Include dependency graph for psfuncs.h:
This graph shows which files directly or indirectly include this file:
Go to the source code of this file.
Function Documentation
◆ _In_reads_bytes_()
| _In_ THREADINFOCLASS _In_reads_bytes_ | ( | ThreadInformationLength | ) |
◆ _IRQL_requires_max_()
| _IRQL_requires_max_ | ( | PASSIVE_LEVEL | ) |
Queries information details about a security descriptor.
Computes the quota size of a security descriptor.
Assigns a security descriptor for a new object.
An extended function that assigns a security descriptor for a new object.
Frees a security descriptor.
An extended function that sets new information data to a security descriptor.
Modifies some information data about a security descriptor.
- Parameters
-
[in] SecurityInformation Security information details to be queried from a security descriptor. [out] SecurityDescriptor The returned security descriptor with security information data. [in,out] Length The returned length of a security descriptor. [in,out] ObjectsSecurityDescriptor The returned object security descriptor.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.
- Parameters
-
[in] Object If specified, the function will use this arbitrary object that points to an object security descriptor. [in] SecurityInformation Security information details to be set. [in] SecurityDescriptor A security descriptor where its info is to be changed. [in,out] ObjectsSecurityDescriptor The returned pointer to security descriptor objects. [in] PoolType Pool type for the new security descriptor to allocate. [in] GenericMapping The generic mapping of access rights masks.
- Returns
- See SeSetSecurityDescriptorInfoEx.
- Parameters
-
[in] Object If specified, the function will use this arbitrary object that points to an object security descriptor. [in] SecurityInformation Security information details to be set. [in] SecurityDescriptor A security descriptor where its info is to be changed. [in,out] ObjectsSecurityDescriptor The returned pointer to security descriptor objects. [in] AutoInheritFlags Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place. [in] PoolType Pool type for the new security descriptor to allocate. [in] GenericMapping The generic mapping of access rights masks.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.
- Parameters
-
[in] SecurityDescriptor A security descriptor to be freed from memory.
- Returns
- Returns STATUS_SUCCESS.
- Parameters
-
[in] _ParentDescriptor A security descriptor of the parent object that is being created. [in] _ExplicitDescriptor An explicit security descriptor that is applied to a new object. [out] NewDescriptor The new allocated security descriptor. [in] ObjectType The type of the new object. [in] IsDirectoryObject Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE. [in] AutoInheritFlags Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited. [in] SubjectContext Security subject context of the new object. [in] GenericMapping Generic mapping of access mask rights. [in] PoolType This parameter is unused.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.
- Parameters
-
[in] ParentDescriptor A security descriptor of the parent object that is being created. [in] ExplicitDescriptor An explicit security descriptor that is applied to a new object. [out] NewDescriptor The new allocated security descriptor. [in] IsDirectoryObject Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE. [in] SubjectContext Security subject context of the new object. [in] GenericMapping Generic mapping of access mask rights. [in] PoolType This parameter is unused.
- Returns
- See SeAssignSecurityEx.
- Parameters
-
[in] SecurityDescriptor A security descriptor. [out] QuotaInfoSize The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.
- Returns
- Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.
Definition at line 923 of file Messaging.c.
75{
76 PFLT_SERVER_PORT_OBJECT PortObject;
78
79 /* The caller must allow at least one connection */
81 {
83 }
84
85 /* The request must be for a kernel handle */
87 {
89 }
90
91 /*
92 * Get rundown protection on the target to stop the owner
93 * from unloading whilst this port object is open. It gets
94 * removed in the FltpServerPortClose callback
95 */
98 {
100 }
101
102 /* Create the server port object for this filter */
104 ServerPortObjectType,
105 ObjectAttributes,
106 KernelMode,
107 NULL,
109 0,
110 0,
111 (PVOID *)&PortObject);
113 {
114 /* Zero out the struct */
116
117 /* Increment the ref count on the target filter */
119
120 /* Setup the filter port object */
127
128 /* Insert the object */
130 NULL,
132 0,
133 NULL,
136 {
137 /* Lock the connection list */
139
140 /* Add the new port object to the connection list and increment the count */
143
144 /* Unlock the connection list*/
146 }
147 }
148
150 {
151 /* Allow the filter to be cleaned up */
153 }
154
156}
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback
Definition: fltkernel.h:1877
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback
Definition: fltkernel.h:1875
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID ServerPortCookie
Definition: fltkernel.h:1874
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback
Definition: fltkernel.h:1876
ULONG FltpObjectPointerReference(_In_ PFLT_OBJECT Object)
Definition: Object.c:322
Definition: nsiface.idl:2307
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
Definition: obhandle.c:2935
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
Definition: oblife.c:1039
Definition: fltmgrint.h:26
Definition: fltmgrint.h:189
PFLT_DISCONNECT_NOTIFY DisconnectNotify
Definition: fltmgrint.h:192
◆ NtAlertResumeThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtAlertResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ NtAlertThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtAlertThread | ( | _In_ HANDLE | ThreadHandle | ) |
◆ NtApphelpCacheControl()
| NTSYSCALLAPI NTSTATUS NTAPI NtApphelpCacheControl | ( | _In_ APPHELPCACHESERVICECLASS | Service, |
| _In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP | ServiceData | ||
| ) |
Definition at line 728 of file apphelp.c.
731{
735
737 {
740 }
742 {
748 break;
754 break;
759 {
763 }
764 break;
766 /* FIXME: Check for admin or system here. */
768 break;
771 break;
774 ApphelpCacheFlush();
777 break;
781 break;
782 default:
784 break;
785 }
787 {
789 }
791}
NTSTATUS ApphelpCacheRemoveEntry(_In_ PUNICODE_STRING ImageName)
Definition: apphelp.c:587
VOID ApphelpFreeUnicodeString(_Inout_ PUNICODE_STRING String)
Definition: apphelp.c:161
NTSTATUS ApphelpCacheUpdateEntry(_In_ PUNICODE_STRING ImageName, _In_ HANDLE ImageHandle)
Definition: apphelp.c:616
NTSTATUS ApphelpValidateData(_In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP ServiceData, _Out_ PUNICODE_STRING ImageName, _Out_ PHANDLE ImageHandle)
Definition: apphelp.c:474
NTSTATUS ApphelpCacheLookupEntry(_In_ PUNICODE_STRING ImageName, _In_ HANDLE ImageHandle)
Definition: apphelp.c:531
Definition: env_spec_w32.h:368
Referenced by BaseDumpAppcompatCache(), BaseFlushAppcompatCache(), BasepShimCacheRemoveEntry(), BasepShimCacheSearch(), and CallApphelp().
