101 ListHead = &
Process->ThreadListHead;
102 while (ListHead !=
Entry)
142 Entry = OldProcess->ActiveProcessLinks.Flink;
179 UCHAR LocalQuantum, MemoryPriority;
227 *Quantum = LocalQuantum;
244 "%lx PrioritySeparation: %lx\n", Immediate, PrioritySeparation);
311 i = (
Process->Vm.Flags.MemoryPriority ==
359 PVOID ExceptionPortObject;
381 "ProcessHandle: %p Parent: %p\n",
ProcessHandle, ParentProcess);
399 if ((InJob) && (!
Parent->Job))
437 Process->ProcessLock.Value = 0;
452 Process->InheritedFromUniqueProcessId =
Parent->UniqueProcessId;
453 Process->DefaultHardErrorProcessing =
Parent->DefaultHardErrorProcessing;
514 (
PVOID*)&DebugObject,
519 Process->DebugPort = DebugObject;
542 (
PVOID*)&ExceptionPortObject,
547 Process->ExceptionPort = ExceptionPortObject;
581 Process->Vm.MaximumWorkingSetSize = MaxWs;
634 SeAuditProcessCreationInfo.
668 Process->SeAuditProcessCreationInfo.ImageFileName =
672 if (!
Process->SeAuditProcessCreationInfo.ImageFileName)
716 DPRINT1(
"Jobs not yet supported\n");
720 if ((
Parent) && (NeedsPeb))
786 Process->Pcb.QuantumReset = Quantum;
856 CurrentThread->
Tcb.
Teb->NtTib.ArbitraryUserPointer =
Process->Peb;
934 FoundProcess = CidEntry->
Object;
977 FoundThread = CidEntry->
Object;
993 *
Process = FoundThread->ThreadsProcess;
1085 return Process->InheritedFromUniqueProcessId;
1115 return Process->PriorityClass;
1145 return Process->SectionBaseAddress;
1205 return Process->Win32WindowStation;
1235 ULONG PriorityClass)
1248 Process->SecurityPort = SecurityPort;
1272 if (Win32Process !=
NULL)
1279 Process->Win32Process = Win32Process;
1290 if (
Process->Win32Process == OldWin32Process)
1315 PVOID WindowStation)
1317 Process->Win32WindowStation = WindowStation;
1358 "ParentProcess: %p Flags: %lx\n", ParentProcess,
Flags);
#define KeQuerySystemTime(t)
_Must_inspect_result_ _Outptr_ PVOID * SectionObject
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
BOOLEAN NTAPI SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges, IN PGENERIC_MAPPING GenericMapping, IN KPROCESSOR_MODE AccessMode, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
VOID NTAPI PspInheritQuota(IN PEPROCESS Process, IN PEPROCESS ParentProcess)
#define PROCESS_CREATE_FLAGS_LEGAL_MASK
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
LIST_ENTRY ThreadListEntry
NTSTATUS NTAPI SeCreateAccessState(IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
#define STATUS_INSUFFICIENT_RESOURCES
#define PROCESS_ALL_ACCESS
ULONG NTAPI PsGetProcessPriorityClass(PEPROCESS Process)
#define SEM_FAILCRITICALERRORS
#define PsGetCurrentThread()
#define PROCESS_QUERY_INFORMATION
VOID FASTCALL KeAcquireGuardedMutex(IN PKGUARDED_MUTEX GuardedMutex)
const LUID SeDebugPrivilege
#define SEM_NOALIGNMENTFAULTEXCEPT
LARGE_INTEGER NTAPI PsGetProcessExitTime(VOID)
CHAR PspForegroundQuantum[3]
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK _Out_ PNTSTATUS AccessStatus
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
#define STATUS_INVALID_PARAMETER
#define BooleanFlagOn(F, SF)
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
PVOID NTAPI PsGetProcessWin32Process(PEPROCESS Process)
