Include dependency graph for psfuncs.h:
This graph shows which files directly or indirectly include this file:
Go to the source code of this file.
Function Documentation
◆ _In_reads_bytes_()
| _In_ THREADINFOCLASS _In_reads_bytes_ | ( | ThreadInformationLength | ) |
◆ _IRQL_requires_max_()
| _IRQL_requires_max_ | ( | PASSIVE_LEVEL | ) |
Queries information details about a security descriptor.
Computes the quota size of a security descriptor.
Assigns a security descriptor for a new object.
An extended function that assigns a security descriptor for a new object.
Frees a security descriptor.
An extended function that sets new information data to a security descriptor.
Modifies some information data about a security descriptor.
- Parameters
-
[in] SecurityInformation Security information details to be queried from a security descriptor. [out] SecurityDescriptor The returned security descriptor with security information data. [in,out] Length The returned length of a security descriptor. [in,out] ObjectsSecurityDescriptor The returned object security descriptor.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.
- Parameters
-
[in] Object If specified, the function will use this arbitrary object that points to an object security descriptor. [in] SecurityInformation Security information details to be set. [in] SecurityDescriptor A security descriptor where its info is to be changed. [in,out] ObjectsSecurityDescriptor The returned pointer to security descriptor objects. [in] PoolType Pool type for the new security descriptor to allocate. [in] GenericMapping The generic mapping of access rights masks.
- Returns
- See SeSetSecurityDescriptorInfoEx.
- Parameters
-
[in] Object If specified, the function will use this arbitrary object that points to an object security descriptor. [in] SecurityInformation Security information details to be set. [in] SecurityDescriptor A security descriptor where its info is to be changed. [in,out] ObjectsSecurityDescriptor The returned pointer to security descriptor objects. [in] AutoInheritFlags Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place. [in] PoolType Pool type for the new security descriptor to allocate. [in] GenericMapping The generic mapping of access rights masks.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.
- Parameters
-
[in] SecurityDescriptor A security descriptor to be freed from memory.
- Returns
- Returns STATUS_SUCCESS.
- Parameters
-
[in] _ParentDescriptor A security descriptor of the parent object that is being created. [in] _ExplicitDescriptor An explicit security descriptor that is applied to a new object. [out] NewDescriptor The new allocated security descriptor. [in] ObjectType The type of the new object. [in] IsDirectoryObject Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE. [in] AutoInheritFlags Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited. [in] SubjectContext Security subject context of the new object. [in] GenericMapping Generic mapping of access mask rights. [in] PoolType This parameter is unused.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.
- Parameters
-
[in] ParentDescriptor A security descriptor of the parent object that is being created. [in] ExplicitDescriptor An explicit security descriptor that is applied to a new object. [out] NewDescriptor The new allocated security descriptor. [in] IsDirectoryObject Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE. [in] SubjectContext Security subject context of the new object. [in] GenericMapping Generic mapping of access mask rights. [in] PoolType This parameter is unused.
- Returns
- See SeAssignSecurityEx.
- Parameters
-
[in] SecurityDescriptor A security descriptor. [out] QuotaInfoSize The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.
- Returns
- Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.
Definition at line 923 of file Messaging.c.
