULONG Event
Definition: iotypes.h:434
smooth NULL
Definition: ftsmooth.c:416
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
KPROCESSOR_MODE Mode
Definition: ps.h:80
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
KEVENT Event
Definition: ps.h:79
#define DPRINT1
Definition: precomp.h:8
VOID NTAPI PspSetContext(OUT PKTRAP_FRAME TrapFrame, OUT PVOID NonVolatileContext, IN PCONTEXT Context, IN KPROCESSOR_MODE Mode)
Definition: psctx.c:32
struct tagContext Context
Definition: acpixf.h:1012
#define IO_NO_INCREMENT
Definition: iotypes.h:565
CONTEXT Context
Definition: ps.h:81

Referenced by PsGetContextThread(), and PsSetContextThread().

◆ PspGetSystemDllEntryPoints()

NTSTATUS NTAPI PspGetSystemDllEntryPoints ( VOID  )

◆ PspInheritQuota()

VOID NTAPI PspInheritQuota ( IN PEPROCESS  Process,
IN PEPROCESS  ParentProcess 
)

Referenced by PspCreateProcess().

◆ PspInitializeJobStructures()

INIT_FUNCTION VOID NTAPI PspInitializeJobStructures ( VOID  )

Definition at line 111 of file job.c.

112 {
115 }
static FAST_MUTEX PsJobListLock
Definition: job.c:23
FORCEINLINE VOID ExInitializeFastMutex(_Out_ PFAST_MUTEX FastMutex)
Definition: exfuncs.h:274
LIST_ENTRY PsJobListHead
Definition: job.c:22
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944

Referenced by PspInitPhase0().

◆ PspInitializeProcessSecurity()

NTSTATUS NTAPI PspInitializeProcessSecurity ( IN PEPROCESS  Process,
IN PEPROCESS Parent  OPTIONAL 
)

Definition at line 71 of file security.c.

73 {
75  PTOKEN NewToken, ParentToken;
76  PAGED_CODE();
77  PSTRACE(PS_SECURITY_DEBUG, "Process: %p\n", Process);
78 
79  /* If we have a parent, then duplicate the Token */
80  if (Parent)
81  {
82  /* Get the Parent Token */
83  ParentToken = PsReferencePrimaryToken(Parent);
84 
85  /* Duplicate it */
86  Status = SeSubProcessToken(ParentToken,
87  &NewToken,
88  TRUE,
90 
91  /* Dereference the Parent */
92  ObFastDereferenceObject(&Parent->Token, ParentToken);
93 
94  /* Set the new Token */
95  if (NT_SUCCESS(Status))
96  {
97  /* Initailize the fast reference */
98  ObInitializeFastReference(&Process->Token, NewToken);
99  }
100  }
101  else
102  {
103  /* No parent, assign the Boot Token */
106  }
107 
108  /* Return to caller */
109  return Status;
110 }
#define TRUE
Definition: types.h:120
PTOKEN PspBootAccessToken
Definition: security.c:17
LONG NTSTATUS
Definition: precomp.h:26
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn BOOLEAN Physical UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE Parent
Definition: acpixf.h:716
#define PAGED_CODE()
Definition: video.h:57
smooth NULL
Definition: ftsmooth.c:416
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
VOID FASTCALL ObInitializeFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: obref.c:109
#define PS_SECURITY_DEBUG
Definition: ps.h:19
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
Definition: security.c:432
Status
Definition: gdiplustypes.h:24
NTSTATUS NTAPI SeSubProcessToken(IN PTOKEN Parent, OUT PTOKEN *Token, IN BOOLEAN InUse, IN ULONG SessionId)
Definition: token.c:672
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: obref.c:169
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
VOID NTAPI SeAssignPrimaryToken(IN PEPROCESS Process, IN PTOKEN Token)
Definition: token.c:862
ULONG NTAPI MmGetSessionId(IN PEPROCESS Process)
Definition: session.c:180
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
return STATUS_SUCCESS
Definition: btrfs.c:2725

Referenced by PspCreateProcess().

◆ PspIsProcessExiting()

BOOLEAN NTAPI PspIsProcessExiting ( IN PEPROCESS  Process)

Definition at line 1067 of file kill.c.

1068 {
1069  return Process->Flags & PSF_PROCESS_EXITING_BIT;
1070 }
#define PSF_PROCESS_EXITING_BIT
Definition: pstypes.h:259
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219

Referenced by MmpPageOutPhysicalAddress().

◆ PspMapSystemDll()

NTSTATUS NTAPI PspMapSystemDll ( IN PEPROCESS  Process,
OUT PVOID DllBase,
IN BOOLEAN  UseLargePages 
)

Referenced by PspCreateProcess().

◆ PspReapRoutine()

VOID NTAPI PspReapRoutine ( IN PVOID  Context)

Definition at line 170 of file kill.c.

