88 Buf->ViewBaseClient = Buf;
91 Buf->OffsetFree =
sizeof(*Buf);
115 DPRINT1(
"RtlDQDB: Failed to free VM!\n");
142 DPRINT(
"RtlpQueryRemoteProcessModules Start\n");
164 Modules->NumberOfModules = 0;
165 ModulePtr = &Modules->Modules[0];
201 while(pleCurEntry != pleListHead)
238 DPRINT(
" Module %wZ\n", &Unicode);
244 else if (Modules !=
NULL)
269 Modules->NumberOfModules++;
280 DPRINT(
"RtlpQueryRemoteProcessModules End\n");
298 Buf->Flags = DebugInfoMask;
301 DPRINT(
"QueryProcessDebugInformation Start\n");
318 ULONG ReturnSize = 0;
328 DPRINT1(
"RtlQueryProcessDebugInformation: Unable to commit %u\n", ReturnSize);
358 Buf->OffsetFree = Buf->OffsetFree + HSize;
370 Buf->OffsetFree = Buf->OffsetFree + LSize;
373 DPRINT(
"QueryProcessDebugInformation end\n");
374 DPRINT(
"QueryDebugInfo : 0x%lx\n", Buf->OffsetFree);
404 ULONG ReturnSize = 0;
414 DPRINT1(
"RtlQueryProcessDebugInformation: Unable to commit %u\n", ReturnSize);
445 Buf->OffsetFree = Buf->OffsetFree + HSize;
457 Buf->OffsetFree = Buf->OffsetFree + LSize;
460 DPRINT(
"QueryProcessDebugInformation end\n");
461 DPRINT(
"QueryDebugInfo : 0x%lx\n", Buf->OffsetFree);
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
#define RTL_DEBUG_QUERY_LOCKS
#define STATUS_INFO_LENGTH_MISMATCH
#define PROCESS_ALL_ACCESS
#define RTL_DEBUG_QUERY_HEAP_TAGS
IN BOOLEAN OUT PSTR Buffer
LIST_ENTRY InLoadOrderModuleList
#define RTL_DEBUG_QUERY_HEAP_BLOCKS
struct _RTL_DEBUG_INFORMATION RTL_DEBUG_INFORMATION
PVOID NTAPI RtlpDebugBufferCommit(_Inout_ PRTL_DEBUG_INFORMATION Buffer, _In_ SIZE_T Size)
IN PVOID IN PVOID IN USHORT IN USHORT Size
_In_ BOOL _In_ HANDLE hProcess
_Check_return_ _CRTIMP _CONST_RETURN char *__cdecl strrchr(_In_z_ const char *_Str, _In_ int _Ch)
struct _RTL_PROCESS_HEAPS RTL_PROCESS_HEAPS
NTSTATUS NTAPI NtOpenProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
#define RTL_DEBUG_QUERY_HEAPS
RTL_PROCESS_LOCK_INFORMATION Locks[1]
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
#define RTL_DEBUG_QUERY_MODULES
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
#define NtCurrentProcess()
struct _LIST_ENTRY * Flink
_Out_ PCLIENT_ID ClientId
#define NT_SUCCESS(StatCode)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T CommitSize
NTSTATUS NTAPI RtlQueryProcessDebugInformation(IN ULONG ProcessId, IN ULONG DebugInfoMask, IN OUT PRTL_DEBUG_INFORMATION Buf)
NTSTATUS NTAPI NtReadVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T NumberOfBytesToRead, OUT PSIZE_T NumberOfBytesRead OPTIONAL)
NTSTATUS NTAPI LdrQueryProcessModuleInformation(IN PRTL_PROCESS_MODULES ModuleInformation, IN ULONG Size, OUT PULONG ReturnedSize OPTIONAL)
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
PRTL_DEBUG_INFORMATION NTAPI RtlCreateQueryDebugBuffer(_In_ ULONG Size, _In_ BOOLEAN EventPair)
struct _RTL_PROCESS_LOCKS * PRTL_PROCESS_LOCKS
struct _RTL_PROCESS_LOCKS RTL_PROCESS_LOCKS
struct _RTL_PROCESS_HEAPS * PRTL_PROCESS_HEAPS
LIST_ENTRY InLoadOrderLinks
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
NTSTATUS NTAPI RtlpQueryRemoteProcessModules(HANDLE ProcessHandle, IN PRTL_PROCESS_MODULES Modules OPTIONAL, IN ULONG Size OPTIONAL, OUT PULONG ReturnedSize)
NTSTATUS NTAPI NtAllocateVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UBaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T URegionSize, IN ULONG AllocationType, IN ULONG Protect)
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
#define STATUS_ACCESS_VIOLATION
UNICODE_STRING FullDllName
NTSTATUS NTAPI RtlDestroyQueryDebugBuffer(_In_ PRTL_DEBUG_INFORMATION Buf)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
#define InitializeObjectAttributes(p, n, a, r, s)
RTL_HEAP_INFORMATION Heaps[1]
_In_ HANDLE ProcessHandle
NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
NTSTATUS NTAPI NtFreeVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *UBaseAddress, IN PSIZE_T URegionSize, IN ULONG FreeType)
PULONG MinorVersion OPTIONAL