75{
76 PFLT_SERVER_PORT_OBJECT PortObject;
78
79 /* The caller must allow at least one connection */
81 {
83 }
84
85 /* The request must be for a kernel handle */
87 {
89 }
90
91 /*
92 * Get rundown protection on the target to stop the owner
93 * from unloading whilst this port object is open. It gets
94 * removed in the FltpServerPortClose callback
95 */
98 {
100 }
101
102 /* Create the server port object for this filter */
104 ServerPortObjectType,
105 ObjectAttributes,
106 KernelMode,
107 NULL,
109 0,
110 0,
111 (PVOID *)&PortObject);
113 {
114 /* Zero out the struct */
116
117 /* Increment the ref count on the target filter */
119
120 /* Setup the filter port object */
127
128 /* Insert the object */
130 NULL,
132 0,
133 NULL,
136 {
137 /* Lock the connection list */
139
140 /* Add the new port object to the connection list and increment the count */
143
144 /* Unlock the connection list*/
146 }
147 }
148
150 {
151 /* Allow the filter to be cleaned up */
153 }
154
156}
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback
Definition: fltkernel.h:1877
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback
Definition: fltkernel.h:1875
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID ServerPortCookie
Definition: fltkernel.h:1874
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback
Definition: fltkernel.h:1876
ULONG FltpObjectPointerReference(_In_ PFLT_OBJECT Object)
Definition: Object.c:322
Definition: nsiface.idl:2307
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
Definition: obhandle.c:2935
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
Definition: oblife.c:1039
Definition: fltmgrint.h:26
Definition: fltmgrint.h:189
PFLT_DISCONNECT_NOTIFY DisconnectNotify
Definition: fltmgrint.h:192
◆ NtAlertResumeThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtAlertResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ NtAlertThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtAlertThread | ( | _In_ HANDLE | ThreadHandle | ) |
◆ NtApphelpCacheControl()
| NTSYSCALLAPI NTSTATUS NTAPI NtApphelpCacheControl | ( | _In_ APPHELPCACHESERVICECLASS | Service, |
| _In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP | ServiceData | ||
| ) |
Definition at line 728 of file apphelp.c.
731{
735
737 {
740 }
742 {
748 break;
754 break;
759 {
763 }
764 break;
766 /* FIXME: Check for admin or system here. */
768 break;
771 break;
774 ApphelpCacheFlush();
777 break;
781 break;
782 default:
784 break;
785 }
787 {
789 }
791}
NTSTATUS ApphelpCacheRemoveEntry(_In_ PUNICODE_STRING ImageName)
Definition: apphelp.c:587
VOID ApphelpFreeUnicodeString(_Inout_ PUNICODE_STRING String)
Definition: apphelp.c:161
NTSTATUS ApphelpCacheUpdateEntry(_In_ PUNICODE_STRING ImageName, _In_ HANDLE ImageHandle)
Definition: apphelp.c:616
NTSTATUS ApphelpValidateData(_In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP ServiceData, _Out_ PUNICODE_STRING ImageName, _Out_ PHANDLE ImageHandle)
Definition: apphelp.c:474
NTSTATUS ApphelpCacheLookupEntry(_In_ PUNICODE_STRING ImageName, _In_ HANDLE ImageHandle)
Definition: apphelp.c:531
Definition: env_spec_w32.h:368
Referenced by BaseDumpAppcompatCache(), BaseFlushAppcompatCache(), BasepShimCacheRemoveEntry(), BasepShimCacheSearch(), and CallApphelp().
◆ NtAssignProcessToJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtAssignProcessToJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ HANDLE | ProcessHandle | ||
| ) |
◆ NtCreateJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateJobObject | ( | _Out_ PHANDLE | JobHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes | ||
| ) |
◆ NtCreateJobSet()
| NTSTATUS NTAPI NtCreateJobSet | ( | _In_ ULONG | NumJob, |
| _In_ PJOB_SET_ARRAY | UserJobSet, | ||
| _In_ ULONG | Flags | ||
| ) |
◆ NtCreateProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ BOOLEAN | InheritObjectTable, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort | ||
| ) |
◆ NtCreateProcessEx()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcessEx | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ ULONG | Flags, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort, | ||
| _In_ BOOLEAN | InJob | ||
| ) |
◆ NtCreateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ProcessHandle, | ||
| _Out_ PCLIENT_ID | ClientId, | ||
| _In_ PCONTEXT | ThreadContext, | ||
| _In_ PINITIAL_TEB | UserStack, | ||
| _In_ BOOLEAN | CreateSuspended | ||
| ) |
◆ NtCurrentTeb()
| FORCEINLINE struct _TEB * NtCurrentTeb | ( | VOID | ) |
Definition at line 420 of file psfuncs.h.