◆ NtAssignProcessToJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtAssignProcessToJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ HANDLE | ProcessHandle | ||
| ) |
◆ NtCreateJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateJobObject | ( | _Out_ PHANDLE | JobHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes | ||
| ) |
◆ NtCreateJobSet()
| NTSTATUS NTAPI NtCreateJobSet | ( | _In_ ULONG | NumJob, |
| _In_ PJOB_SET_ARRAY | UserJobSet, | ||
| _In_ ULONG | Flags | ||
| ) |
◆ NtCreateProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ BOOLEAN | InheritObjectTable, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort | ||
| ) |
◆ NtCreateProcessEx()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcessEx | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ ULONG | Flags, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort, | ||
| _In_ BOOLEAN | InJob | ||
| ) |
◆ NtCreateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ProcessHandle, | ||
| _Out_ PCLIENT_ID | ClientId, | ||
| _In_ PCONTEXT | ThreadContext, | ||
| _In_ PINITIAL_TEB | UserStack, | ||
| _In_ BOOLEAN | CreateSuspended | ||
| ) |
◆ NtCurrentTeb()
| FORCEINLINE struct _TEB * NtCurrentTeb | ( | VOID | ) |
Definition at line 420 of file psfuncs.h.
421{
422#if defined(_M_IX86)
424#elif defined (_M_AMD64)
426#elif defined (_M_ARM)
427 // return (struct _TEB *)KeGetPcr()->Used_Self;
429#elif defined (_M_ARM64)
430 //UNIMPLEMENTED;
431 return 0;
432// #elif defined(_M_PPC)
433// return (struct _TEB *)_read_teb_dword(0x18);
434#else
435#error Unsupported architecture
436#endif
437}
PPC_QUAL unsigned long __readfsdword(const unsigned long Offset)
Definition: intrin_ppc.h:382
Definition: compat.h:710
Definition: compat.h:836
◆ NtImpersonateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtImpersonateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ HANDLE | ThreadToImpersonate, | ||
| _In_ PSECURITY_QUALITY_OF_SERVICE | SecurityQualityOfService | ||
| ) |
◆ NtIsProcessInJob()
| NTSYSCALLAPI NTSTATUS NTAPI NtIsProcessInJob | ( | _In_ HANDLE | ProcessHandle, |
| _In_opt_ HANDLE | JobHandle | ||
| ) |
◆ NtOpenProcess()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_opt_ PCLIENT_ID | ClientId | ||
| ) |
◆ NtOpenProcessToken()
| _Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcessToken | ( | _In_ HANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
◆ NtOpenThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ PCLIENT_ID | ClientId | ||
| ) |
◆ NtOpenThreadToken()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadToken | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Opens a token that is tied to a thread handle.
- Parameters
-
[out] ThreadHandle Thread handle where the token is about to be opened. [in] DesiredAccess The request access right for the token. [in] OpenAsSelf If set to TRUE, the access check will be made with the security context of the process of the calling thread (opening as self). Otherwise the access check will be made with the security context of the calling thread instead. [out] TokenHandle The opened token handle returned to the caller for use.
- Returns
- See NtOpenThreadTokenEx.
Definition at line 2474 of file token.c.
2479{
2481 TokenHandle);
2482}
NTSTATUS NTAPI NtOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2331
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2658
◆ NtOpenThreadTokenEx()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadTokenEx | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _In_ ULONG | HandleAttributes, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Opens a token that is tied to a thread handle.
- Parameters
-
[out] ThreadHandle Thread handle where the token is about to be opened. [in] DesiredAccess The request access right for the token. [in] OpenAsSelf If set to TRUE, the access check will be made with the security context of the process of the calling thread (opening as self). Otherwise the access check will be made with the security context of the calling thread instead. [in] HandleAttributes Handle attributes for the opened thread token handle. [out] TokenHandle The opened token handle returned to the caller for use.
- Returns
- Returns STATUS_SUCCESS if the function has successfully opened the thread token. STATUS_CANT_OPEN_ANONYMOUS is returned if a token has SecurityAnonymous as impersonation level and we cannot open it. A failure NTSTATUS code is returned otherwise.
Definition at line 2331 of file token.c.
2337{
2339 HANDLE hToken;
2347
2348 PAGED_CODE();
2349
2351
2352 /* Ensure that we can give the handle to the caller */
2354 {
2355 _SEH2_TRY
2356 {
2358 }
2360 {
2361 /* Return the exception code */
2363 }
2364 _SEH2_END;
2365 }
2366
2367 /* Validate object attributes */
2369
2370 /*
2371 * At first open the thread token for information access and verify
2372 * that the token associated with the thread is valid.
2373 */
2376 NULL);
2378 {
2381 }
2382
2383 /* Reference the token from the thread */
2385 &ImpersonationLevel);
2387 {
2391 }
2392
2393 /* Ensure the token has no anonymous security */
2395 {
2400 }
2401
2402 /* Revert to self if OpenAsSelf is specified */
2404 {
2406 &ImpersonationState);
2407 }
2408
2409 /* Call the private function to do the job */
2411 ThreadHandle,
2412 Token,
2413 DesiredAccess,
2414 HandleAttributes,
2415 EffectiveOnly,
2416 CopyOnOpen,
2417 ImpersonationLevel,
2418 PreviousMode,
2419 &hToken);
2420
2421 /* Restore the impersonation back if needed */
2422 if (RestoreImpersonation)
2423 {
2425 }
2426
2427 /* Dereference the access token and the associated thread */
2430
2432 {
2435 }
2436
2437 /* Give the opened token handle to the caller */
2438 _SEH2_TRY
2439 {
2440 *TokenHandle = hToken;
2441 }
2443 {
2445 }
2446 _SEH2_END;
2447
2449}
Definition: tokenizer.hpp:28
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG HandleAttributes
Definition: obfuncs.h:433
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN EffectiveOnly
Definition: sefuncs.h:410
BOOLEAN NTAPI PsDisableImpersonation(IN PETHREAD Thread, OUT PSE_IMPERSONATION_STATE ImpersonationState)
Definition: security.c:937
VOID NTAPI PsRestoreImpersonation(IN PETHREAD Thread, IN PSE_IMPERSONATION_STATE ImpersonationState)
Definition: security.c:987
PACCESS_TOKEN NTAPI PsReferenceImpersonationToken(IN PETHREAD Thread, OUT PBOOLEAN CopyOnOpen, OUT PBOOLEAN EffectiveOnly, OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
Definition: security.c:871
static NTSTATUS SepOpenThreadToken(_In_ PETHREAD Thread, _In_ HANDLE ThreadHandle, _In_ PTOKEN ThreadToken, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ BOOLEAN EffectiveOnly, _In_ BOOLEAN CopyOnOpen, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _In_ KPROCESSOR_MODE PreviousMode, _Out_ PHANDLE OpenedTokenHandle)
Internal private function that returns an opened handle of an access token associated with a thread.
