12#define _PS_DEBUG_ 0x00
17#define PS_THREAD_DEBUG 0x01
18#define PS_PROCESS_DEBUG 0x02
19#define PS_SECURITY_DEBUG 0x04
20#define PS_JOB_DEBUG 0x08
21#define PS_NOTIFICATIONS_DEBUG 0x10
22#define PS_WIN32K_DEBUG 0x20
23#define PS_STATE_DEBUG 0x40
24#define PS_QUOTA_DEBUG 0x80
25#define PS_KILL_DEBUG 0x100
26#define PS_REF_DEBUG 0x200
32#ifdef NEW_DEBUG_SYSTEM_IMPLEMENTED
33#define PSTRACE(x, ...) \
35 DbgPrintEx("%s [%.16s] - ", \
37 PsGetCurrentProcess()->ImageFileName); \
38 DbgPrintEx(__VA_ARGS__); \
41#define PSTRACE(x, ...) \
42 if (x & PspTraceLevel) \
44 DbgPrint("%s [%.16s] - ", \
46 PsGetCurrentProcess()->ImageFileName); \
47 DbgPrint(__VA_ARGS__); \
50#define PSREFTRACE(x) \
51 PSTRACE(PS_REF_DEBUG, \
52 "Pointer Count [%p] @%d: %lx\n", \
55 OBJECT_TO_OBJECT_HEADER(x)->PointerCount)
57#define PSTRACE(x, fmt, ...) DPRINT(fmt, ##__VA_ARGS__)
64#define PSP_MAX_CREATE_THREAD_NOTIFY 8
65#define PSP_MAX_LOAD_IMAGE_NOTIFY 8
66#define PSP_MAX_CREATE_PROCESS_NOTIFY 8
71#define PSP_JOB_SCHEDULING_CLASSES 10
76#define PSP_NON_PAGED_POOL_QUOTA_THRESHOLD 0x10000
77#define PSP_PAGED_POOL_QUOTA_THRESHOLD 0x80000
222 PVOID *NormalContext,
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE Parent
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
_Must_inspect_result_ _In_ LONGLONG _In_ LONGLONG Amount
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
VOID(NTAPI * PLEGO_NOTIFY_ROUTINE)(_In_ PKTHREAD Thread)
NTSTATUS(NTAPI * PKWIN32_PROCESS_CALLOUT)(_In_ struct _EPROCESS *Process, _In_ BOOLEAN Create)
NTSTATUS(NTAPI * PKWIN32_THREAD_CALLOUT)(_In_ struct _ETHREAD *Thread, _In_ PSW32THREADCALLOUTTYPE Type)
enum _SECURITY_IMPERSONATION_LEVEL * PSECURITY_IMPERSONATION_LEVEL
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
_In_ HANDLE ProcessHandle
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
_In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN EffectiveOnly
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN _In_ TOKEN_TYPE TokenType
NTSTATUS NTAPI PsOpenTokenOfProcess(IN HANDLE ProcessHandle, OUT PACCESS_TOKEN *Token)
VOID NTAPI PsReturnSharedPoolQuota(_In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ SIZE_T AmountToReturnPaged, _In_ SIZE_T AmountToReturnNonPaged)
Returns the shared (paged and non paged) pool quotas. The function is used exclusively by the Object ...
POBJECT_TYPE _PsProcessType
LIST_ENTRY PspReaperListHead
NTSTATUS NTAPI PsSuspendThread(IN PETHREAD Thread, OUT PULONG PreviousCount OPTIONAL)
EX_CALLBACK PspLoadImageNotifyRoutine[PSP_MAX_LOAD_IMAGE_NOTIFY]
PVOID PspSystemDllEntryPoint
VOID NTAPI PspRemoveProcessFromJob(IN PEPROCESS Process, IN PEJOB Job)
KSPIN_LOCK PsLoadedModuleSpinLock
LIST_ENTRY PsLoadedModuleList
NTSTATUS NTAPI PspSetPrimaryToken(IN PEPROCESS Process, IN HANDLE TokenHandle OPTIONAL, IN PACCESS_TOKEN Token OPTIONAL)
NTSTATUS NTAPI PspSetQuotaLimits(_In_ PEPROCESS Process, _In_ ULONG Unused, _In_ PVOID QuotaLimits, _In_ ULONG QuotaLimitsLength, _In_ KPROCESSOR_MODE PreviousMode)
This function adjusts the working set limits of a process and sets up new quota limits when necessary...
VOID NTAPI ApphelpCacheShutdown(VOID)
PLEGO_NOTIFY_ROUTINE PspLegoNotifyRoutine
VOID NTAPI PspDeleteProcess(IN PVOID ObjectBody)
PKWIN32_THREAD_CALLOUT PspW32ThreadCallout
PACCESS_TOKEN NTAPI PsReferenceEffectiveToken(IN PETHREAD Thread, OUT IN PTOKEN_TYPE TokenType, OUT PBOOLEAN EffectiveOnly, OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
NTSTATUS NTAPI PsTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
NTSTATUS NTAPI PsChargeProcessPageFileQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the process page file quota. The function is used internally by the kernel.