421{
422#if defined(_M_IX86)
424#elif defined (_M_AMD64)
426#elif defined (_M_ARM)
428#endif
429}
PPC_QUAL unsigned long __readfsdword(const unsigned long Offset)
Definition: intrin_ppc.h:382
Definition: compat.h:710
Definition: compat.h:836
◆ NtImpersonateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtImpersonateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ HANDLE | ThreadToImpersonate, | ||
| _In_ PSECURITY_QUALITY_OF_SERVICE | SecurityQualityOfService | ||
| ) |
◆ NtIsProcessInJob()
| NTSYSCALLAPI NTSTATUS NTAPI NtIsProcessInJob | ( | _In_ HANDLE | ProcessHandle, |
| _In_opt_ HANDLE | JobHandle | ||
| ) |
◆ NtOpenProcess()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_opt_ PCLIENT_ID | ClientId | ||
| ) |
◆ NtOpenProcessToken()
| _Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcessToken | ( | _In_ HANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
◆ NtOpenThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ PCLIENT_ID | ClientId | ||
| ) |
◆ NtOpenThreadToken()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadToken | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Opens a token that is tied to a thread handle.
- Parameters
-
[out] ThreadHandle Thread handle where the token is about to be opened. [in] DesiredAccess The request access right for the token. [in] OpenAsSelf If set to TRUE, the access check will be made with the security context of the process of the calling thread (opening as self). Otherwise the access check will be made with the security context of the calling thread instead. [out] TokenHandle The opened token handle returned to the caller for use.
- Returns
- See NtOpenThreadTokenEx.
Definition at line 2474 of file token.c.
2479{
2481 TokenHandle);
2482}
NTSTATUS NTAPI NtOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2331
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2658
◆ NtOpenThreadTokenEx()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadTokenEx | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _In_ ULONG | HandleAttributes, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Opens a token that is tied to a thread handle.
- Parameters
-
[out] ThreadHandle Thread handle where the token is about to be opened. [in] DesiredAccess The request access right for the token. [in] OpenAsSelf If set to TRUE, the access check will be made with the security context of the process of the calling thread (opening as self). Otherwise the access check will be made with the security context of the calling thread instead. [in] HandleAttributes Handle attributes for the opened thread token handle. [out] TokenHandle The opened token handle returned to the caller for use.
- Returns
- Returns STATUS_SUCCESS if the function has successfully opened the thread token. STATUS_CANT_OPEN_ANONYMOUS is returned if a token has SecurityAnonymous as impersonation level and we cannot open it. A failure NTSTATUS code is returned otherwise.
Definition at line 2331 of file token.c.
2337{
2339 HANDLE hToken;
2347
2348 PAGED_CODE();
2349
2351
2352 /* Ensure that we can give the handle to the caller */
2354 {
2355 _SEH2_TRY
2356 {
2358 }
2360 {
2361 /* Return the exception code */
2363 }
2364 _SEH2_END;
2365 }
2366
2367 /* Validate object attributes */
2369
2370 /*
2371 * At first open the thread token for information access and verify
2372 * that the token associated with the thread is valid.