171 {
172  PSINGLE_LIST_ENTRY NextEntry;
174  PSTRACE(PS_KILL_DEBUG, "Context: %p\n", Context);
175 
176  /* Start main loop */
177  do
178  {
179  /* Write magic value and return the next entry to process */
181  (PVOID)1);
182  ASSERT((NextEntry != NULL) && (NextEntry != (PVOID)1));
183 
184  /* Start inner loop */
185  do
186  {
187  /* Get the first Thread Entry */
188  Thread = CONTAINING_RECORD(NextEntry, ETHREAD, ReaperLink);
189 
190  /* Delete this entry's kernel stack */
192  Thread->Tcb.LargeStack);
194 
195  /* Move to the next entry */
196  NextEntry = NextEntry->Next;
197 
198  /* Dereference this thread */
200  } while ((NextEntry != NULL) && (NextEntry != (PVOID)1));
201 
202  /* Remove magic value, keep looping if it got changed */
204  NULL,
205  (PVOID)1) != (PVOID)1);
206 }
Definition: ntbasedef.h:635
VOID NTAPI MmDeleteKernelStack(PVOID Stack, BOOLEAN GuiStack)
KTHREAD Tcb
Definition: pstypes.h:1034
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
smooth NULL
Definition: ftsmooth.c:416
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
#define PS_KILL_DEBUG
Definition: ps.h:25
struct _LIST_ENTRY * Flink
Definition: typedefs.h:119
#define InterlockedExchangePointer(Target, Value)
Definition: dshow.h:45
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel) ?(CompletionRoutine !=NULL) :TRUE)
struct _SINGLE_LIST_ENTRY * Next
Definition: ntbasedef.h:636
PVOID StackBase
Definition: ketypes.h:1556
LIST_ENTRY PspReaperListHead
Definition: kill.c:19
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
PVOID InitialStack
Definition: ketypes.h:1554

Referenced by PspInitPhase0().

◆ PspRemoveProcessFromJob()

VOID NTAPI PspRemoveProcessFromJob ( IN PEPROCESS  Process,
IN PEJOB  Job 
)

Definition at line 138 of file job.c.

140 {
141  /* FIXME */
142 }

Referenced by PspDeleteProcess().

◆ PspSetPrimaryToken()

NTSTATUS NTAPI PspSetPrimaryToken ( IN PEPROCESS  Process,
IN HANDLE TokenHandle  OPTIONAL,
IN PACCESS_TOKEN Token  OPTIONAL 
)

Definition at line 215 of file security.c.

218 {
220  BOOLEAN IsChildOrSibling;
221  PACCESS_TOKEN NewToken = Token;
223  BOOLEAN Result, SdAllocated;
226 
227  PSTRACE(PS_SECURITY_DEBUG, "Process: %p Token: %p\n", Process, Token);
228 
229  /* Reference the token by handle if we don't already have a token object */
230  if (!Token)
231  {
235  PreviousMode,
236  (PVOID*)&NewToken,
237  NULL);
238  if (!NT_SUCCESS(Status)) return Status;
239  }
240 
241  /*
242  * Check whether this token is a child or sibling of the current process token.
243  * NOTE: On Windows Vista+ both of these checks (together with extra steps)
244  * are now performed by a new SeIsTokenAssignableToProcess() helper.
245  */
246  Status = SeIsTokenChild(NewToken, &IsChildOrSibling);
247  if (!NT_SUCCESS(Status))
248  {
249  /* Failed, dereference */
250  if (!Token) ObDereferenceObject(NewToken);
251  return Status;
252  }
253  if (!IsChildOrSibling)
254  {
255  Status = SeIsTokenSibling(NewToken, &IsChildOrSibling);
256  if (!NT_SUCCESS(Status))
257  {
258  /* Failed, dereference */
259  if (!Token) ObDereferenceObject(NewToken);
260  return Status;
261  }
262  }
263 
264  /* Check if this was an independent token */
265  if (!IsChildOrSibling)
266  {
267  /* Make sure we have the privilege to assign a new one */
269  PreviousMode))
270  {
271  /* Failed, dereference */
272  if (!Token) ObDereferenceObject(NewToken);
274  }
275  }
276 
277  /* Assign the token */
279  if (NT_SUCCESS(Status))
280  {
281  /*
282  * We need to completely reverify if the process still has access to
283  * itself under this new token.
284  */
287  &SdAllocated);
288  if (NT_SUCCESS(Status))
289  {
290  /* Setup the security context */
291  SubjectContext.ProcessAuditId = Process;
293  SubjectContext.ClientToken = NULL;
294 
295  /* Do the access check */
298  FALSE,
300  0,
301  NULL,
303  PreviousMode,
304  &Process->GrantedAccess,
305  &AccessStatus);
306 
307  /* Dereference the token and let go the SD */
309  SubjectContext.PrimaryToken);
311 
312  /* Remove access if it failed */
313  if (!Result) Process->GrantedAccess = 0;
314 
315  /* Setup granted access */
316  Process->GrantedAccess |= (PROCESS_VM_OPERATION |
327  }
328  }
329 
330  /* Dereference the token */
331  if (!Token) ObDereferenceObject(NewToken);
332  return Status;
333 }
#define MAXIMUM_ALLOWED
Definition: nt_native.h:83
BOOLEAN NTAPI SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges, IN PGENERIC_MAPPING GenericMapping, IN KPROCESSOR_MODE AccessMode, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
Definition: accesschk.c:340
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
Definition: fltkernel.h:2239
NTSTATUS NTAPI SeIsTokenSibling(IN PTOKEN Token, OUT PBOOLEAN IsSibling)
Definition: token.c:749
#define PROCESS_QUERY_INFORMATION
Definition: pstypes.h:158
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK _Out_ PNTSTATUS AccessStatus
Definition: sefuncs.h:13
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
Definition: wsk.h:182
NTSTATUS NTAPI SeIsTokenChild(IN PTOKEN Token, OUT PBOOLEAN IsChild)
Definition: token.c:716
LONG NTSTATUS
Definition: precomp.h:26
_IRQL_requires_same_ _In_ PLSA_STRING _In_ SECURITY_LOGON_TYPE _In_ ULONG _In_ ULONG _In_opt_ PTOKEN_GROUPS _In_ PTOKEN_SOURCE _Out_ PVOID _Out_ PULONG _Inout_ PLUID _Out_ PHANDLE Token
#define TOKEN_ASSIGN_PRIMARY
Definition: setypes.h:871
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
Definition: priv.c:524
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:2966
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
const LUID SeAssignPrimaryTokenPrivilege
Definition: priv.c:24
#define PROCESS_CREATE_THREAD
Definition: pstypes.h:150
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:496
#define PROCESS_DUP_HANDLE
VOID NTAPI ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
Definition: obsecure.c:709
unsigned char BOOLEAN
smooth NULL
Definition: ftsmooth.c:416
POBJECT_TYPE SeTokenObjectType
Definition: token.c:34
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
Definition: wsk.h:426
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
Definition: psfuncs.h:715
#define PROCESS_SET_QUOTA
Definition: pstypes.h:156
NTSTATUS NTAPI ObGetObjectSecurity(IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
Definition: obsecure.c:611
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
#define PROCESS_VM_WRITE
Definition: pstypes.h:154
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define PS_SECURITY_DEBUG
Definition: ps.h:19
#define PROCESS_CREATE_PROCESS
Definition: pstypes.h:155
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
NTSTATUS NTAPI PspAssignPrimaryToken(IN PEPROCESS Process, IN HANDLE Token, IN PACCESS_TOKEN AccessToken OPTIONAL)
Definition: security.c:178
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
Definition: security.c:432
OBJECT_TYPE_INITIALIZER TypeInfo
Definition: obtypes.h:390
Status
Definition: gdiplustypes.h:24
GENERIC_MAPPING GenericMapping
Definition: obtypes.h:358
#define STANDARD_RIGHTS_ALL
Definition: nt_native.h:69
#define PROCESS_TERMINATE
Definition: pstypes.h:149
#define PROCESS_VM_READ
Definition: pstypes.h:153
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: obref.c:169
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define PROCESS_VM_OPERATION
Definition: pstypes.h:152
#define PROCESS_SET_INFORMATION
Definition: pstypes.h:157
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
POBJECT_TYPE PsProcessType
Definition: process.c:20