Definition: token.c:1170
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
Definition: ob_x.h:22
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:494
Definition: pstypes.h:1103
Definition: setypes.h:115
Definition: setypes.h:216
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
Definition: psfuncs.h:156
◆ NtQueryInformationJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _Out_bytecap_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength, | ||
| _Out_ PULONG | ReturnLength | ||
| ) |
◆ NtQueryInformationProcess()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Definition at line 59 of file query.c.
65{
70
71 PAGED_CODE();
72
73 /* Verify Information Class validity */
77 ICIF_PROBE_READ,
78 ProcessInformation,
79 ProcessInformationLength,
80 ReturnLength,
81 NULL,
82 PreviousMode);
84 {
85 DPRINT1("NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n", Status, ProcessInformationClass);
87 }
88
90 (ProcessInformationClass == ProcessImageInformation)) &&
92 {
93 /*
94 * Retrieving the process cookie is only allowed for the calling process
95 * itself! XP only allows NtCurrentProcess() as process handles even if
96 * a real handle actually represents the current process.
97 */
99 }
100
101 /* Check the information class */
102 switch (ProcessInformationClass)
103 {
104 /* Basic process information */
106 {
108
110 {
112 break;
113 }
114
115 /* Set return length */
117
118 /* Reference the process */
121 PsProcessType,
122 PreviousMode,
124 NULL);
126
127 /* Protect writes with SEH */
128 _SEH2_TRY
129 {
130 /* Write all the information from the EPROCESS/KPROCESS */
135 UniqueProcessId;
136 ProcessBasicInfo->InheritedFromUniqueProcessId =
139
140 }
142 {
143 /* Get exception code */
145 }
146 _SEH2_END;
147
148 /* Dereference the process */
150 break;
151 }
152
153 /* Process quota limits */
155 {
156 QUOTA_LIMITS_EX QuotaLimits;
157 BOOLEAN Extended;
158
161 {
163 break;
164 }
165
166 /* Set return length */
167 Length = ProcessInformationLength;
169
170 /* Reference the process */
173 PsProcessType,
174 PreviousMode,
176 NULL);
178
179 /* Indicate success */
181
183
184 /* Get max/min working set sizes */
185 QuotaLimits.MaximumWorkingSetSize =
187 QuotaLimits.MinimumWorkingSetSize =
189
190 /* Get default time limits */
192
193 /* Is quota block a default one? */
195 {
196 /* Get default pools and pagefile limits */
200 }
201 else
202 {
203 /* Get limits from non-default quota block */
204 QuotaLimits.PagedPoolLimit =
206 QuotaLimits.NonPagedPoolLimit =
208 QuotaLimits.PagefileLimit =
210 }
211
212 /* Get additional information, if needed */
213 if (Extended)
214 {
219
220 /* FIXME: Get the correct information */
221 //QuotaLimits.WorkingSetLimit = (SIZE_T)-1; // Not used on Win2k3, it is set to 0
223 }
224
225 /* Protect writes with SEH */
226 _SEH2_TRY
227 {
229 }
231 {
232 /* Get exception code */
234 }
235 _SEH2_END;
236
237 /* Dereference the process */
239 break;
240 }
241
243 {
245 PROCESS_VALUES ProcessValues;
246
248 {
250 break;
251 }
252
254
255 /* Reference the process */
258 PsProcessType,
259 PreviousMode,
261 NULL);
263
264 /* Query IO counters from the process */
266
267 _SEH2_TRY
268 {
270 }
272 {
273 /* Ignore exception */
274 }
275 _SEH2_END;
276
277 /* Set status to success in any case */
279
280 /* Dereference the process */
282 break;
283 }
284
285 /* Timing */
287 {
290
291 /* Set the return length */
293 {
295 break;
296 }
297
299
300 /* Reference the process */
303 PsProcessType,
304 PreviousMode,
306 NULL);
308
309 /* Protect writes with SEH */
310 _SEH2_TRY
311 {
312 /* Copy time information from EPROCESS/KPROCESS */
318 }
320 {
321 /* Get exception code */
323 }
324 _SEH2_END;
325
326 /* Dereference the process */
328 break;
329 }
330
331 /* Process Debug Port */
333
335 {
337 break;
338 }
339
340 /* Set return length */
342
343 /* Reference the process */
346 PsProcessType,
347 PreviousMode,
349 NULL);
351
352 /* Protect write with SEH */
353 _SEH2_TRY
354 {
355 /* Return whether or not we have a debug port */
358 }
360 {
361 /* Get exception code */
363 }
364 _SEH2_END;
365
366 /* Dereference the process */
368 break;
369
371 {
372 ULONG HandleCount;
373
375 {
377 break;
378 }
379
380 /* Set the return length*/
382
383 /* Reference the process */
386 PsProcessType,
387 PreviousMode,
389 NULL);
391
392 /* Count the number of handles this process has */
394
395 /* Protect write in SEH */
396 _SEH2_TRY
397 {
398 /* Return the count of handles */
399 *(PULONG)ProcessInformation = HandleCount;
400 }
402 {
403 /* Get the exception code */
405 }
406 _SEH2_END;
407
408 /* Dereference the process */
410 break;
411 }
412
413 /* Session ID for the process */
415 {
417
419 {
421 break;
422 }
423
424 /* Set the return length*/
426
427 /* Reference the process */
430 PsProcessType,
431 PreviousMode,
433 NULL);
435
436 /* Enter SEH for write safety */
437 _SEH2_TRY
438 {
439 /* Write back the Session ID */
441 }
443 {
444 /* Get the exception code */
446 }
447 _SEH2_END;
448
449 /* Dereference the process */
451 break;
452 }
453
454 /* Virtual Memory Statistics */
456 {
458
459 /* Validate the input length */
462 {
464 break;
465 }
466
467 /* Reference the process */
470 PsProcessType,
471 PreviousMode,
473 NULL);
475
476 /* Enter SEH for write safety */
477 _SEH2_TRY
478 {
479 /* Return data from EPROCESS */
491 //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
492 //
493
494 /* Set the return length */
495 Length = ProcessInformationLength;
496 }
498 {
499 /* Get the exception code */
501 }
502 _SEH2_END;
503
504 /* Dereference the process */
506 break;
507 }
508
509 /* Hard Error Processing Mode */
511
513 {
515 break;
516 }
517
518 /* Set the return length*/
520
521 /* Reference the process */
524 PsProcessType,
525 PreviousMode,
527 NULL);
529
530 /* Enter SEH for writing back data */
531 _SEH2_TRY
532 {
533 /* Write the current processing mode */
535 DefaultHardErrorProcessing;
536 }
538 {
539 /* Get the exception code */
541 }
542 _SEH2_END;
543
544 /* Dereference the process */
546 break;
547
548 /* Priority Boosting status */
550
552 {
554 break;
555 }
556
