epsapi.h File Reference

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	FAILED_WITH_STATUS   DEFINE_DBG_MSG("%s() failed, status 0x%08X")
#define	DEFINE_DBG_MSG(__str__)   "PSAPI: " __str__ "\n"

Typedefs
typedef NTSTATUS(NTAPI *	PPROC_ENUM_ROUTINE) (IN PSYSTEM_PROCESS_INFORMATION CurrentProcess, IN OUT PVOID CallbackContext)
typedef NTSTATUS(NTAPI *	PTHREAD_ENUM_ROUTINE) (IN PSYSTEM_THREAD_INFORMATION CurrentThread, IN OUT PVOID CallbackContext)
typedef NTSTATUS(NTAPI *	PSYSMOD_ENUM_ROUTINE) (IN PRTL_PROCESS_MODULE_INFORMATION CurrentModule, IN OUT PVOID CallbackContext)
typedef NTSTATUS(NTAPI *	PPROCMOD_ENUM_ROUTINE) (IN HANDLE ProcessHandle, IN PLDR_DATA_TABLE_ENTRY CurrentModule, IN OUT PVOID CallbackContext)

Functions
NTSTATUS NTAPI	PsaEnumerateProcessesAndThreads (IN PPROC_ENUM_ROUTINE ProcessCallback, IN OUT PVOID ProcessCallbackContext, IN PTHREAD_ENUM_ROUTINE ThreadCallback, IN OUT PVOID ThreadCallbackContext)
NTSTATUS NTAPI	PsaEnumerateProcesses (IN PPROC_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaEnumerateThreads (IN PTHREAD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaCaptureProcessesAndThreads (OUT PSYSTEM_PROCESS_INFORMATION *ProcessesAndThreads)
NTSTATUS NTAPI	PsaWalkProcessesAndThreads (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads, IN PPROC_ENUM_ROUTINE ProcessCallback, IN OUT PVOID ProcessCallbackContext, IN PTHREAD_ENUM_ROUTINE ThreadCallback, IN OUT PVOID ThreadCallbackContext)
NTSTATUS NTAPI	PsaWalkProcesses (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads, IN PPROC_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaWalkThreads (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads, IN PTHREAD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
PSYSTEM_PROCESS_INFORMATION FASTCALL	PsaWalkFirstProcess (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads)
PSYSTEM_PROCESS_INFORMATION FASTCALL	PsaWalkNextProcess (IN PSYSTEM_PROCESS_INFORMATION CurrentProcess)
PSYSTEM_THREAD_INFORMATION FASTCALL	PsaWalkFirstThread (IN PSYSTEM_PROCESS_INFORMATION CurrentProcess)
PSYSTEM_THREAD_INFORMATION FASTCALL	PsaWalkNextThread (IN PSYSTEM_THREAD_INFORMATION CurrentThread)
NTSTATUS NTAPI	PsaEnumerateSystemModules (IN PSYSMOD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaCaptureSystemModules (OUT PRTL_PROCESS_MODULES *SystemModules)
NTSTATUS NTAPI	PsaWalkSystemModules (IN PRTL_PROCESS_MODULES SystemModules, IN PSYSMOD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
PRTL_PROCESS_MODULE_INFORMATION FASTCALL	PsaWalkFirstSystemModule (IN PRTL_PROCESS_MODULES SystemModules)
PRTL_PROCESS_MODULE_INFORMATION FASTCALL	PsaWalkNextSystemModule (IN PRTL_PROCESS_MODULES CurrentSystemModule)
NTSTATUS NTAPI	PsaEnumerateProcessModules (IN HANDLE ProcessHandle, IN PPROCMOD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
VOID NTAPI	PsaFreeCapture (IN PVOID Capture)
void *	PsaiMalloc (SIZE_T size)
void *	PsaiRealloc (void *ptr, SIZE_T size)
void	PsaiFree (void *ptr)

Macro Definition Documentation

DEFINE_DBG_MSG

#define DEFINE_DBG_MSG

(

__str__

)

"PSAPI: " __str__ "\n"

Definition at line 131 of file epsapi.h.