2373 */
2376 NULL);
2378 {
2381 }
2382
2383 /* Reference the token from the thread */
2385 &ImpersonationLevel);
2387 {
2391 }
2392
2393 /* Ensure the token has no anonymous security */
2395 {
2400 }
2401
2402 /* Revert to self if OpenAsSelf is specified */
2404 {
2406 &ImpersonationState);
2407 }
2408
2409 /* Call the private function to do the job */
2411 ThreadHandle,
2412 Token,
2413 DesiredAccess,
2414 HandleAttributes,
2415 EffectiveOnly,
2416 CopyOnOpen,
2417 ImpersonationLevel,
2418 PreviousMode,
2419 &hToken);
2420
2421 /* Restore the impersonation back if needed */
2422 if (RestoreImpersonation)
2423 {
2425 }
2426
2427 /* Dereference the access token and the associated thread */
2430
2432 {
2435 }
2436
2437 /* Give the opened token handle to the caller */
2438 _SEH2_TRY
2439 {
2440 *TokenHandle = hToken;
2441 }
2443 {
2445 }
2446 _SEH2_END;
2447
2449}
Definition: tokenizer.hpp:28
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG HandleAttributes
Definition: obfuncs.h:433
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN EffectiveOnly
Definition: sefuncs.h:410
BOOLEAN NTAPI PsDisableImpersonation(IN PETHREAD Thread, OUT PSE_IMPERSONATION_STATE ImpersonationState)
Definition: security.c:937
VOID NTAPI PsRestoreImpersonation(IN PETHREAD Thread, IN PSE_IMPERSONATION_STATE ImpersonationState)
Definition: security.c:987
PACCESS_TOKEN NTAPI PsReferenceImpersonationToken(IN PETHREAD Thread, OUT PBOOLEAN CopyOnOpen, OUT PBOOLEAN EffectiveOnly, OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
Definition: security.c:871
static NTSTATUS SepOpenThreadToken(_In_ PETHREAD Thread, _In_ HANDLE ThreadHandle, _In_ PTOKEN ThreadToken, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ BOOLEAN EffectiveOnly, _In_ BOOLEAN CopyOnOpen, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _In_ KPROCESSOR_MODE PreviousMode, _Out_ PHANDLE OpenedTokenHandle)
Internal private function that returns an opened handle of an access token associated with a thread.
Definition: token.c:1170
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
Definition: ob_x.h:22
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:494
Definition: pstypes.h:1102
Definition: setypes.h:115
Definition: setypes.h:216
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
Definition: psfuncs.h:156
◆ NtQueryInformationJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _Out_bytecap_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength, | ||
| _Out_ PULONG | ReturnLength | ||
| ) |
◆ NtQueryInformationProcess()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Definition at line 59 of file query.c.
65{
70 HANDLE DebugPort = 0;
71 PPROCESS_BASIC_INFORMATION ProcessBasicInfo =
72 (PPROCESS_BASIC_INFORMATION)ProcessInformation;
76 ULONG HandleCount;
78 (PPROCESS_SESSION_INFORMATION)ProcessInformation;
84 ULONG_PTR Wow64 = 0;
85 PROCESS_VALUES ProcessValues;
87 PAGED_CODE();
88
89 /* Verify Information Class validity */
93 ICIF_PROBE_READ,
94 ProcessInformation,
95 ProcessInformationLength,
96 ReturnLength,
97 NULL,
98 PreviousMode);
100 {
101 DPRINT1("NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n", Status, ProcessInformationClass);
103 }
104
106 (ProcessInformationClass == ProcessImageInformation)) &&
108 {
109 /*
110 * Retrieving the process cookie is only allowed for the calling process
111 * itself! XP only allows NtCurrentProcess() as process handles even if
112 * a real handle actually represents the current process.