Referenced by NtSetInformationProcess().

◆ PspSetQuotaLimits()

NTSTATUS NTAPI PspSetQuotaLimits ( _In_ PEPROCESS  Process,
_In_ ULONG  Unused,
_In_ PVOID  QuotaLimits,
_In_ ULONG  QuotaLimitsLength,
_In_ KPROCESSOR_MODE  PreviousMode 
)

Definition at line 293 of file quota.c.

299 {
300  QUOTA_LIMITS_EX CapturedQuotaLimits;
301  PEPROCESS_QUOTA_BLOCK QuotaBlock, OldQuotaBlock;
302  BOOLEAN IncreaseOkay;
303  KAPC_STATE SavedApcState;
305 
307 
308  _SEH2_TRY
309  {
310  ProbeForRead(QuotaLimits, QuotaLimitsLength, sizeof(ULONG));
311 
312  /* Check if we have the basic or extended structure */
313  if (QuotaLimitsLength == sizeof(QUOTA_LIMITS))
314  {
315  /* Copy the basic structure, zero init the remaining fields */
316  RtlCopyMemory(&CapturedQuotaLimits, QuotaLimits, sizeof(QUOTA_LIMITS));
317  CapturedQuotaLimits.WorkingSetLimit = 0;
318  CapturedQuotaLimits.Reserved2 = 0;
319  CapturedQuotaLimits.Reserved3 = 0;
320  CapturedQuotaLimits.Reserved4 = 0;
321  CapturedQuotaLimits.CpuRateLimit.RateData = 0;
322  CapturedQuotaLimits.Flags = 0;
323  }
324  else if (QuotaLimitsLength == sizeof(QUOTA_LIMITS_EX))
325  {
326  /* Copy the full structure */
327  RtlCopyMemory(&CapturedQuotaLimits, QuotaLimits, sizeof(QUOTA_LIMITS_EX));
328 
329  /* Verify that the caller passed valid flags */
330  if ((CapturedQuotaLimits.Flags & ~VALID_QUOTA_FLAGS) ||
331  ((CapturedQuotaLimits.Flags & QUOTA_LIMITS_HARDWS_MIN_ENABLE) &&
332  (CapturedQuotaLimits.Flags & QUOTA_LIMITS_HARDWS_MIN_DISABLE)) ||
333  ((CapturedQuotaLimits.Flags & QUOTA_LIMITS_HARDWS_MAX_ENABLE) &&
334  (CapturedQuotaLimits.Flags & QUOTA_LIMITS_HARDWS_MAX_DISABLE)))
335  {
336  DPRINT1("Invalid quota flags: 0x%lx\n", CapturedQuotaLimits.Flags);
338  }
339 
340  /* Verify that the caller didn't pass reserved values */
341  if ((CapturedQuotaLimits.WorkingSetLimit != 0) ||
342  (CapturedQuotaLimits.Reserved2 != 0) ||
343  (CapturedQuotaLimits.Reserved3 != 0) ||
344  (CapturedQuotaLimits.Reserved4 != 0) ||
345  (CapturedQuotaLimits.CpuRateLimit.RateData != 0))
346  {
347  DPRINT1("Invalid value: (%lx,%lx,%lx,%lx,%lx)\n",
348  CapturedQuotaLimits.WorkingSetLimit,
349  CapturedQuotaLimits.Reserved2,
350  CapturedQuotaLimits.Reserved3,
351  CapturedQuotaLimits.Reserved4,
352  CapturedQuotaLimits.CpuRateLimit.RateData);
354  }
355  }
356  else
357  {
358  DPRINT1("Invalid quota size: 0x%lx\n", QuotaLimitsLength);
360  }
361  }
363  {
364  DPRINT1("Exception while copying data\n");
366  }
367  _SEH2_END;
368 
369  /* Check the caller changes the working set size limits */
370  if ((CapturedQuotaLimits.MinimumWorkingSetSize != 0) &&
371  (CapturedQuotaLimits.MaximumWorkingSetSize != 0))
372  {
373  /* Check for special case: trimming the WS */
374  if ((CapturedQuotaLimits.MinimumWorkingSetSize == SIZE_T_MAX) &&
375  (CapturedQuotaLimits.MaximumWorkingSetSize == SIZE_T_MAX))
376  {
377  /* No increase allowed */
378  IncreaseOkay = FALSE;
379  }
380  else
381  {
382  /* Check if the caller has the required privilege */
384  PreviousMode);
385  }
386 
387  /* Attach to the target process and disable APCs */
388  KeStackAttachProcess(&Process->Pcb, &SavedApcState);
390 
391  /* Call Mm to adjust the process' working set size */
393  CapturedQuotaLimits.MaximumWorkingSetSize,
394  0,
395  IncreaseOkay);
396 
397  /* Bring back APCs and detach from the process */
399  KeUnstackDetachProcess(&SavedApcState);
400  }
401  else if (Process->QuotaBlock == &PspDefaultQuotaBlock)
402  {
403  /* Check if the caller has the required privilege */
405  {
407  }
408 
409  /* Allocate a new quota block */
410  QuotaBlock = ExAllocatePoolWithTag(NonPagedPool,
411  sizeof(EPROCESS_QUOTA_BLOCK),
413  if (QuotaBlock == NULL)
414  {