FAILED_WITH_STATUS

#define FAILED_WITH_STATUS   DEFINE_DBG_MSG("%s() failed, status 0x%08X")

Definition at line 41 of file epsapi.h.

Typedef Documentation

PPROC_ENUM_ROUTINE

typedef NTSTATUS(NTAPI * PPROC_ENUM_ROUTINE) (IN PSYSTEM_PROCESS_INFORMATION CurrentProcess, IN OUT PVOID CallbackContext)

Definition at line 27 of file epsapi.h.

PPROCMOD_ENUM_ROUTINE

typedef NTSTATUS(NTAPI * PPROCMOD_ENUM_ROUTINE) (IN HANDLE ProcessHandle, IN PLDR_DATA_TABLE_ENTRY CurrentModule, IN OUT PVOID CallbackContext)

Definition at line 36 of file epsapi.h.

PSYSMOD_ENUM_ROUTINE

typedef NTSTATUS(NTAPI * PSYSMOD_ENUM_ROUTINE) (IN PRTL_PROCESS_MODULE_INFORMATION CurrentModule, IN OUT PVOID CallbackContext)

Definition at line 33 of file epsapi.h.

PTHREAD_ENUM_ROUTINE

typedef NTSTATUS(NTAPI * PTHREAD_ENUM_ROUTINE) (IN PSYSTEM_THREAD_INFORMATION CurrentThread, IN OUT PVOID CallbackContext)

Definition at line 30 of file epsapi.h.

Function Documentation

PsaCaptureProcessesAndThreads()

NTSTATUS NTAPI PsaCaptureProcessesAndThreads

(

OUT PSYSTEM_PROCESS_INFORMATION *

ProcessesAndThreads

)

Definition at line 38 of file processes.c.

{
  PSYSTEM_PROCESS_INFORMATION pInfoBuffer = NULL;
  SIZE_T nSize = 0x8000;
  NTSTATUS Status;
 
  if(ProcessesAndThreads == NULL)
  {
    return STATUS_INVALID_PARAMETER_1;
  }
 
  /* FIXME: if the system has loaded several processes and threads, the buffer
            could get really big. But if there's several processes and threads, the
            system is already under stress, and a huge buffer could only make things
            worse. The function should be profiled to see what's the average minimum
            buffer size, to succeed on the first shot */
  do
  {
    PVOID pTmp;
 
    /* free the buffer, and reallocate it to the new size. RATIONALE: since we
       ignore the buffer's contents at this point, there's no point in a realloc()
       that could end up copying a large chunk of data we'd discard anyway */
    PsaiFree(pInfoBuffer);
    pTmp = PsaiMalloc(nSize);
 
    if(pTmp == NULL)
    {
      DPRINT(FAILED_WITH_STATUS, "PsaiMalloc", STATUS_NO_MEMORY);
      Status = STATUS_NO_MEMORY;
      break;
    }
 
    pInfoBuffer = pTmp;
 
    /* query the information */
    Status = NtQuerySystemInformation(SystemProcessInformation,
                                      pInfoBuffer,
                                      nSize,
                                      NULL);
 
    /* double the buffer size */
    nSize *= 2;
  } while(Status == STATUS_INFO_LENGTH_MISMATCH);
 
  if(!NT_SUCCESS(Status))
  {
    DPRINT(FAILED_WITH_STATUS, "NtQuerySystemInformation", Status);
    return Status;
  }
 
  *ProcessesAndThreads = pInfoBuffer;
  return STATUS_SUCCESS;
}

Referenced by PsaEnumerateProcessesAndThreads().

PsaCaptureSystemModules()

NTSTATUS NTAPI PsaCaptureSystemModules

(

OUT PRTL_PROCESS_MODULES *

SystemModules

)

Definition at line 61 of file drivers.c.