113 */
115 }
116
117 /* Check the information class */
118 switch (ProcessInformationClass)
119 {
120 /* Basic process information */
122
124 {
126 break;
127 }
128
129 /* Set return length */
131
132 /* Reference the process */
135 PsProcessType,
136 PreviousMode,
138 NULL);
140
141 /* Protect writes with SEH */
142 _SEH2_TRY
143 {
144 /* Write all the information from the EPROCESS/KPROCESS */
149 UniqueProcessId;
150 ProcessBasicInfo->InheritedFromUniqueProcessId =
153
154 }
156 {
157 /* Get exception code */
159 }
160 _SEH2_END;
161
162 /* Dereference the process */
164 break;
165
166 /* Process quota limits */
168
170 {
172 break;
173 }
174
176
177 /* Reference the process */
180 PsProcessType,
181 PreviousMode,
183 NULL);
185
186 /* Indicate success */
188
189 _SEH2_TRY
190 {
191 /* Set max/min working set sizes */
192 QuotaLimits->MaximumWorkingSetSize =
194 QuotaLimits->MinimumWorkingSetSize =
196
197 /* Set default time limits */
200
201 /* Is quota block a default one? */
203 {
204 /* Set default pools and pagefile limits */
208 }
209 else
210 {
211 /* Get limits from non-default quota block */
212 QuotaLimits->PagedPoolLimit =
214 QuotaLimits->NonPagedPoolLimit =
216 QuotaLimits->PagefileLimit =
218 }
219 }
221 {
222 /* Get exception code */
224 }
225 _SEH2_END;
226
227 /* Dereference the process */
229 break;
230
232
234 {
236 break;
237 }
238
240
241 /* Reference the process */
244 PsProcessType,
245 PreviousMode,
247 NULL);
249
250 /* Query IO counters from the process */
252
253 _SEH2_TRY
254 {
256 }
258 {
259 /* Ignore exception */
260 }
261 _SEH2_END;
262
263 /* Set status to success in any case */
265
266 /* Dereference the process */
268 break;
269
270 /* Timing */
272
273 /* Set the return length */
275 {
277 break;
278 }
279
281
282 /* Reference the process */
285 PsProcessType,
286 PreviousMode,
288 NULL);
290
291 /* Protect writes with SEH */
292 _SEH2_TRY
293 {
294 /* Copy time information from EPROCESS/KPROCESS */
300 }
302 {
303 /* Get exception code */
305 }
306 _SEH2_END;
307
308 /* Dereference the process */
310 break;
311
312 /* Process Debug Port */
314
316 {
318 break;
319 }
320
321 /* Set return length */
323
324 /* Reference the process */
327 PsProcessType,
328 PreviousMode,
330 NULL);
332
333 /* Protect write with SEH */
334 _SEH2_TRY
335 {
336 /* Return whether or not we have a debug port */
339 }
341 {
342 /* Get exception code */
344 }
345 _SEH2_END;
346
347 /* Dereference the process */
349 break;
350
352
354 {
356 break;
357 }
358
359 /* Set the return length*/
361
362 /* Reference the process */
365 PsProcessType,
366 PreviousMode,
368 NULL);
370
371 /* Count the number of handles this process has */
373
374 /* Protect write in SEH */
375 _SEH2_TRY
376 {
377 /* Return the count of handles */
378 *(PULONG)ProcessInformation = HandleCount;
379 }
381 {
382 /* Get the exception code */
384 }
385 _SEH2_END;
386
387 /* Dereference the process */
389 break;
390
391 /* Session ID for the process */
393
395 {
397 break;
398 }
399
400 /* Set the return length*/
402
403 /* Reference the process */
406 PsProcessType,
407 PreviousMode,
409 NULL);
411
412 /* Enter SEH for write safety */
413 _SEH2_TRY
414 {
415 /* Write back the Session ID */
417 }
419 {
420 /* Get the exception code */
422 }
423 _SEH2_END;
424
425 /* Dereference the process */
427 break;
428
429 /* Virtual Memory Statistics */
431
432 /* Validate the input length */
435 {
437 break;
438 }
439
440 /* Reference the process */
443 PsProcessType,
444 PreviousMode,
446 NULL);
448
449 /* Enter SEH for write safety */
450 _SEH2_TRY
451 {
452 /* Return data from EPROCESS */
464 //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
465 //
466
467 /* Set the return length */
468 Length = ProcessInformationLength;
469 }
471 {
472 /* Get the exception code */
474 }
475 _SEH2_END;
476
477 /* Dereference the process */
479 break;
480
481 /* Hard Error Processing Mode */
483
485 {
487 break;
488 }
489
490 /* Set the return length*/
492
493 /* Reference the process */