416  return STATUS_NO_MEMORY;
417  }
418 
419  /* Initialize the quota block */
420  QuotaBlock->ReferenceCount = 1;
421  QuotaBlock->ProcessCount = 1;
422  QuotaBlock->QuotaEntry[0].Peak = Process->QuotaPeak[0];
423  QuotaBlock->QuotaEntry[1].Peak = Process->QuotaPeak[1];
424  QuotaBlock->QuotaEntry[2].Peak = Process->QuotaPeak[2];
428 
429  /* Try to exchange the quota block, if that failed, just drop it */
430  OldQuotaBlock = InterlockedCompareExchangePointer((PVOID*)&Process->QuotaBlock,
431  QuotaBlock,
433  if (OldQuotaBlock == &PspDefaultQuotaBlock)
434  {
435  /* Success, insert the new quota block */
436  PspInsertQuotaBlock(QuotaBlock);
437  }
438  else
439  {
440  /* Failed, free the quota block and ignore it */
441  ExFreePoolWithTag(QuotaBlock, TAG_QUOTA_BLOCK);
442  }
443 
445  }
446  else
447  {
449  }
450 
451  return Status;
452 }
_Must_inspect_result_ typedef _In_ PVOID Unused
Definition: iotypes.h:1128
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
NTSYSAPI VOID NTAPI RtlCopyMemory(VOID UNALIGNED *Destination, CONST VOID UNALIGNED *Source, ULONG Length)
KAPC_STATE
Definition: ketypes.h:1273
#define STATUS_INFO_LENGTH_MISMATCH
Definition: udferr_usr.h:133
const LUID SeIncreaseQuotaPrivilege
Definition: priv.c:26
SIZE_T Reserved2
Definition: pstypes.h:75
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define SIZE_T_MAX
Definition: dhcpd.h:91
#define UNREFERENCED_PARAMETER(P)
Definition: ntbasedef.h:323
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define VALID_QUOTA_FLAGS
Definition: quota.c:22
LONG NTSTATUS
Definition: precomp.h:26
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
VOID NTAPI PspInsertQuotaBlock(PEPROCESS_QUOTA_BLOCK QuotaBlock)
Definition: quota.c:129
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
Definition: priv.c:524
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
NTSTATUS NTAPI MmAdjustWorkingSetSize(IN SIZE_T WorkingSetMinimumInBytes, IN SIZE_T WorkingSetMaximumInBytes, IN ULONG SystemCache, IN BOOLEAN IncreaseOkay)
Definition: mmsup.c:44
_SEH2_TRY
Definition: create.c:4250
EPROCESS_QUOTA_ENTRY QuotaEntry[3]
Definition: pstypes.h:977
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
Definition: quota.c:17
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
Definition: procobj.c:701
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
unsigned char BOOLEAN
smooth NULL
Definition: ftsmooth.c:416
#define KeLeaveGuardedRegion()
Definition: ke_x.h:63
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
ULONG RateData
Definition: pstypes.h:60
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
#define _SEH2_YIELD(STMT_)
Definition: pseh2_64.h:8
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
#define KeEnterGuardedRegion()
Definition: ke_x.h:34
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
Status
Definition: gdiplustypes.h:24
SIZE_T MaximumWorkingSetSize
Definition: pstypes.h:71
#define TAG_QUOTA_BLOCK
Definition: quota.c:21
_SEH2_END
Definition: create.c:4424
SIZE_T MinimumWorkingSetSize
Definition: pstypes.h:70
SIZE_T WorkingSetLimit
Definition: pstypes.h:74
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
Definition: procobj.c:753
#define STATUS_NO_MEMORY
Definition: ntstatus.h:246
SIZE_T Limit
Definition: pstypes.h:970
#define DPRINT1
Definition: precomp.h:8
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
RATE_QUOTA_LIMIT CpuRateLimit
Definition: pstypes.h:79
unsigned int ULONG
Definition: retypes.h:1
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1099
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
return STATUS_SUCCESS
Definition: btrfs.c:2725
SIZE_T Reserved3
Definition: pstypes.h:76
SIZE_T Peak
Definition: pstypes.h:971
SIZE_T Reserved4
Definition: pstypes.h:77