{
  SIZE_T nSize = 0;
  PRTL_PROCESS_MODULES psmModules = NULL;
  NTSTATUS Status;
 
#if 0
  __try
  {
#else
  do
  {
#endif
  /* initial probe. We just get the count of system modules */
  Status = NtQuerySystemInformation(SystemModuleInformation,
                                    &nSize,
                                    sizeof(nSize),
                                    NULL);
 
  if(!NT_SUCCESS(Status) && (Status != STATUS_INFO_LENGTH_MISMATCH))
  {
    DPRINT(FAILED_WITH_STATUS, "NtQuerySystemInformation", Status);
    break;
  }
 
  /* RATIONALE: the loading of a system module is a rare occurrence. To
     minimize memory operations that could be expensive, or fragment the
     pool/heap, we try to determine the buffer size in advance, knowing that
     the number of elements is unlikely to change */
  nSize = sizeof(RTL_PROCESS_MODULES) +
          (nSize * sizeof(RTL_PROCESS_MODULES));
 
  psmModules = NULL;
 
  do
  {
    PVOID pTmp;
 
    /* free the buffer, and reallocate it to the new size. RATIONALE: since we
       ignore the buffer's content at this point, there's no point in a realloc,
       that could end up copying a large chunk of data we'd discard anyway */
    PsaiFree(psmModules);
    psmModules = NULL;
    pTmp = PsaiMalloc(nSize);
 
    if(pTmp == NULL)
    {
      Status = STATUS_NO_MEMORY;
      DPRINT(FAILED_WITH_STATUS, "PsaiMalloc", Status);
      break;
    }
 
    psmModules = pTmp;
 
    /* query the information */
    Status = NtQuerySystemInformation(SystemModuleInformation,
                                      psmModules,
                                      nSize,
                                      NULL);
 
    /* double the buffer for the next loop */
    nSize *= 2;
  } while(Status == STATUS_INFO_LENGTH_MISMATCH);
 
  if(!NT_SUCCESS(Status))
  {
    DPRINT(FAILED_WITH_STATUS, "NtQuerySystemInformation", Status);
    break;
  }
 
  *SystemModules = psmModules;
 
  Status = STATUS_SUCCESS;
#if 0
  }
  __finally
  {
#else
  } while(0);
#endif
  /* in case of failure, free the buffer */
  if(!NT_SUCCESS(Status) && psmModules != NULL)
  {
    PsaiFree(psmModules);
  }
#if 0
  }
#endif
 
  return Status;
}

Referenced by PsaEnumerateSystemModules().

PsaEnumerateProcesses()

NTSTATUS NTAPI PsaEnumerateProcesses	(	IN PPROC_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 218 of file processes.c.

{
  return PsaEnumerateProcessesAndThreads(Callback,
                                         CallbackContext,
                                         NULL,
                                         NULL);
}

PsaEnumerateProcessesAndThreads()

NTSTATUS NTAPI PsaEnumerateProcessesAndThreads	(	IN PPROC_ENUM_ROUTINE	ProcessCallback,
		IN OUT PVOID	ProcessCallbackContext,
		IN PTHREAD_ENUM_ROUTINE	ThreadCallback,
		IN OUT PVOID	ThreadCallbackContext
	)

Definition at line 153 of file processes.c.

{
  PSYSTEM_PROCESS_INFORMATION pInfoBuffer = NULL;
  NTSTATUS Status;
 
  if(ProcessCallback == NULL && ThreadCallback == NULL)
  {
    return STATUS_INVALID_PARAMETER;
  }
 
  /* get the processes and threads list */
  Status = PsaCaptureProcessesAndThreads(&pInfoBuffer);
 
  if(!NT_SUCCESS(Status))
  {
    goto Bail;
  }
 
  /* walk the processes and threads list */
  Status = PsaWalkProcessesAndThreads(pInfoBuffer,
                                      ProcessCallback,
                                      ProcessCallbackContext,
                                      ThreadCallback,
                                      ThreadCallbackContext);
 
Bail:
  PsaFreeCapture(pInfoBuffer);
 
  return Status;
}

Referenced by PsaEnumerateProcesses(), and PsaEnumerateThreads().