496 PsProcessType,
497 PreviousMode,
499 NULL);
501
502 /* Enter SEH for writing back data */
503 _SEH2_TRY
504 {
505 /* Write the current processing mode */
507 DefaultHardErrorProcessing;
508 }
510 {
511 /* Get the exception code */
513 }
514 _SEH2_END;
515
516 /* Dereference the process */
518 break;
519
520 /* Priority Boosting status */
522
524 {
526 break;
527 }
528
529 /* Set the return length */
531
532 /* Reference the process */
535 PsProcessType,
536 PreviousMode,
538 NULL);
540
541 /* Enter SEH for writing back data */
542 _SEH2_TRY
543 {
544 /* Return boost status */
547 }
549 {
550 /* Get the exception code */
552 }
553 _SEH2_END;
554
555 /* Dereference the process */
557 break;
558
559 /* DOS Device Map */
561
563 {
564 /* Protect read in SEH */
565 _SEH2_TRY
566 {
567 PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
568
570 }
572 {
573 /* Get the exception code */
576 }
577 _SEH2_END;
578
579 /* Only one flag is supported and it needs LUID mappings */
581 !ObIsLUIDDeviceMapsEnabled())
582 {
584 break;
585 }
586 }
587 else
588 {
589 /* This has to be the size of the Query union field for x64 compatibility! */
591 {
593 break;
594 }
595
596 /* No flags for standard call */
597 Flags = 0;
598 }
599
600 /* Set the return length */
601 Length = ProcessInformationLength;
602
603 /* Reference the process */
606 PsProcessType,
607 PreviousMode,
609 NULL);
611
612 /* Query the device map information */
614 ProcessInformation,
615 Flags);
616
617 /* Dereference the process */
619 break;
620
621 /* Priority class */
623
625 {
627 break;
628 }
629
630 /* Set the return length*/
632
633 /* Reference the process */
636 PsProcessType,
637 PreviousMode,
639 NULL);
641
642 /* Enter SEH for writing back data */
643 _SEH2_TRY
644 {
645 /* Return current priority class */
648 }
650 {
651 /* Get the exception code */
653 }
654 _SEH2_END;
655
656 /* Dereference the process */
658 break;
659
661
662 /* Reference the process */
665 PsProcessType,
666 PreviousMode,
668 NULL);
670
671 /* Get the image path */
674 {
675 /* Set return length */
678
679 /* Make sure it's large enough */
681 {
682 /* Enter SEH to protect write */
683 _SEH2_TRY
684 {
685 /* Copy it */
686 RtlCopyMemory(ProcessInformation,
687 ImageName,
688 Length);
689
690 /* Update pointer */
691 ((PUNICODE_STRING)ProcessInformation)->Buffer =
693 }
695 {
696 /* Get the exception code */
698 }
699 _SEH2_END;
700 }
701 else
702 {
703 /* Buffer too small */
705 }
706
707 /* Free the image path */
709 }
710 /* Dereference the process */
712 break;
713
715
717 {
719 break;
720 }
721
722 /* Set the return length*/
724
725 /* Reference the process */
728 PsProcessType,
729 PreviousMode,
731 NULL);
733
734 /* Enter SEH for writing back data */
735 _SEH2_TRY
736 {
737 /* Return the debug flag state */
739 }
741 {
742 /* Get the exception code */
744 }
745 _SEH2_END;
746
747 /* Dereference the process */
749 break;
750
752
754 {
756 break;
757 }
758
759 /* Set the return length */
761
762 /* Reference the process */
765 PsProcessType,
766 PreviousMode,
768 NULL);
770
771 /* Enter SEH for writing back data */
772 _SEH2_TRY
773 {
774 /* Return the BreakOnTermination state */
776 }
778 {
779 /* Get the exception code */
781 }
782 _SEH2_END;
783
784 /* Dereference the process */
786 break;
787
788 /* Per-process security cookie */
790
792 {
793 /* Length size wrong, bail out */
795 break;
796 }
797
798 /* Get the current process and cookie */
802 {
803 LARGE_INTEGER SystemTime;
804 ULONG NewCookie;
805 PKPRCB Prcb;
806
807 /* Generate a new cookie */
808 KeQuerySystemTime(&SystemTime);
809 Prcb = KeGetCurrentPrcb();
812
813 /* Set the new cookie or return the current one */
815 NewCookie,
816 Cookie);
818
819 /* Set return length */
821 }
822
823 /* Indicate success */
825
826 /* Enter SEH to protect write */
827 _SEH2_TRY
828 {
829 /* Write back the cookie */
831 }
833 {
834 /* Get the exception code */
836 }
837 _SEH2_END;
838 break;
839
841
843 {
844 /* Break out */
846 break;
847 }
848