Referenced by NtSetInformationProcess().

◆ PspShutdownProcessManager()

VOID NTAPI PspShutdownProcessManager ( VOID  )

Definition at line 138 of file kill.c.

139 {
141 
142  /* Loop every process */
144  while (Process)
145  {
146  /* Make sure this isn't the idle or initial process */
148  {
149  /* Kill it */
151  }
152 
153  /* Get the next process */
155  }
156 }
PEPROCESS PsIdleProcess
Definition: psmgr.c:51
PEPROCESS PsInitialSystemProcess
Definition: psmgr.c:50
smooth NULL
Definition: ftsmooth.c:416
NTSTATUS NTAPI PspTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
Definition: kill.c:82
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
Definition: process.c:128
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define STATUS_SYSTEM_SHUTDOWN
Definition: ntstatus.h:841

◆ PspSystemThreadStartup()

VOID NTAPI PspSystemThreadStartup ( PKSTART_ROUTINE  StartRoutine,
PVOID  StartContext 
)

◆ PspTerminateThreadByPointer()

NTSTATUS NTAPI PspTerminateThreadByPointer ( IN PETHREAD  Thread,
IN NTSTATUS  ExitStatus,
IN BOOLEAN  bSelf 
)

Definition at line 987 of file kill.c.

990 {
991  PKAPC Apc;
993  ULONG Flags;
994  PAGED_CODE();
995  PSTRACE(PS_KILL_DEBUG, "Thread: %p ExitStatus: %d\n", Thread, ExitStatus);
997 
998  /* Check if this is a Critical Thread, and Bugcheck */
1000  {
1001  /* Break to debugger */
1002  PspCatchCriticalBreak("Terminating critical thread 0x%p (%s)\n",
1003  Thread,
1004  Thread->ThreadsProcess->ImageFileName);
1005  }
1006 
1007  /* Check if we are already inside the thread */
1008  if ((bSelf) || (PsGetCurrentThread() == Thread))
1009  {
1010  /* This should only happen at passive */
1012 
1013  /* Mark it as terminated */
1015 
1016  /* Directly terminate the thread */
1018  }
1019 
1020  /* This shouldn't be a system thread */
1022 
1023  /* Allocate the APC */
1025  if (!Apc) return STATUS_INSUFFICIENT_RESOURCES;
1026 
1027  /* Set the Terminated Flag */
1029 
1030  /* Set it, and check if it was already set while we were running */
1033  {
1034  /* Initialize a Kernel Mode APC to Kill the Thread */
1035  KeInitializeApc(Apc,
1036  &Thread->Tcb,
1041  KernelMode,
1043 
1044  /* Insert it into the APC Queue */
1045  if (!KeInsertQueueApc(Apc, Apc, NULL, 2))
1046  {
1047  /* The APC was already in the queue, fail */
1049  }
1050  else
1051  {
1052  /* Forcefully resume the thread and return */
1054  return Status;
1055  }
1056  }
1057 
1058  /* We failed, free the APC */
1060 
1061  /* Return Status */
1062  return Status;
1063 }
VOID NTAPI KeInitializeApc(IN PKAPC Apc, IN PKTHREAD Thread, IN KAPC_ENVIRONMENT TargetEnvironment, IN PKKERNEL_ROUTINE KernelRoutine, IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL, IN PKNORMAL_ROUTINE NormalRoutine, IN KPROCESSOR_MODE Mode, IN PVOID Context)
Definition: apc.c:651
#define STATUS_INSUFFICIENT_RESOURCES
Definition: udferr_usr.h:158
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
#define ASSERT_IRQL_EQUAL(x)
Definition: debug.h:43
LONG NTSTATUS
Definition: precomp.h:26
KTHREAD Tcb
Definition: pstypes.h:1034
VOID NTAPI PspCatchCriticalBreak(IN PCHAR Message, IN PVOID ProcessOrThread, IN PCHAR ImageName)
Definition: kill.c:27
#define PAGED_CODE()
Definition: video.h:57
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
#define PSREFTRACE(x)
Definition: ps.h:58
smooth NULL
Definition: ftsmooth.c:416
#define UlongToPtr(u)
Definition: config.h:106
#define PS_KILL_DEBUG
Definition: ps.h:25
#define CT_TERMINATED_BIT
Definition: pstypes.h:222
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
ULONG BreakOnTermination
Definition: pstypes.h:1115
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
#define STATUS_UNSUCCESSFUL
Definition: udferr_usr.h:132
#define ExAllocatePoolWithTag(hernya, size, tag)
Definition: env_spec_w32.h:350
VOID NTAPI PspExitThread(IN NTSTATUS ExitStatus)
Definition: kill.c:449
VOID NTAPI PspExitApcRundown(IN PKAPC Apc)
Definition: kill.c:160
ULONG CrossThreadFlags
Definition: pstypes.h:1125
#define PspSetCrossThreadFlag(Thread, Flag)
Definition: ps_x.h:25
Definition: ketypes.h:535
#define PASSIVE_LEVEL
Definition: env_spec_w32.h:693
ULONG SystemThread
Definition: pstypes.h:1113
#define InterlockedExchange
Definition: armddk.h:54
Status
Definition: gdiplustypes.h:24
VOID NTAPI PspExitNormalApc(IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
Definition: kill.c:946
#define TAG_TERMINATE_APC
Definition: tag.h:163
_In_ NTSTATUS ExitStatus
Definition: psfuncs.h:861
BOOLEAN NTAPI KeInsertQueueApc(IN PKAPC Apc, IN PVOID SystemArgument1, IN PVOID SystemArgument2, IN KPRIORITY PriorityBoost)
Definition: apc.c:735
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
Definition: thrdobj.c:276
unsigned int ULONG
Definition: retypes.h:1
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1099
return STATUS_SUCCESS
Definition: btrfs.c:2725
signed int * PLONG
Definition: retypes.h:5
VOID NTAPI PsExitSpecialApc(IN PKAPC Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine, IN OUT PVOID *NormalContext, IN OUT PVOID *SystemArgument1, IN OUT PVOID *SystemArgument2)
Definition: kill.c:921