PsaEnumerateProcessModules()

NTSTATUS NTAPI PsaEnumerateProcessModules	(	IN HANDLE	ProcessHandle,
		IN PPROCMOD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 30 of file modules.c.

{
  NTSTATUS Status;
 
  /* current process - use direct memory copy */
  /* FIXME - compare process id instead of a handle */
  if(ProcessHandle == NtCurrentProcess())
  {
    PLIST_ENTRY ListHead, Current;
 
#if 0
    __try
    {
#endif
      ListHead = &(NtCurrentPeb()->Ldr->InLoadOrderModuleList);
      Current = ListHead->Flink;
 
      while(Current != ListHead)
      {
        PLDR_DATA_TABLE_ENTRY LoaderModule = CONTAINING_RECORD(Current, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
 
        /* return the current module to the callback */
        Status = Callback(ProcessHandle, LoaderModule, CallbackContext);
 
        if(!NT_SUCCESS(Status))
        {
          goto Failure;
        }
 
        Current = LoaderModule->InLoadOrderLinks.Flink;
      }
#if 0
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
      return GetExceptionCode();
    }
#endif
  }
  else
  {
    PROCESS_BASIC_INFORMATION BasicInformation;
    PPEB_LDR_DATA LoaderData;
    LDR_DATA_TABLE_ENTRY LoaderModule;
    PLIST_ENTRY ListHead, Current;
 
    /* query the process basic information (includes the PEB address) */
    Status = NtQueryInformationProcess(ProcessHandle,
                                       ProcessBasicInformation,
                                       &BasicInformation,
                                       sizeof(BasicInformation),
                                       NULL);
 
    if(!NT_SUCCESS(Status))
    {
      DPRINT(FAILED_WITH_STATUS, "NtQueryInformationProcess", Status);
      goto Failure;
    }
 
    /* get the address of the PE Loader data */
    Status = NtReadVirtualMemory(ProcessHandle,
                                 &(BasicInformation.PebBaseAddress->Ldr),
                                 &LoaderData,
                                 sizeof(LoaderData),
                                 NULL);
 
    if(!NT_SUCCESS(Status))
    {
      DPRINT(FAILED_WITH_STATUS, "NtReadVirtualMemory", Status);
      goto Failure;
    }
 
    /* head of the module list: the last element in the list will point to this */
    ListHead = &LoaderData->InLoadOrderModuleList;
 
    /* get the address of the first element in the list */
    Status = NtReadVirtualMemory(ProcessHandle,
                                 &(LoaderData->InLoadOrderModuleList.Flink),
                                 &Current,
                                 sizeof(Current),
                                 NULL);
 
    while(Current != ListHead)
    {
      /* read the current module */
      Status = NtReadVirtualMemory(ProcessHandle,
                                   CONTAINING_RECORD(Current, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks),
                                   &LoaderModule,
                                   sizeof(LoaderModule),
                                   NULL);
 
      if(!NT_SUCCESS(Status))
      {
        DPRINT(FAILED_WITH_STATUS, "NtReadVirtualMemory", Status);
        goto Failure;
      }
 
      /* return the current module to the callback */
      Status = Callback(ProcessHandle, &LoaderModule, CallbackContext);
 
      if(!NT_SUCCESS(Status))
      {
        goto Failure;
      }
 
      /* address of the next module in the list */
      Current = LoaderModule.InLoadOrderLinks.Flink;
    }
  }
 
  return STATUS_SUCCESS;
 
Failure:
  return Status;
}

PsaEnumerateSystemModules()

NTSTATUS NTAPI PsaEnumerateSystemModules	(	IN PSYSMOD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 21 of file drivers.c.