557 /* Set the return length */
559
560 /* Reference the process */
563 PsProcessType,
564 PreviousMode,
566 NULL);
568
569 /* Enter SEH for writing back data */
570 _SEH2_TRY
571 {
572 /* Return boost status */
575 }
577 {
578 /* Get the exception code */
580 }
581 _SEH2_END;
582
583 /* Dereference the process */
585 break;
586
587 /* DOS Device Map */
589 {
591
593 {
594 /* Protect read in SEH */
595 _SEH2_TRY
596 {
597 PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
598
600 }
602 {
603 /* Get the exception code */
606 }
607 _SEH2_END;
608
609 /* Only one flag is supported and it needs LUID mappings */
611 !ObIsLUIDDeviceMapsEnabled())
612 {
614 break;
615 }
616 }
617 else
618 {
619 /* This has to be the size of the Query union field for x64 compatibility! */
621 {
623 break;
624 }
625
626 /* No flags for standard call */
627 Flags = 0;
628 }
629
630 /* Set the return length */
631 Length = ProcessInformationLength;
632
633 /* Reference the process */
636 PsProcessType,
637 PreviousMode,
639 NULL);
641
642 /* Query the device map information */
644 ProcessInformation,
645 Flags);
646
647 /* Dereference the process */
649 break;
650 }
651
652 /* Priority class */
654 {
656
658 {
660 break;
661 }
662
663 /* Set the return length*/
665
666 /* Reference the process */
669 PsProcessType,
670 PreviousMode,
672 NULL);
674
675 /* Enter SEH for writing back data */
676 _SEH2_TRY
677 {
678 /* Return current priority class */
681 }
683 {
684 /* Get the exception code */
686 }
687 _SEH2_END;
688
689 /* Dereference the process */
691 break;
692 }
693
695 {
697
698 /* Reference the process */
701 PsProcessType,
702 PreviousMode,
704 NULL);
706
707 /* Get the image path */
710 {
711 /* Set return length */
714
715 /* Make sure it's large enough */
717 {
718 /* Enter SEH to protect write */
719 _SEH2_TRY
720 {
721 /* Copy it */
722 RtlCopyMemory(ProcessInformation,
723 ImageName,
724 Length);
725
726 /* Update pointer */
727 ((PUNICODE_STRING)ProcessInformation)->Buffer =
729 }
731 {
732 /* Get the exception code */
734 }
735 _SEH2_END;
736 }
737 else
738 {
739 /* Buffer too small */
741 }
742
743 /* Free the image path */
745 }
746 /* Dereference the process */
748 break;
749 }
750
752
754 {
756 break;
757 }
758
759 /* Set the return length*/
761
762 /* Reference the process */
765 PsProcessType,
766 PreviousMode,
768 NULL);
770
771 /* Enter SEH for writing back data */
772 _SEH2_TRY
773 {
774 /* Return the debug flag state */
776 }
778 {
779 /* Get the exception code */
781 }
782 _SEH2_END;
783
784 /* Dereference the process */
786 break;
787
789
791 {
793 break;
794 }
795
796 /* Set the return length */
798
799 /* Reference the process */
802 PsProcessType,
803 PreviousMode,
805 NULL);
807
808 /* Enter SEH for writing back data */
809 _SEH2_TRY
810 {
811 /* Return the BreakOnTermination state */
813 }
815 {
816 /* Get the exception code */
818 }
819 _SEH2_END;
820
821 /* Dereference the process */
823 break;
824
825 /* Per-process security cookie */
827 {
829
831 {
832 /* Length size wrong, bail out */
834 break;
835 }
836
837 /* Get the current process and cookie */
841 {
842 LARGE_INTEGER SystemTime;
843 ULONG NewCookie;
844 PKPRCB Prcb;
845
846 /* Generate a new cookie */
847 KeQuerySystemTime(&SystemTime);
848 Prcb = KeGetCurrentPrcb();
851
852 /* Set the new cookie or return the current one */
854 NewCookie,
855 Cookie);
857
858 /* Set return length */
860 }
861
862 /* Indicate success */
864
865 /* Enter SEH to protect write */
866 _SEH2_TRY
867 {
868 /* Write back the cookie */
870 }
872 {
873 /* Get the exception code */
875 }
876 _SEH2_END;
877 break;
878 }
879
881
883 {
884 /* Break out */
886 break;
887 }
888
889 /* Set the length required and validate it */
891
892 /* Enter SEH to protect write */
893 _SEH2_TRY
894 {
896 }
898 {
899 /* Get the exception code */
901 }
902 _SEH2_END;
903
904 /* Indicate success */
906 break;
907
909 {
910 HANDLE DebugPort = 0;
911
913 {
915 break;
916 }
917
918 /* Set the return length */
920
921 /* Reference the process */
924 PsProcessType,
925 PreviousMode,
927 NULL);
929
930 /* Get the debug port */
932
933 /* Let go of the process */
935
936 /* Protect write in SEH */
937 _SEH2_TRY
938 {
939 /* Return debug port's handle */
940 *(PHANDLE)ProcessInformation = DebugPort;
941 }
943 {
944 /* Get the exception code */
946 }
947 _SEH2_END;
948 break;
949 }
950
954 break;
955
957
959 {
961 break;
962 }
963
964 /* Set the return length */
966
967 /* Indicate success */
969
970 /* Protect write in SEH */
971 _SEH2_TRY
972 {
973 /* Query Ob */
975 }
977 {
978 /* Get the exception code */
980 }
981 _SEH2_END;
982 break;
983
985
987 {
989 break;
990 }
991
992 /* Set the return length */
994
995 /* Reference the process */
998 PsProcessType,
999 PreviousMode,
1001 NULL);
1003
1004 /* Protect write in SEH */
1005 _SEH2_TRY
1006 {
1007 /* Return if the flag is set */
1009 }
1011 {
1012 /* Get the exception code */
1014 }
1015 _SEH2_END;
1016
1017 /* Dereference the process */
1019 break;
1020
1022 {
1023 ULONG_PTR Wow64 = 0;
1024
1026 {
1028 break;
1029 }
1030
1031 /* Set return length */
1033
1034 /* Reference the process */
1037 PsProcessType,
1038 PreviousMode,
1040 NULL);
1042
1043 /* Make sure the process isn't dying */
1045 {
1046 /* Get the WOW64 process structure */
1047#ifdef _WIN64
1049#else
1050 Wow64 = 0;
1051#endif
1052 /* Release the lock */
1054 }
1055
1056 /* Protect write with SEH */
1057 _SEH2_TRY
1058 {
1059 /* Return whether or not we have a debug port */
1060 *(PULONG_PTR)ProcessInformation = Wow64;
1061 }
1063 {
1064 /* Get exception code */
1066 }
1067 _SEH2_END;
1068
1069 /* Dereference the process */
1071 break;
1072 }
1073
1075 {
1076 ULONG ExecuteOptions = 0;
1077
1079 {
1081 break;
1082 }
1083
1084 /* Set return length */
1086
1088 {
1090 }
1091
1092 /* Get the options */
1095 {
1096 /* Protect write with SEH */
1097 _SEH2_TRY
1098 {
1099 /* Return them */
1100 *(PULONG)ProcessInformation = ExecuteOptions;
1101 }
1103 {
1104 /* Get exception code */
1106 }
1107 _SEH2_END;
1108 }
1109 break;
1110 }
1111
1115 break;
1116
1120 break;
1121
1125 break;
1126