Referenced by KiThreadStartup(), NtTerminateProcess(), NtTerminateThread(), PspSystemThreadStartup(), PspTerminateProcess(), PspUserThreadStartup(), and PsTerminateSystemThread().

◆ PsReferenceEffectiveToken()

PACCESS_TOKEN NTAPI PsReferenceEffectiveToken ( IN PETHREAD  Thread,
OUT IN PTOKEN_TYPE  TokenType,
OUT PBOOLEAN  EffectiveOnly,
OUT PSECURITY_IMPERSONATION_LEVEL  ImpersonationLevel 
)

Definition at line 705 of file security.c.

709 {
712 
713  PAGED_CODE();
714 
716  "Thread: %p, TokenType: %p\n", Thread, TokenType);
717 
718  /* Check if we don't have impersonation info */
719  Process = Thread->ThreadsProcess;
721  {
722  /* Lock the Process */
724 
725  /* Make sure impersonation is still active */
727  {
728  /* Get the token */
731 
732  /* Return data to caller */
736 
737  /* Unlock the Process */
739  return Token;
740  }
741 
742  /* Unlock the Process */
744  }
745 
746  /* Fast Reference the Token */
748 
749  /* Check if we got the Token or if we got locked */
750  if (!Token)
751  {
752  /* Lock the Process */
754 
755  /* Do a Locked Fast Reference */
757 
758  /* Unlock the Process */
760  }
761 
762  /* Return the token */
764  *EffectiveOnly = FALSE;
765  // NOTE: ImpersonationLevel is left untouched on purpose!
766  return Token;
767 }
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
Definition: pstypes.h:1003
_IRQL_requires_same_ _In_ PLSA_STRING _In_ SECURITY_LOGON_TYPE _In_ ULONG _In_ ULONG _In_opt_ PTOKEN_GROUPS _In_ PTOKEN_SOURCE _Out_ PVOID _Out_ PULONG _Inout_ PLUID _Out_ PHANDLE Token
PVOID FASTCALL ObFastReferenceObject(IN PEX_FAST_REF FastRef)
Definition: obref.c:134
#define PAGED_CODE()
Definition: video.h:57
PPS_IMPERSONATION_INFORMATION ImpersonationInfo
Definition: pstypes.h:1074
FORCEINLINE VOID PspUnlockProcessSecurityShared(IN PEPROCESS Process)
Definition: ps_x.h:122
smooth NULL
Definition: ftsmooth.c:416
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
Definition: psfuncs.h:154
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
#define PS_SECURITY_DEBUG
Definition: ps.h:19
ULONG ActiveImpersonationInfo
Definition: pstypes.h:1112
FORCEINLINE VOID PspLockProcessSecurityShared(IN PEPROCESS Process)
Definition: ps_x.h:111
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define ObReferenceObject
Definition: obfuncs.h:204
PVOID FASTCALL ObFastReferenceObjectLocked(IN PEX_FAST_REF FastRef)
Definition: obref.c:121
#define PSTRACE(x, fmt,...)
Definition: ps.h:57
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN EffectiveOnly
Definition: sefuncs.h:417
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN _In_ TOKEN_TYPE TokenType
Definition: sefuncs.h:417

Referenced by SeCreateClientSecurity().

◆ PsReferenceProcessFilePointer()

NTSTATUS NTAPI PsReferenceProcessFilePointer ( IN PEPROCESS  Process,
OUT PFILE_OBJECT FileObject 
)

Definition at line 24 of file query.c.