#define KeGetPreviousMode()
#define ExAcquireRundownProtection
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
_In_ BOOL _In_ HANDLE hProcess
#define PSP_VARIABLE_QUANTUMS
NTSTATUS NTAPI PspCreateProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess OPTIONAL, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
PHANDLE_TABLE PspCidTable
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn BOOLEAN Physical UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE Parent
#define STATUS_INVALID_PARAMETER_MIX
#define PROCESS_CREATE_FLAGS_LARGE_PAGES
#define InsertTailList(ListHead, Entry)
NTSTATUS NTAPI PspMapSystemDll(IN PEPROCESS Process, OUT PVOID *DllBase, IN BOOLEAN UseLargePages)
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
ULONG PsMinimumWorkingSet
NTKERNELAPI VOID FASTCALL ExInitializeRundownProtection(_Out_ PEX_RUNDOWN_REF RunRef)
VOID NTAPI KeInitializeProcess(struct _KPROCESS *Process, KPRIORITY Priority, KAFFINITY Affinity, PULONG_PTR DirectoryTableBase, IN BOOLEAN Enable)
NTSTATUS NTAPI NtOpenProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId)
_Must_inspect_result_ FORCEINLINE BOOLEAN IsListEmpty(_In_ const LIST_ENTRY *ListHead)
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
#define PROCESS_CREATE_THREAD
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
LIST_ENTRY PsActiveProcessHead
HANDLE NTAPI ExCreateHandle(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
NTSTATUS NTAPI PsGetProcessExitStatus(PEPROCESS Process)
ULONG NTAPI PsGetProcessSessionIdEx(IN PEPROCESS Process)
PEPROCESS PsInitialSystemProcess
NTSTATUS NTAPI PsSetProcessWin32Process(_Inout_ PEPROCESS Process, _In_opt_ PVOID Win32Process, _In_opt_ PVOID OldWin32Process)
#define STATUS_INVALID_CID
KPRIORITY NTAPI PspComputeQuantumAndPriority(IN PEPROCESS Process, IN PSPROCESSPRIORITYMODE Mode, OUT PUCHAR Quantum)
#define ASSERTMSG(msg, exp)
ULONG PsPrioritySeparation
#define PROCESS_DUP_HANDLE
#define PROCESS_PRIORITY_NORMAL
#define PsGetCurrentProcess
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
CHAR PspJobSchedulingClasses[PSP_JOB_SCHEDULING_CLASSES]
#define EXCEPTION_EXECUTE_HANDLER
VOID NTAPI ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
BOOLEAN ImageUsesLargePages
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
FORCEINLINE VOID Ki386PerfEnd(VOID)
NTSTATUS NTAPI PsSetProcessSecurityPort(PEPROCESS Process, PVOID SecurityPort)
#define PROCESS_PRIORITY_CLASS_NORMAL
LPSTR NTAPI PsGetProcessImageFileName(PEPROCESS Process)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
#define PROCESS_SET_QUOTA
#define PSF_HAS_ADDRESS_SPACE_BIT
NTSTATUS NTAPI ObGetObjectSecurity(IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
POBJECT_TYPE LpcPortObjectType
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
#define PSP_LONG_QUANTUMS
struct _LIST_ENTRY * Flink
ULONG NTAPI PsGetCurrentProcessSessionId(VOID)
_In_ KPROCESSOR_MODE PreviousMode
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES
_Must_inspect_result_ _In_ ULONG Flags
_Out_ PCLIENT_ID ClientId
BOOLEAN NTAPI MmIsThisAnNtAsSystem(VOID)
PVOID NTAPI PsGetProcessDebugPort(PEPROCESS Process)