1127 /* Not supported by Server 2003 */
1128 default:
1131 }
1132
1133 /* Protect write with SEH */
1134 _SEH2_TRY
1135 {
1136 /* Check if caller wanted return length */
1138 }
1140 {
1141 /* Get exception code */
1143 }
1144 _SEH2_END;
1145
1147}
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
Definition: dbgkobj.c:1526
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
struct _VM_COUNTERS_ * PVM_COUNTERS
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
struct _VM_COUNTERS_EX VM_COUNTERS_EX
struct _IO_COUNTERS * PIO_COUNTERS
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
Definition: procobj.c:860
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
Definition: procobj.c:525
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
Definition: section.c:1615
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
Definition: pagfault.c:2653
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
Definition: probe.h:219
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
Definition: process.c:1163
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
Definition: audit.c:199
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
Definition: obhandle.c:56
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
Definition: devicemap.c:539
Definition: pstypes.h:1262
Definition: pstypes.h:82
Definition: winternl.h:1059
Definition: ketypes.h:649
Definition: winternl.h:402
ULONG_PTR InheritedFromUniqueProcessId
Definition: pstypes.h:340
Definition: pstypes.h:370
Definition: pstypes.h:358
Definition: pstypes.h:956
Definition: pstypes.h:383
Definition: ke.h:45
Definition: pstypes.h:67
Definition: lsa.idl:286
Definition: mmtypes.h:340
Definition: mmdrv.h:130
Definition: winternl.h:1604
SIZE_T QuotaPeakNonPagedPoolUsage
Definition: winternl.h:1612
Definition: typedefs.h:103
struct _LARGE_INTEGER::@2306 u
◆ NtQueryInformationThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_ PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
◆ NtRegisterThreadTerminatePort()
| NTSYSCALLAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort | ( | _In_ HANDLE | TerminationPort | ) |
◆ NtResumeProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtResumeProcess | ( | _In_ HANDLE | ProcessHandle | ) |
◆ NtResumeThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ NtSetInformationJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _In_bytecount_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength | ||
| ) |
◆ NtSetInformationProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
◆ NtSetInformationThread()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _In_reads_bytes_(ThreadInformationLength) PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength | ||
| ) |
◆ NtSuspendProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtSuspendProcess | ( | _In_ HANDLE | ProcessHandle | ) |
◆ NtSuspendThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtSuspendThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ PULONG | PreviousSuspendCount | ||
| ) |
◆ NtTerminateJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ NtTerminateProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ NtTerminateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ PsChargePoolQuota()
| NTKERNELAPI VOID NTAPI PsChargePoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the PoolType parameter.
- Parameters
-
[in] Process The process which quota is to be charged. [in] PoolType The pool type to choose to charge quotas (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to charge into a process.
- Returns
- Nothing.
- Remarks
- The function raises an exception if STATUS_QUOTA_EXCEEDED status code is returned. Callers are responsible on their own to handle the raised exception.
Definition at line 775 of file quota.c.
779{
782
783 /* Don't do anything for the system process */
785
786 /* Charge the usage */
789}
NTSTATUS NTAPI PsChargeProcessPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
Definition: quota.c:872
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
Definition: wdfdevice.h:3815
Referenced by FsRtlCancelNotify(), and FsRtlNotifyFilterReportChange().
◆ PsChargeProcessNonPagedPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Charges the non paged pool quota of a given process.
- Parameters
-
[in] Process The process which non paged quota is to be charged. [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 811 of file quota.c.
814{
815 /* Call the general function */
817}
Referenced by MiCreatePebOrTeb(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), NtAllocateVirtualMemory(), NtFreeVirtualMemory(), and START_TEST().
◆ PsChargeProcessPagedPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Charges the paged pool quota of a given process.
- Parameters
-
[in] Process The process which paged quota is to be charged. [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 839 of file quota.c.
842{
843 /* Call the general function */
845}
Referenced by ExpAllocateHandleTable(), ExpAllocateTablePagedPool(), ExpAllocateTablePagedPoolNoZero(), and START_TEST().
◆ PsChargeProcessPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
- Parameters
-
[in] Process The process which quota is to be charged. [in] PoolType The type of quota pool to charge (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 872 of file quota.c.
876{
877 /* Don't do anything for the system process */
879
881 Process->QuotaBlock,
883 Amount);
884}
NTSTATUS NTAPI PspChargeProcessQuotaSpecifiedPool(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ PS_QUOTA_TYPE QuotaType, _In_ SIZE_T Amount)
Internal kernel function that provides the bulk logic of process quota charging, necessary for export...
Definition: quota.c:195
Referenced by ExAllocatePoolWithQuotaTag(), PsChargePoolQuota(), PsChargeProcessNonPagedPoolQuota(), and PsChargeProcessPagedPoolQuota().
◆ PsEstablishWin32Callouts()
| NTKERNELAPI VOID NTAPI PsEstablishWin32Callouts | ( | _In_ PWIN32_CALLOUTS_FPNS | CalloutData | ) |
◆ PsGetCurrentProcessSessionId()
| NTKERNELAPI ULONG NTAPI PsGetCurrentProcessSessionId | ( | VOID | ) |
Definition at line 1133 of file process.c.