26 {
27  PSECTION Section;
28  PAGED_CODE();
29 
30  /* Lock the process */
31  if (!ExAcquireRundownProtection(&Process->RundownProtect))
32  {
34  }
35 
36  /* Get the section */
37  Section = Process->SectionObject;
38  if (Section)
39  {
40  /* Get the file object and reference it */
43  }
44 
45  /* Release the protection */
46  ExReleaseRundownProtection(&Process->RundownProtect);
47 
48  /* Return status */
49  return Section ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL;
50 }
PFILE_OBJECT NTAPI MmGetFileObjectForSection(IN PVOID Section)
Definition: section.c:1681
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
#define ExAcquireRundownProtection
Definition: ex.h:130
#define PAGED_CODE()
Definition: video.h:57
_Inout_ PFILE_OBJECT FileObject
Definition: cdprocs.h:593
#define STATUS_PROCESS_IS_TERMINATING
Definition: ntstatus.h:488
#define STATUS_UNSUCCESSFUL
Definition: udferr_usr.h:132
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
#define ObReferenceObject
Definition: obfuncs.h:204
return STATUS_SUCCESS
Definition: btrfs.c:2725

Referenced by SeLocateProcessImageName().

◆ PsResumeThread()

NTSTATUS NTAPI PsResumeThread ( IN PETHREAD  Thread,
OUT PULONG PreviousCount  OPTIONAL 
)

Definition at line 32 of file state.c.

34 {
35  ULONG OldCount;
36  PAGED_CODE();
37 
38  /* Resume the thread */
39  OldCount = KeResumeThread(&Thread->Tcb);
40 
41  /* Return the count if asked */
42  if (PreviousCount) *PreviousCount = OldCount;
43  return STATUS_SUCCESS;
44 }
ULONG NTAPI KeResumeThread(IN PKTHREAD Thread)
Definition: thrdobj.c:397
KTHREAD Tcb
Definition: pstypes.h:1034
#define PAGED_CODE()
Definition: video.h:57
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
unsigned int ULONG
Definition: retypes.h:1
return STATUS_SUCCESS
Definition: btrfs.c:2725

Referenced by DbgkpPostFakeThreadMessages(), DbgkpWakeTarget(), and NtResumeThread().

◆ PsReturnProcessPageFileQuota()

NTSTATUS NTAPI PsReturnProcessPageFileQuota ( IN PEPROCESS  Process,
IN SIZE_T  Amount 
)

Definition at line 281 of file quota.c.

283 {
284  /* Don't do anything for the system process */
286 
288  return STATUS_SUCCESS;
289 }
_Must_inspect_result_ _In_ LONGLONG _In_ LONGLONG Amount
Definition: fsrtlfuncs.h:550
VOID NTAPI PspReturnProcessQuotaSpecifiedPool(IN PEPROCESS Process, IN UCHAR PoolIndex, IN SIZE_T Amount)
Definition: quota.c:76
PEPROCESS PsInitialSystemProcess
Definition: psmgr.c:50
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
return STATUS_SUCCESS
Definition: btrfs.c:2725

◆ PsSuspendThread()

NTSTATUS NTAPI PsSuspendThread ( IN PETHREAD  Thread,
OUT PULONG PreviousCount  OPTIONAL 
)

Definition at line 48 of file state.c.

51 {
53  ULONG OldCount = 0;
54  PAGED_CODE();
55 
56  /* Assume success */
58 
59  /* Check if we're suspending ourselves */
60  if (Thread == PsGetCurrentThread())
61  {
62  /* Guard with SEH because KeSuspendThread can raise an exception */
63  _SEH2_TRY
64  {
65  /* Do the suspend */
66  OldCount = KeSuspendThread(&Thread->Tcb);
67  }
69  {
70  /* Get the exception code */
72  }
73  _SEH2_END;
74  }
75  else
76  {
77  /* Acquire rundown protection */
79  {
80  /* Make sure the thread isn't terminating */
81  if (Thread->Terminated)
82  {
83  /* Fail */
85  }
86  else
87  {
88  /* Guard with SEH because KeSuspendThread can raise an exception */
89  _SEH2_TRY
90  {
91  /* Do the suspend */
92  OldCount = KeSuspendThread(&Thread->Tcb);
93  }
95  {
96  /* Get the exception code */
98  }
99  _SEH2_END;
100 
101  /* Check if it was terminated during the suspend */
102  if (Thread->Terminated)
103  {
104  /* Wake it back up and fail */
107  OldCount = 0;
108  }
109  }
110 
111  /* Release rundown protection */
113  }
114  else
115  {
116  /* Thread is terminating */
118  }
119  }
120 
121  /* Write back the previous count */
122  if (PreviousCount) *PreviousCount = OldCount;
123  return Status;
124 }
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
#define STATUS_THREAD_IS_TERMINATING
Definition: ntstatus.h:297
LONG NTSTATUS
Definition: precomp.h:26
EX_RUNDOWN_REF RundownProtect
Definition: pstypes.h:1090
KTHREAD Tcb
Definition: pstypes.h:1034
#define ExAcquireRundownProtection
Definition: ex.h:130
#define PAGED_CODE()
Definition: video.h:57
_SEH2_TRY
Definition: create.c:4250
ULONG NTAPI KeSuspendThread(PKTHREAD Thread)
Definition: thrdobj.c:610
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
Status
Definition: gdiplustypes.h:24
_SEH2_END
Definition: create.c:4424
ULONG Terminated
Definition: pstypes.h:1105
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
Definition: thrdobj.c:276
unsigned int ULONG
Definition: retypes.h:1
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
return STATUS_SUCCESS
Definition: btrfs.c:2725
#define STATUS_SUSPEND_COUNT_EXCEEDED
Definition: ntstatus.h:296

Referenced by DbgkpPostFakeThreadMessages(), NtSuspendThread(), and PsSuspendProcess().