849 /* Set the length required and validate it */
851
852 /* Enter SEH to protect write */
853 _SEH2_TRY
854 {
856 }
858 {
859 /* Get the exception code */
861 }
862 _SEH2_END;
863
864 /* Indicate success */
866 break;
867
869
871 {
873 break;
874 }
875
876 /* Set the return length */
878
879 /* Reference the process */
882 PsProcessType,
883 PreviousMode,
885 NULL);
887
888 /* Get the debug port */
890
891 /* Let go of the process */
893
894 /* Protect write in SEH */
895 _SEH2_TRY
896 {
897 /* Return debug port's handle */
898 *(PHANDLE)ProcessInformation = DebugPort;
899 }
901 {
902 /* Get the exception code */
904 }
905 _SEH2_END;
906 break;
907
911 break;
912
914
916 {
918 break;
919 }
920
921 /* Set the return length */
923
924 /* Indicate success */
926
927 /* Protect write in SEH */
928 _SEH2_TRY
929 {
930 /* Query Ob */
932 }
934 {
935 /* Get the exception code */
937 }
938 _SEH2_END;
939 break;
940
942
944 {
946 break;
947 }
948
949 /* Set the return length */
951
952 /* Reference the process */
955 PsProcessType,
956 PreviousMode,
958 NULL);
960
961 /* Protect write in SEH */
962 _SEH2_TRY
963 {
964 /* Return if the flag is set */
966 }
968 {
969 /* Get the exception code */
971 }
972 _SEH2_END;
973
974 /* Dereference the process */
976 break;
977
979
981 {
983 break;
984 }
985
986 /* Set return length */
988
989 /* Reference the process */
992 PsProcessType,
993 PreviousMode,
995 NULL);
997
998 /* Make sure the process isn't dying */
1000 {
1001 /* Get the WOW64 process structure */
1002#ifdef _WIN64
1004#else
1005 Wow64 = 0;
1006#endif
1007 /* Release the lock */
1009 }
1010
1011 /* Protect write with SEH */
1012 _SEH2_TRY
1013 {
1014 /* Return whether or not we have a debug port */
1015 *(PULONG_PTR)ProcessInformation = Wow64;
1016 }
1018 {
1019 /* Get exception code */
1021 }
1022 _SEH2_END;
1023
1024 /* Dereference the process */
1026 break;
1027
1029
1031 {
1033 break;
1034 }
1035
1036 /* Set return length */
1038
1040 {
1042 }
1043
1044 /* Get the options */
1047 {
1048 /* Protect write with SEH */
1049 _SEH2_TRY
1050 {
1051 /* Return them */
1052 *(PULONG)ProcessInformation = ExecuteOptions;
1053 }
1055 {
1056 /* Get exception code */
1058 }
1059 _SEH2_END;
1060 }
1061 break;
1062
1066 break;
1067
1071 break;
1072
1076 break;
1077
1078 /* Not supported by Server 2003 */
1079 default:
1082 }
1083
1084 /* Protect write with SEH */
1085 _SEH2_TRY
1086 {
1087 /* Check if caller wanted return length */
1089 }
1091 {
1092 /* Get exception code */
1094 }
1095 _SEH2_END;
1096
1098}
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
Definition: dbgkobj.c:1526
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
struct _VM_COUNTERS_ * PVM_COUNTERS
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
struct _IO_COUNTERS * PIO_COUNTERS
struct _QUOTA_LIMITS QUOTA_LIMITS
struct _QUOTA_LIMITS * PQUOTA_LIMITS
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
Definition: procobj.c:860
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
Definition: procobj.c:525
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
Definition: section.c:1811
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
Definition: pagfault.c:2653
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
Definition: probe.h:219
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
Definition: process.c:1163
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
Definition: audit.c:199
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
Definition: obhandle.c:56
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
Definition: devicemap.c:539
Definition: pstypes.h:1261
Definition: pstypes.h:82
Definition: winternl.h:1059
Definition: ketypes.h:626
Definition: winternl.h:402
ULONG_PTR InheritedFromUniqueProcessId
Definition: pstypes.h:340
Definition: pstypes.h:370
Definition: pstypes.h:358
Definition: pstypes.h:955
Definition: pstypes.h:383
Definition: ke.h:45
Definition: lsa.idl:286
Definition: mmtypes.h:340
Definition: mmdrv.h:130
Definition: pstypes.h:105
Definition: winternl.h:1604