1134{
1136}
Referenced by ExpWin32SessionCallout(), IntCreateDesktop(), IntDestroyMenuObject(), NtSetInformationObject(), NtUserSwitchDesktop(), ObpLookupObjectName(), and VideoPortUseDeviceInSession().
◆ PsGetCurrentProcessWin32Process()
| NTKERNELAPI PVOID NTAPI PsGetCurrentProcessWin32Process | ( | VOID | ) |
Definition at line 1183 of file process.c.
Referenced by _Function_class_(), CheckWinstaAttributeAccess(), co_IntGraphicsCheck(), co_IntSetParent(), co_IntSetWindowLongPtr(), co_IntUserManualGuiCheck(), co_UserDestroyWindow(), DC_bAllocDcAttr(), DC_vFreeDcAttr(), DecrementCurrentProcessGdiHandleCount(), DesktopHeapAddressToUser(), DesktopHeapGetUserDelta(), FontLink_PrepareFontInfo(), GDI_CleanupForProcess(), GetBrushAttrPool(), GetControlColor(), GetFontFamilyInfoForSubstitutes(), GetW32ProcessInfo(), handle_internal_message(), IdlePing(), IdlePong(), IncrementCurrentProcessGdiHandleCount(), IntAllowSetForegroundWindow(), IntGdiAddFontMemResource(), IntGdiCleanupPrivateFontsForProcess(), IntGdiLoadFontsFromMemory(), IntGdiRemoveFontMemResource(), IntGdiSetRegionOwner(), IntGetFontFamilyInfo(), IntLoadHookModule(), IntLoadSystenIcons(), IntLockSetForegroundWindow(), IntMapDesktopView(), IntUnmapDesktopView(), IntWinStaOkToClose(), NtUserCallHwndParam(), NtUserCallOneParam(), NtUserDestroyCursor(), NtUserFindExistingCursorIcon(), NtUserGetComboBoxInfo(), NtUserGetListBoxInfo(), NtUserSetSystemCursor(), NtUserSetWindowFNID(), REGION_bAllocRgnAttr(), REGION_vCleanup(), TextIntRealizeFont(), UserDbgAssertThreadInfo(), UserGetDCEx(), UserGetProcessWindowStation(), UserHeapAddressToUser(), UserSetProcessWindowStation(), UserSystemParametersInfo(), and UserUnregisterUserApiHook().
◆ PsGetCurrentThreadProcessId()
| NTKERNELAPI HANDLE NTAPI PsGetCurrentThreadProcessId | ( | VOID | ) |
Definition at line 755 of file thread.c.
Referenced by intDdCreateDirectDrawLocal().
◆ PsGetCurrentThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsGetCurrentThreadWin32Thread | ( | VOID | ) |
Definition at line 805 of file thread.c.
Referenced by AllocateUserMessage(), CaretSystemTimerProc(), co_HOOK_CallHooks(), co_IntActivateKeyboardLayout(), co_IntCallHookProc(), co_IntCallSentMessageCallback(), co_IntCallWindowProc(), co_IntClientLoadLibrary(), co_IntClientThreadSetup(), co_IntCreateDefaultImeWindow(), co_IntFixCaret(), co_IntGetPeekMessage(), co_IntLoadDefaultCursors(), co_IntLoadSysMenuTemplate(), co_IntPaintWindows(), co_IntPeekMessage(), co_IntProcessKeyboardMessage(), co_IntProcessMouseMessage(), co_IntSendActivateMessages(), co_IntSendMessageTimeoutSingle(), co_IntSendMessageWithCallBack(), co_IntSetActiveWindow(), co_IntSetCaretPos(), co_IntSetForegroundAndFocusWindow(), co_IntWaitMessage(), co_MsqDispatchOneSentMessage(), co_MsqReplyMessage(), co_MsqSendMessage(), co_MsqSendMessageAsync(), co_UserDestroyWindow(), co_UserHideCaret(), co_UserSetCapture(), co_UserSetFocus(), co_UserShowCaret(), co_WinPosSearchChildren(), co_WinPosSetWindowPos(), co_WinPosShowWindow(), DECREASE_THREAD_LOCK_COUNT(), DefWndDoSizeMove(), DefWndStartSizeMove(), DesktopHeapGetUserDelta(), DesktopThreadMain(), GetW32ThreadInfo(), handle_internal_message(), IdlePing(), INCREASE_THREAD_LOCK_COUNT(), IntAddAtom(), IntCallWndProc(), IntCallWndProcRet(), IntCbAllocateMemory(), IntCbFreeMemory(), IntCreateDesktop(), IntDeactivateWindow(), IntDefWindowProc(), IntDeRegisterShellHookWindow(), IntDesktopOkToClose(), IntDestroyOwnedWindows(), IntDispatchMessage(), IntDrawScrollBar(), IntGetAndReferenceClass(), IntGetAtomName(), IntGetCapture(), IntGetCurrentThreadDesktopWindow(), IntGetImeCompatFlags(), IntGetNextHook(), IntGetQueueStatus(), IntGetThreadDesktopWindow(), IntGetThreadFocusWindow(), IntInitMessagePumpHook(), IntInvalidateWindows(), IntIsClipboardOpenByMe(), IntMsqClearWakeMask(), IntMsqSetWakeMask(), IntNotifyImeShowStatus(), IntNotifyWinEvent(), IntQueryTrackMouseEvent(), IntRegisterShellHookWindow(), IntReleaseCapture(), IntRemoveHook(), IntSendDestroyMsg(), IntSendSyncPaint(), IntSetThreadDesktop(), IntSetTimer(), IntTrackMouseEvent(), IntTrackPopupMenuEx(), IntTranslateKbdMessage(), IntUnhookWindowsHook(), IntUninitMessagePumpHook(), IntUserSetActiveWindow(), MENU_DoNextMenu(), MENU_InitTracking(), MENU_TrackMenu(), MsqGetMessageExtraInfo(), MsqSetMessageExtraInfo(), NtUserBlockInput(), NtUserCallNoParam(), NtUserCallOneParam(), NtUserCallTwoParam(), NtUserCreateAcceleratorTable(), NtUserCreateCaret(), NtUserGetAppImeLevel(), NtUserGetCaretPos(), NtUserGetGUIThreadInfo(), NtUserGetKeyboardLayoutName(), NtUserGetKeyboardState(), NtUserGetKeyNameText(), NtUserGetThreadState(), NtUserLockWorkStation(), NtUserMapVirtualKeyEx(), NtUserQueryWindow(), NtUserSendInput(), NtUserSetAppImeLevel(), NtUserSetKeyboardState(), NtUserSetThreadState(), NtUserSetWindowsHookEx(), NtUserSetWinEventHook(), NtUserToUnicodeEx(), NtUserValidateTimerCallback(), NtUserVkKeyScanEx(), NtUserWaitForInputIdle(), PostTimerMessages(), UserCreateInputContext(), UserDbgAssertThreadInfo(), UserDerefObjectCo(), UserDestroyMenu(), UserEnterExclusive(), UserGetActiveWindow(), UserGetCPD(), UserGetKeyboardLayout(), UserGetKeyState(), UserGhostThreadEntry(), UserInitialize(), UserOpenClipboard(), UserOpenInputDesktop(), UserRefObjectCo(), UserRegisterHotKey(), UserRegisterUserApiHook(), UserSendKeyboardInput(), UserSendMouseInput(), UserSetActiveWindow(), UserSetCursor(), UserShowCursor(), and UserUnregisterUserApiHook().