{
  PRTL_PROCESS_MODULES psmModules;
  NTSTATUS Status = STATUS_SUCCESS;
 
#if 0
  __try
  {
#else
  do
  {
#endif
  /* capture the system modules */
  Status = PsaCaptureSystemModules(&psmModules);
 
  if(!NT_SUCCESS(Status))
  {
    break;
  }
 
  /* walk the system modules */
  Status = PsaWalkSystemModules(psmModules, Callback, CallbackContext);
#if 0
  }
  __finally
  {
#else
  } while(0);
#endif
  /* free the capture */
  PsaFreeCapture(psmModules);
#if 0
  }
#endif
 
  return Status;
}

PsaEnumerateThreads()

NTSTATUS NTAPI PsaEnumerateThreads	(	IN PTHREAD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 228 of file processes.c.

{
  return PsaEnumerateProcessesAndThreads(NULL,
                                         NULL,
                                         Callback,
                                         CallbackContext);
}

PsaFreeCapture()

VOID NTAPI PsaFreeCapture

(

IN PVOID

Capture

)

Definition at line 188 of file processes.c.

{
  PsaiFree(Capture);
}

Referenced by PsaEnumerateProcessesAndThreads().

PsaiFree()

void PsaiFree

(

void *

ptr

)

Definition at line 103 of file ctm.c.

{ free(ptr); }

Referenced by PsaCaptureProcessesAndThreads(), PsaCaptureSystemModules(), and PsaFreeCapture().

PsaiMalloc()

void * PsaiMalloc

(

SIZE_T

size

)

Definition at line 101 of file ctm.c.

{ return malloc(size); }

Referenced by PsaCaptureProcessesAndThreads(), and PsaCaptureSystemModules().

PsaiRealloc()

void * PsaiRealloc	(	void *	ptr,
		SIZE_T	size
	)

Definition at line 102 of file ctm.c.

{ return realloc(ptr, size); }

PsaWalkFirstProcess()

PSYSTEM_PROCESS_INFORMATION FASTCALL PsaWalkFirstProcess

(

IN PSYSTEM_PROCESS_INFORMATION

ProcessesAndThreads

)

Definition at line 238 of file processes.c.

{
  return ProcessesAndThreads;
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkFirstSystemModule()

PRTL_PROCESS_MODULE_INFORMATION FASTCALL PsaWalkFirstSystemModule

(

IN PRTL_PROCESS_MODULES

SystemModules

)

Definition at line 177 of file drivers.c.

{
  return &(SystemModules->Modules[0]);
}

PsaWalkFirstThread()

PSYSTEM_THREAD_INFORMATION FASTCALL PsaWalkFirstThread

(

IN PSYSTEM_PROCESS_INFORMATION

CurrentProcess

)

Definition at line 257 of file processes.c.

{
  static SIZE_T nOffsetOfThreads = 0;
 
  /* get the offset of the Threads field */
  nOffsetOfThreads = sizeof(SYSTEM_PROCESS_INFORMATION);
 
  return (PSYSTEM_THREAD_INFORMATION)((ULONG_PTR)CurrentProcess + nOffsetOfThreads);
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkNextProcess()

PSYSTEM_PROCESS_INFORMATION FASTCALL PsaWalkNextProcess

(

IN PSYSTEM_PROCESS_INFORMATION

CurrentProcess

)

Definition at line 244 of file processes.c.

{
  if(CurrentProcess->NextEntryOffset == 0)
  {
    return NULL;
  }
  else
  {
    return (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)CurrentProcess + CurrentProcess->NextEntryOffset);
  }
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkNextSystemModule()

PRTL_PROCESS_MODULE_INFORMATION FASTCALL PsaWalkNextSystemModule

(

IN PRTL_PROCESS_MODULES

CurrentSystemModule

)

Definition at line 183 of file drivers.c.

{
  return (PRTL_PROCESS_MODULE_INFORMATION)((ULONG_PTR)CurrentSystemModule +
                                            (FIELD_OFFSET(RTL_PROCESS_MODULES, Modules[1]) -
                                             FIELD_OFFSET(RTL_PROCESS_MODULES, Modules[0])));
}

PsaWalkNextThread()

PSYSTEM_THREAD_INFORMATION FASTCALL PsaWalkNextThread

(

IN PSYSTEM_THREAD_INFORMATION

CurrentThread

)

Definition at line 268 of file processes.c.