#define _SEH2_YIELD(STMT_)
KPRIORITY PspPriorityTable[PROCESS_PRIORITY_CLASS_ABOVE_NORMAL+1]
VOID NTAPI DbgkCopyProcessDebugPort(IN PEPROCESS Process, IN PEPROCESS Parent)
NTSTATUS NTAPI MmCreatePeb(IN PEPROCESS Process, IN PINITIAL_PEB InitialPeb, OUT PPEB *BasePeb)
#define NT_SUCCESS(StatCode)
PEJOB NTAPI PsGetProcessJob(PEPROCESS Process)
PVOID NTAPI PsGetProcessSectionBaseAddress(PEPROCESS Process)
#define PSF_NO_DEBUG_INHERIT_BIT
NTSTATUS NTAPI MmInitializeProcessAddressSpace(IN PEPROCESS Process, IN PEPROCESS Clone OPTIONAL, IN PVOID Section OPTIONAL, IN OUT PULONG Flags, IN POBJECT_NAME_INFORMATION *AuditName OPTIONAL)
#define STATUS_PROCESS_IS_TERMINATING
#define ObDereferenceObject
VOID NTAPI PsSetProcessWindowStation(PEPROCESS Process, PVOID WindowStation)
FORCEINLINE VOID PspRunCreateProcessNotifyRoutines(IN PEPROCESS CurrentProcess, IN BOOLEAN Create)
#define PSF_PROCESS_DELETE_BIT
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
#define MEMORY_PRIORITY_BACKGROUND
#define ProbeForWriteHandle(Ptr)
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
VOID NTAPI PsChangeQuantumTable(IN BOOLEAN Immediate, IN ULONG PrioritySeparation)
#define PROCESS_CREATE_PROCESS
POBJECT_TYPE MmSectionObjectType
ULONG PsRawPrioritySeparation
BOOLEAN NTAPI PsIsSystemProcess(IN PEPROCESS Process)
static HANDLE(WINAPI *pCreateJobObjectW)(LPSECURITY_ATTRIBUTES sa
BOOLEAN NTAPI PsGetProcessExitProcessCalled(PEPROCESS Process)
NTSTATUS NTAPI PsLookupProcessThreadByCid(IN PCLIENT_ID Cid, OUT PEPROCESS *Process OPTIONAL, OUT PETHREAD *Thread)
#define STATUS_UNSUCCESSFUL
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
#define ExAllocatePoolWithTag(hernya, size, tag)
_In_ WDFINTERRUPT _In_ WDF_INTERRUPT_POLICY _In_ WDF_INTERRUPT_PRIORITY Priority
NTSTATUS NTAPI PsLookupProcessByProcessId(IN HANDLE ProcessId, OUT PEPROCESS *Process)
#define PspQuantumLengthFromMask(Mask)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
#define PspPrioritySeparationFromMask(Mask)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
LARGE_INTEGER ShortPsLockDelay
#define PSP_FIXED_QUANTUMS
#define KeEnterCriticalRegion()
#define memcpy(s1, s2, n)
VOID NTAPI SeAuditProcessCreate(IN PEPROCESS Process)
NTSTATUS NTAPI MmInitializeHandBuiltProcess2(IN PEPROCESS Process)
KPRIORITY NTAPI KeSetPriorityAndQuantumProcess(IN PKPROCESS Process, IN KPRIORITY Priority, IN UCHAR Quantum OPTIONAL)
PVOID NTAPI PsGetProcessWin32WindowStation(PEPROCESS Process)
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
static const WCHAR Cleanup[]
OBJECT_TYPE_INITIALIZER TypeInfo
#define PSP_SHORT_QUANTUMS
CHAR PspVariableQuantums[6]
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT
VOID NTAPI PsSetProcessPriorityByClass(IN PEPROCESS Process, IN PSPROCESSPRIORITYMODE Type)
KAFFINITY KeActiveProcessors
FORCEINLINE PMMPFN MiGetPfnEntry(IN PFN_NUMBER Pfn)
BOOLEAN NTAPI MmCreateProcessAddressSpace(IN ULONG MinWs, IN PEPROCESS Dest, IN PULONG_PTR DirectoryTableBase)
PPEB NTAPI PsGetProcessPeb(PEPROCESS Process)
#define MEMORY_PRIORITY_FOREGROUND
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