◆ PsGetProcessExitProcessCalled()
| NTKERNELAPI BOOLEAN NTAPI PsGetProcessExitProcessCalled | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessExitStatus()
| NTKERNELAPI NTSTATUS NTAPI PsGetProcessExitStatus | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessInheritedFromUniqueProcessId()
◆ PsGetProcessSecurityPort()
| NTKERNELAPI PVOID NTAPI PsGetProcessSecurityPort | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessSessionId()
| NTKERNELAPI ULONG NTAPI PsGetProcessSessionId | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessWin32Process()
| NTKERNELAPI PVOID NTAPI PsGetProcessWin32Process | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessWin32WindowStation()
| NTKERNELAPI PVOID NTAPI PsGetProcessWin32WindowStation | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetThreadFreezeCount()
| NTKERNELAPI ULONG NTAPI PsGetThreadFreezeCount | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadHardErrorsAreDisabled()
| NTKERNELAPI BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadId()
| NTKERNELAPI HANDLE NTAPI PsGetThreadId | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadProcess()
| NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadTeb()
| NTKERNELAPI PTEB NTAPI PsGetThreadTeb | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsGetThreadWin32Thread | ( | _In_ PETHREAD | Thread | ) |
◆ PsIsProtectedProcess()
◆ PsIsSystemProcess()
| NTKERNELAPI BOOLEAN NTAPI PsIsSystemProcess | ( | _In_ PEPROCESS | Process | ) |
◆ PsIsThreadImpersonating()
| NTKERNELAPI BOOLEAN NTAPI PsIsThreadImpersonating | ( | _In_ PETHREAD | Thread | ) |
◆ PsLookupProcessThreadByCid()
| NTKERNELAPI NTSTATUS NTAPI PsLookupProcessThreadByCid | ( | _In_ PCLIENT_ID | Cid, |
| _Out_opt_ PEPROCESS * | Process, | ||
| _Out_ PETHREAD * | Thread | ||
| ) |
◆ PsReturnPoolQuota()
| NTKERNELAPI VOID NTAPI PsReturnPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Returns the pool quota that the process was taking up.
- Parameters
-
[in] Process The process which quota is to be returned. [in] PoolType The type of quota pool to return (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 907 of file quota.c.
911{
912 /* Don't do anything for the system process */
914
916 Process->QuotaBlock,
918 Amount);
919}
VOID NTAPI PspReturnProcessQuotaSpecifiedPool(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ PS_QUOTA_TYPE QuotaType, _In_ SIZE_T Amount)
Internal kernel function that provides the bulk logic of process quota returning. It returns (takes a...
Definition: quota.c:345
Referenced by ExFreePoolWithTag(), ExReturnPoolQuota(), PsReturnProcessNonPagedPoolQuota(), and PsReturnProcessPagedPoolQuota().
◆ PsReturnProcessNonPagedPoolQuota()
| NTKERNELAPI VOID NTAPI PsReturnProcessNonPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Returns the non paged quota pool that the process was taking up.
- Parameters
-
[in] Process The process which non paged quota is to be returned. [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 938 of file quota.c.
941{
942 /* Don't do anything for the system process */
944
946}
VOID NTAPI PsReturnPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Returns the pool quota that the process was taking up.
Definition: quota.c:907
Referenced by MiCreatePebOrTeb(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), MiUnmapLockedPagesInUserSpace(), MiUnmapViewOfSection(), MmCleanProcessAddressSpace(), MmDeleteTeb(), NtAllocateVirtualMemory(), NtFreeVirtualMemory(), PspDeleteProcess(), and START_TEST().
◆ PsReturnProcessPagedPoolQuota()
Returns the paged pool quota that the process was taking up.
- Parameters
-
[in] Process The process which paged pool quota is to be returned. [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 965 of file quota.c.
968{
969 /* Don't do anything for the system process */
971
973}
Referenced by ExpAllocateHandleTable(), ExpFreeHandleTable(), ExpFreeTablePagedPool(), FsRtlCancelNotify(), FsRtlNotifyCleanup(), FsRtlNotifyCompleteIrp(), FsRtlNotifyFilterReportChange(), and START_TEST().
◆ PsRevertThreadToSelf()
| NTKERNELAPI VOID NTAPI PsRevertThreadToSelf | ( | _Inout_ PETHREAD | Thread | ) |
◆ PsSetProcessPriorityByClass()
◆ PsSetProcessSecurityPort()
| NTKERNELAPI NTSTATUS NTAPI PsSetProcessSecurityPort | ( | _Inout_ PEPROCESS | Process, |
| _In_ PVOID | SecurityPort | ||
| ) |
◆ PsSetProcessWin32Process()
| NTKERNELAPI NTSTATUS NTAPI PsSetProcessWin32Process | ( | _Inout_ PEPROCESS | Process, |
| _In_opt_ PVOID | Win32Process, | ||
| _In_opt_ PVOID | OldWin32Process | ||
| ) |
Definition at line 1257 of file process.c.
1261{
1263
1264 /* Assume success */
1266
1267 /* Lock the process */
1268 KeEnterCriticalRegion();
1270
1271 /* Check if we set a new win32 process */
1273 {
1274 /* Check if the process is in the right state */
1277 {
1278 /* Set the new win32 process */
1279 Process->Win32Process = Win32Process;
1280 }
1281 else
1282 {
1283 /* Otherwise fail */
1285 }
1286 }
1287 else
1288 {
1289 /* Reset the win32 process, did the caller specify the correct old value? */
1291 {
1292 /* Yes, so reset the win32 process to NULL */
1294 }
1295 else
1296 {
1297 /* Otherwise fail */
1299 }
1300 }
1301
1302 /* Unlock the process */
1304 KeLeaveCriticalRegion();
1305
1307}
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1039
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1255
Referenced by AllocW32Process(), and ExitProcessCallback().