VOID NTAPI PspSystemThreadStartup(PKSTART_ROUTINE StartRoutine, PVOID StartContext)
VOID NTAPI PspExitProcessFromJob(IN PEJOB Job, IN PEPROCESS Process)
BOOLEAN NTAPI PspIsProcessExiting(IN PEPROCESS Process)
VOID NTAPI PspExitThread(IN NTSTATUS ExitStatus)
VOID NTAPI PspInitializeJobStructures(VOID)
ERESOURCE PsLoadedModuleResource
UNICODE_STRING PsNtDllPathName
PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout
VOID NTAPI PspGetOrSetContextKernelRoutine(IN PKAPC Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine, IN OUT PVOID *NormalContext, IN OUT PVOID *SystemArgument1, IN OUT PVOID *SystemArgument2)
NTSTATUS NTAPI PspInitializeProcessSecurity(IN PEPROCESS Process, IN PEPROCESS Parent OPTIONAL)
#define PSP_MAX_CREATE_PROCESS_NOTIFY
ULONG PspProcessNotifyRoutineCount
PHANDLE_TABLE PspCidTable
BOOLEAN NTAPI PsInitSystem(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
EX_CALLBACK PspThreadNotifyRoutine[PSP_MAX_CREATE_THREAD_NOTIFY]
NTSTATUS NTAPI PspTerminateThreadByPointer(IN PETHREAD Thread, IN NTSTATUS ExitStatus, IN BOOLEAN bSelf)
VOID NTAPI PspShutdownProcessManager(VOID)
LCID PsDefaultSystemLocaleId
PEPROCESS_QUOTA_BLOCK NTAPI PsChargeSharedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T AmountToChargePaged, _In_ SIZE_T AmountToChargeNonPaged)
Charges the shared (paged and non paged) pool quotas. The function is used exclusively by the Object ...
VOID NTAPI PspDereferenceQuotaBlock(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock)
De-references a quota block when quotas have been returned back because of an object de-allocation or...
#define PSP_JOB_SCHEDULING_CLASSES
NTSTATUS NTAPI PspCreateProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess OPTIONAL, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
ULONG PspThreadNotifyRoutineCount
NTSTATUS NTAPI PsReferenceProcessFilePointer(IN PEPROCESS Process, OUT PFILE_OBJECT *FileObject)
VOID NTAPI PspDeleteProcessSecurity(IN PEPROCESS Process)
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
BOOLEAN PspUseJobSchedulingClasses
LIST_ENTRY PsActiveProcessHead
NTSTATUS NTAPI PsResumeThread(IN PETHREAD Thread, OUT PULONG PreviousCount OPTIONAL)
struct _GET_SET_CTX_CONTEXT GET_SET_CTX_CONTEXT
BOOLEAN PsImageNotifyEnabled
NTSTATUS NTAPI PsReturnProcessPageFileQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the page file quota that the process was taking up. The function is used exclusively by the k...
struct _GET_SET_CTX_CONTEXT * PGET_SET_CTX_CONTEXT
ULONG PsPrioritySeparation
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
VOID NTAPI PsChangeQuantumTable(IN BOOLEAN Immediate, IN ULONG PrioritySeparation)
NTSTATUS NTAPI ApphelpCacheInitialize(VOID)
VOID NTAPI PspDeleteThread(IN PVOID ObjectBody)
VOID NTAPI PspDeleteJob(IN PVOID ObjectBody)
VOID NTAPI PsIdleThreadMain(IN PVOID Context)
CHAR PspJobSchedulingClasses[PSP_JOB_SCHEDULING_CLASSES]
ULONG PsRawPrioritySeparation
#define PSP_MAX_LOAD_IMAGE_NOTIFY
#define PSP_MAX_CREATE_THREAD_NOTIFY
LARGE_INTEGER ShortPsLockDelay
LCID PsDefaultThreadLocaleId
POBJECT_TYPE _PsThreadType
PTOKEN PspBootAccessToken
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
VOID NTAPI PsExitSpecialApc(PKAPC Apc, PKNORMAL_ROUTINE *NormalRoutine, PVOID *NormalContext, PVOID *SystemArgument1, PVOID *SystemArgument2)
GENERIC_MAPPING PspJobMapping
WORK_QUEUE_ITEM PspReaperWorkItem
VOID NTAPI PspReapRoutine(IN PVOID Context)
NTSTATUS NTAPI PspMapSystemDll(IN PEPROCESS Process, OUT PVOID *DllBase, IN BOOLEAN UseLargePages)
KGUARDED_MUTEX PspActiveProcessMutex
VOID NTAPI PspInheritQuota(_In_ PEPROCESS Process, _In_ PEPROCESS ParentProcess)
VOID NTAPI PspDeleteThreadSecurity(IN PETHREAD Thread)
VOID NTAPI PspExitProcess(IN BOOLEAN LastThread, IN PEPROCESS Process)
NTSTATUS NTAPI PsLocateSystemDll(VOID)
ULONG_PTR PsNtosImageBase
EX_CALLBACK PspProcessNotifyRoutine[PSP_MAX_CREATE_PROCESS_NOTIFY]
VOID NTAPI PspDeleteLdt(PEPROCESS Process)
NTSTATUS NTAPI PspQueryDescriptorThread(IN PETHREAD Thread, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
VOID NTAPI PspDeleteVdmObjects(PEPROCESS Process)
PULONG MinorVersion OPTIONAL
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ ULONG Flags
KSTART_ROUTINE * PKSTART_ROUTINE
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE StartRoutine
_In_ KPROCESSOR_MODE PreviousMode
enum _TOKEN_TYPE * PTOKEN_TYPE