◆ PsTerminateProcess()

NTSTATUS NTAPI PsTerminateProcess ( IN PEPROCESS  Process,
IN NTSTATUS  ExitStatus 
)

Definition at line 129 of file kill.c.

131 {
132  /* Call the internal API */
134 }
NTSTATUS NTAPI PspTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
Definition: kill.c:82
_In_ NTSTATUS ExitStatus
Definition: psfuncs.h:861
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219

Referenced by DbgkpCloseObject(), and ExpDebuggerWorker().

Variable Documentation

◆ _PsProcessType

POBJECT_TYPE _PsProcessType

◆ _PsThreadType

POBJECT_TYPE _PsThreadType

◆ PsActiveProcessHead

LIST_ENTRY PsActiveProcessHead

Definition at line 22 of file process.c.

Referenced by KdbpCmdProc(), and PspInitPhase0().

◆ PsDefaultSystemLocaleId

LCID PsDefaultSystemLocaleId

◆ PsDefaultThreadLocaleId

LCID PsDefaultThreadLocaleId

◆ PsIdleProcess

PEPROCESS PsIdleProcess

◆ PsImageNotifyEnabled

BOOLEAN PsImageNotifyEnabled

Definition at line 18 of file psnotify.c.

Referenced by DbgkCreateThread(), MmLoadSystemImage(), and PsSetLoadImageNotifyRoutine().

◆ PsJobType

POBJECT_TYPE PsJobType

Definition at line 20 of file job.c.

Referenced by PspInitPhase0(), and TestObjectTypes().

◆ PsLoadedModuleList

◆ PsLoadedModuleResource

◆ PsLoadedModuleSpinLock

KSPIN_LOCK PsLoadedModuleSpinLock

Definition at line 36 of file sysldr.c.

Referenced by MiInitializeLoadedModuleList(), and MiProcessLoaderEntry().

◆ PsNtDllPathName

UNICODE_STRING PsNtDllPathName

Definition at line 45 of file psmgr.c.

Referenced by DbgkCreateThread(), and PsLocateSystemDll().

◆ PsNtosImageBase

ULONG_PTR PsNtosImageBase

◆ PspActiveProcessMutex

KGUARDED_MUTEX PspActiveProcessMutex

Definition at line 23 of file process.c.

Referenced by PsGetNextProcess(), PspCreateProcess(), PspDeleteProcess(), and PspInitPhase0().

◆ PspBootAccessToken

PTOKEN PspBootAccessToken

Definition at line 17 of file security.c.

Referenced by PspInitializeProcessSecurity(), and PspInitPhase0().

◆ PspCidTable

◆ PspDefaultQuotaBlock

◆ PspJobMapping

GENERIC_MAPPING PspJobMapping

Definition at line 41 of file job.c.

Referenced by PspInitPhase0().

◆ PspJobSchedulingClasses

CHAR PspJobSchedulingClasses[PSP_JOB_SCHEDULING_CLASSES]

Definition at line 27 of file job.c.

Referenced by PsChangeQuantumTable(), and PspComputeQuantumAndPriority().

◆ PspLegoNotifyRoutine

PLEGO_NOTIFY_ROUTINE PspLegoNotifyRoutine

Definition at line 24 of file psnotify.c.

Referenced by PspRunLegoRoutine(), and PsSetLegoNotifyRoutine().

◆ PspLoadImageNotifyRoutine

◆ PspProcessNotifyRoutine

◆ PspProcessNotifyRoutineCount

ULONG PspProcessNotifyRoutineCount

◆ PspReaperListHead

LIST_ENTRY PspReaperListHead

Definition at line 19 of file kill.c.

◆ PspReaperWorkItem

WORK_QUEUE_ITEM PspReaperWorkItem

Definition at line 20 of file kill.c.

Referenced by KeTerminateThread(), and PspInitPhase0().

◆ PspReaping

BOOLEAN PspReaping

◆ PsPrioritySeparation

ULONG PsPrioritySeparation

◆ PspSystemDllBase

PVOID PspSystemDllBase

◆ PspSystemDllEntryPoint

PVOID PspSystemDllEntryPoint

Definition at line 43 of file psmgr.c.

Referenced by PspInitializeSystemDll(), and PspUserThreadStartup().

◆ PspThreadNotifyRoutine

◆ PspThreadNotifyRoutineCount

ULONG PspThreadNotifyRoutineCount

◆ PspTraceLevel

ULONG PspTraceLevel

Definition at line 18 of file query.c.

◆ PspUseJobSchedulingClasses

BOOLEAN PspUseJobSchedulingClasses

Definition at line 25 of file job.c.

Referenced by PsChangeQuantumTable(), and PspComputeQuantumAndPriority().

◆ PspW32ProcessCallout

PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout

Definition at line 18 of file win32.c.

Referenced by PsConvertToGuiThread(), PsEstablishWin32Callouts(), and PspExitThread().

◆ PspW32ThreadCallout

PKWIN32_THREAD_CALLOUT PspW32ThreadCallout

Definition at line 19 of file win32.c.

Referenced by PsConvertToGuiThread(), PsEstablishWin32Callouts(), and PspExitThread().

◆ PsRawPrioritySeparation

ULONG PsRawPrioritySeparation

Definition at line 27 of file process.c.

Referenced by PspInitPhase0().

◆ ShortPsLockDelay

LARGE_INTEGER ShortPsLockDelay

Definition at line 463 of file ps.h.