#define DbgkDebugObjectType
LONGLONG NTAPI PsGetProcessCreateTimeQuadPart(PEPROCESS Process)
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess)
FORCEINLINE VOID ExAcquirePushLockShared(PEX_PUSH_LOCK PushLock)
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
#define KeLeaveCriticalRegion()
GENERIC_MAPPING GenericMapping
#define STANDARD_RIGHTS_ALL
#define PROCESS_TERMINATE
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define InitializeListHead(ListHead)
BOOLEAN PspUseJobSchedulingClasses
NTSTATUS NTAPI MmSetMemoryPriorityProcess(IN PEPROCESS Process, IN UCHAR MemoryPriority)
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
VOID NTAPI SeDeleteAccessState(IN PACCESS_STATE AccessState)
HANDLE NTAPI PsGetCurrentProcessId(VOID)
PVOID NTAPI PsGetCurrentProcessWin32Process(VOID)
#define PROCESS_CREATE_FLAGS_BREAKAWAY
KGUARDED_MUTEX PspActiveProcessMutex
VOID FASTCALL KeReleaseGuardedMutex(IN OUT PKGUARDED_MUTEX GuardedMutex)
ULONG PsMaximumWorkingSet
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define DEBUG_OBJECT_ADD_REMOVE_PROCESS
#define ObReferenceObject
FORCEINLINE VOID ExReleasePushLockShared(PEX_PUSH_LOCK PushLock)
NTSTATUS NTAPI NtCreateProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL)
#define SECTION_MAP_EXECUTE
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
NTSTATUS NTAPI ObInitProcess(IN PEPROCESS Parent OPTIONAL, IN PEPROCESS Process)
#define RtlZeroMemory(Destination, Length)
NTSTATUS NTAPI PsCreateSystemProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
HANDLE NTAPI PsGetProcessInheritedFromUniqueProcessId(PEPROCESS Process)
ULONG NTAPI MmGetSessionId(IN PEPROCESS Process)
#define PROCESS_VM_OPERATION
NTSTATUS NTAPI PspInitializeProcessSecurity(IN PEPROCESS Process, IN PEPROCESS Parent OPTIONAL)
#define RtlCopyMemory(Destination, Source, Length)
#define PROCESS_SET_INFORMATION
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL
#define PSTRACE(x, fmt,...)
#define _SEH2_EXCEPT(...)
VOID NTAPI KeSetQuantumProcess(IN PKPROCESS Process, IN UCHAR Quantum)
HANDLE NTAPI PsGetProcessId(PEPROCESS Process)
#define _SEH2_GetExceptionCode()
NTSTATUS NTAPI SeCreateAccessStateEx(IN PETHREAD Thread, IN PEPROCESS Process, IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
enum _PSPROCESSPRIORITYMODE PSPROCESSPRIORITYMODE
VOID NTAPI PsSetProcessPriorityClass(PEPROCESS Process, ULONG PriorityClass)
BOOLEAN NTAPI SeDetailedAuditingWithToken(IN PTOKEN Token)
#define PROCESS_PRIORITY_CLASS_IDLE
_In_ HANDLE ProcessHandle
ULONG NTAPI MmGetSessionIdEx(IN PEPROCESS Process)
NTSTATUS NTAPI NtCreateProcessEx(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
BOOLEAN NTAPI PsIsProcessBeingDebugged(PEPROCESS Process)
NTSTATUS NTAPI MmInitializeHandBuiltProcess(IN PEPROCESS Process, IN PULONG_PTR DirectoryTableBase)
POBJECT_TYPE PsProcessType
#define PspQuantumTypeFromMask(Mask)
base of all file and directory entries
VOID NTAPI ObInheritDeviceMap(IN PEPROCESS Parent, IN PEPROCESS Process)
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
PVOID NTAPI PsGetProcessSecurityPort(PEPROCESS Process)
PULONG MinorVersion OPTIONAL