◆ PsSetProcessWindowStation()
| NTKERNELAPI VOID NTAPI PsSetProcessWindowStation | ( | _Inout_ PEPROCESS | Process, |
| _In_opt_ PVOID | WindowStation | ||
| ) |
◆ PsSetThreadHardErrorsAreDisabled()
| NTKERNELAPI VOID NTAPI PsSetThreadHardErrorsAreDisabled | ( | _Inout_ PETHREAD | Thread, |
| _In_ BOOLEAN | Disabled | ||
| ) |
◆ PsSetThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsSetThreadWin32Thread | ( | _Inout_ PETHREAD | Thread, |
| _In_opt_ PVOID | Win32Thread, | ||
| _In_opt_ PVOID | OldWin32Thread | ||
| ) |
◆ ZwAlertResumeThread()
| NTSYSAPI NTSTATUS NTAPI ZwAlertResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ ZwAlertThread()
◆ ZwAssignProcessToJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwAssignProcessToJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ HANDLE | ProcessHandle | ||
| ) |
◆ ZwCreateJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwCreateJobObject | ( | _Out_ PHANDLE | JobHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes | ||
| ) |
◆ ZwCreateProcess()
| NTSYSAPI NTSTATUS NTAPI ZwCreateProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ BOOLEAN | InheritObjectTable, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort | ||
| ) |
Referenced by RtlCreateUserProcess().
◆ ZwCreateThread()
| NTSYSAPI NTSTATUS NTAPI ZwCreateThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ProcessHandle, | ||
| _Out_ PCLIENT_ID | ClientId, | ||
| _In_ PCONTEXT | ThreadContext, | ||
| _In_ PINITIAL_TEB | UserStack, | ||
| _In_ BOOLEAN | CreateSuspended | ||
| ) |
Referenced by RtlCreateUserThread().
◆ ZwImpersonateThread()
| NTSYSAPI NTSTATUS NTAPI ZwImpersonateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ HANDLE | ThreadToImpersonate, | ||
| _In_ PSECURITY_QUALITY_OF_SERVICE | SecurityQualityOfService | ||
| ) |
◆ ZwIsProcessInJob()
◆ ZwOpenThread()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ PCLIENT_ID | ClientId | ||
| ) |
◆ ZwOpenThreadToken()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThreadToken | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Referenced by IntGetCurrentAccessToken(), RtlAdjustPrivilege(), and RtlpOpenThreadToken().
◆ ZwOpenThreadTokenEx()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThreadTokenEx | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _In_ ULONG | HandleAttributes, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Referenced by RtlFormatCurrentUserKeyPath().
◆ ZwQueryInformationJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _Out_bytecap_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength, | ||
| _Out_ PULONG | ReturnLength | ||
| ) |
◆ ZwQueryInformationProcess()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Referenced by lie_about_fs_type(), RtlCreateUserProcess(), RtlEncodePointer(), RtlSetProcessIsCritical(), and START_TEST().
◆ ZwQueryInformationThread()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_ PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Referenced by RtlSetThreadIsCritical().
◆ ZwRegisterThreadTerminatePort()
◆ ZwResumeProcess()
◆ ZwResumeThread()
Referenced by ExpLoadInitialProcess().
◆ ZwSetInformationJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwSetInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _In_ PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength | ||
| ) |
◆ ZwSetInformationProcess()
| NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
Referenced by RtlSetProcessIsCritical().
◆ ZwSuspendProcess()
◆ ZwSuspendThread()
| NTSYSAPI NTSTATUS NTAPI ZwSuspendThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ PULONG | PreviousSuspendCount | ||
| ) |
◆ ZwTerminateJobObject()
◆ ZwTerminateThread()
Referenced by RtlAssert().
Variable Documentation
◆ DesiredAccess
◆ ExitStatus
Definition at line 866 of file psfuncs.h.
Referenced by BaseExitThreadPoolThread(), BaseSrvBSMThread(), CdfsChkdsk(), ChkdskEx(), CsrDereferenceNtSession(), DbgkExitProcess(), DbgkExitThread(), Ext2Chkdsk(), NtfsChkdsk(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), PspExitThread(), PspTerminateProcess(), PspTerminateThreadByPointer(), PsTerminateProcess(), PsTerminateSystemThread(), RtlpExitThread(), test_query_process_basic(), VfatChkdsk(), and VfatxChkdsk().
◆ HandleAttributes
◆ ThreadInformationClass
| _In_ THREADINFOCLASS ThreadInformationClass |
Definition at line 840 of file psfuncs.h.
Referenced by NtQueryInformationThread(), NtSetInformationThread(), NtUserQueryInformationThread(), and NtUserSetInformationThread().
◆ ThreadInformationLength
| _In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength |
Definition at line 842 of file psfuncs.h.
Referenced by NtQueryInformationThread(), NtSetInformationThread(), NtUserSetInformationThread(), and PspQueryDescriptorThread().
◆ TokenHandle
Definition at line 725 of file psfuncs.h.
Referenced by AdjustTokenGroups(), AdjustTokenPrivileges(), BasepReplaceProcessThreadTokens(), CreateDefaultProcessSecurityCommon(), CreateProcessInternalW(), DuplicateTokenAsEffective(), GetCallerLuid(), GetSiteSidFromToken(), GetTokenInformation(), IntGetCurrentAccessToken(), IsPrivilegeEnabled(), IsTokenRestricted(), LogonUserExW(), LsapIsTrustedClient(), LsapLogonUser(), LsarSetSecurityObject(), MyLogonUser(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtCreateToken(), NtOpenProcessToken(), NtOpenProcessTokenEx(), NtOpenThreadToken(), NtOpenThreadTokenEx(), NtQueryInformationToken(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), OpenProcessToken(), OpenThreadToken(), PsAssignImpersonationToken(), PspSetPrimaryToken(), RtlAdjustPrivilege(), RtlCreateUserSecurityObject(), RtlDefaultNpAcl(), RtlFormatCurrentUserKeyPath(), RtlpGetImpersonationToken(), RtlpOpenThreadToken(), RtlRemovePrivileges(), SamrSetSecurityObject(), SepCreateToken(), SepOpenThreadToken(), SetThreadToken(), SetTokenInformation(), SHTestTokenMembership(), and START_TEST().