{
  return (PSYSTEM_THREAD_INFORMATION)((ULONG_PTR)CurrentThread +
                           ((sizeof(SYSTEM_PROCESS_INFORMATION) + sizeof(SYSTEM_THREAD_INFORMATION)) -
                            sizeof(SYSTEM_PROCESS_INFORMATION)));
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkProcesses()

NTSTATUS NTAPI PsaWalkProcesses	(	IN PSYSTEM_PROCESS_INFORMATION	ProcessesAndThreads,
		IN PPROC_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 194 of file processes.c.

{
  return PsaWalkProcessesAndThreads(ProcessesAndThreads,
                                    Callback,
                                    CallbackContext,
                                    NULL,
                                    NULL);
}

PsaWalkProcessesAndThreads()

NTSTATUS NTAPI PsaWalkProcessesAndThreads	(	IN PSYSTEM_PROCESS_INFORMATION	ProcessesAndThreads,
		IN PPROC_ENUM_ROUTINE	ProcessCallback,
		IN OUT PVOID	ProcessCallbackContext,
		IN PTHREAD_ENUM_ROUTINE	ThreadCallback,
		IN OUT PVOID	ThreadCallbackContext
	)

Definition at line 94 of file processes.c.

{
  NTSTATUS Status;
 
  if(ProcessCallback == NULL && ThreadCallback == NULL)
  {
    return STATUS_INVALID_PARAMETER;
  }
 
  Status = STATUS_SUCCESS;
 
  ProcessesAndThreads = PsaWalkFirstProcess(ProcessesAndThreads);
 
  /* scan the process list */
  do
  {
    if(ProcessCallback)
    {
      Status = ProcessCallback(ProcessesAndThreads, ProcessCallbackContext);
 
      if(!NT_SUCCESS(Status))
      {
        break;
      }
    }
 
    /* if the caller provided a thread callback */
    if(ThreadCallback)
    {
      ULONG i;
      PSYSTEM_THREAD_INFORMATION pCurThread;
 
      /* scan the current process's thread list */
      for(i = 0, pCurThread = PsaWalkFirstThread(ProcessesAndThreads);
          i < ProcessesAndThreads->NumberOfThreads;
          i++, pCurThread = PsaWalkNextThread(pCurThread))
      {
        Status = ThreadCallback(pCurThread, ThreadCallbackContext);
 
        if(!NT_SUCCESS(Status))
        {
          goto Bail;
        }
      }
    }
 
    /* move to the next process */
    ProcessesAndThreads = PsaWalkNextProcess(ProcessesAndThreads);
  } while(ProcessesAndThreads);
 
Bail:
  return Status;
}

Referenced by PsaEnumerateProcessesAndThreads(), PsaWalkProcesses(), and PsaWalkThreads().

PsaWalkSystemModules()

NTSTATUS NTAPI PsaWalkSystemModules	(	IN PRTL_PROCESS_MODULES	SystemModules,
		IN PSYSMOD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 154 of file drivers.c.

{
  ULONG i;
  NTSTATUS Status;
 
  /* repeat until all modules have been returned */
  for(i = 0; i < SystemModules->NumberOfModules; i++)
  {
    /* return current module to the callback */
    Status = Callback(&(SystemModules->Modules[i]), CallbackContext);
 
    if(!NT_SUCCESS(Status))
    {
      return Status;
    }
  }
 
  return STATUS_SUCCESS;
}

Referenced by PsaEnumerateSystemModules().

PsaWalkThreads()

NTSTATUS NTAPI PsaWalkThreads	(	IN PSYSTEM_PROCESS_INFORMATION	ProcessesAndThreads,
		IN PTHREAD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 206 of file processes.c.

{
  return PsaWalkProcessesAndThreads(ProcessesAndThreads,
                                    NULL,
                                    NULL,
                                   Callback,
                                   CallbackContext);
}