SIZE_T QuotaPeakNonPagedPoolUsage
Definition: winternl.h:1612
Definition: typedefs.h:103
struct _LARGE_INTEGER::@2282 u
◆ NtQueryInformationThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_ PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
◆ NtRegisterThreadTerminatePort()
| NTSYSCALLAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort | ( | _In_ HANDLE | TerminationPort | ) |
◆ NtResumeProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtResumeProcess | ( | _In_ HANDLE | ProcessHandle | ) |
◆ NtResumeThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ NtSetInformationJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _In_bytecount_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength | ||
| ) |
◆ NtSetInformationProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
◆ NtSetInformationThread()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _In_reads_bytes_(ThreadInformationLength) PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength | ||
| ) |
◆ NtSuspendProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtSuspendProcess | ( | _In_ HANDLE | ProcessHandle | ) |
◆ NtSuspendThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtSuspendThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ PULONG | PreviousSuspendCount | ||
| ) |
◆ NtTerminateJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ NtTerminateProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ NtTerminateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ PsChargePoolQuota()
| NTKERNELAPI VOID NTAPI PsChargePoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the PoolType parameter.
- Parameters
-
[in] Process The process which quota is to be charged. [in] PoolType The pool type to choose to charge quotas (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to charge into a process.
- Returns
- Nothing.
- Remarks
- The function raises an exception if STATUS_QUOTA_EXCEEDED status code is returned. Callers are responsible on their own to handle the raised exception.
Definition at line 775 of file quota.c.
779{
782
783 /* Don't do anything for the system process */
785
786 /* Charge the usage */
789}
NTSTATUS NTAPI PsChargeProcessPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
Definition: quota.c:872
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
Definition: wdfdevice.h:3815
Referenced by FsRtlCancelNotify(), and FsRtlNotifyFilterReportChange().
◆ PsChargeProcessNonPagedPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Charges the non paged pool quota of a given process.
- Parameters
-
[in] Process The process which non paged quota is to be charged. [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 811 of file quota.c.
814{
815 /* Call the general function */
817}
Referenced by MiCreatePebOrTeb(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), NtAllocateVirtualMemory(), NtFreeVirtualMemory(), and START_TEST().
◆ PsChargeProcessPagedPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Charges the paged pool quota of a given process.
- Parameters
-
[in] Process The process which paged quota is to be charged. [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 839 of file quota.c.
842{
843 /* Call the general function */
845}
Referenced by ExpAllocateHandleTable(), ExpAllocateTablePagedPool(), ExpAllocateTablePagedPoolNoZero(), and START_TEST().
◆ PsChargeProcessPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
- Parameters
-
[in] Process The process which quota is to be charged. [in] PoolType The type of quota pool to charge (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 872 of file quota.c.
876{
877 /* Don't do anything for the system process */
879
881 Process->QuotaBlock,
883 Amount);
884}
NTSTATUS NTAPI PspChargeProcessQuotaSpecifiedPool(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ PS_QUOTA_TYPE QuotaType, _In_ SIZE_T Amount)
Internal kernel function that provides the bulk logic of process quota charging, necessary for export...
Definition: quota.c:195
Referenced by ExAllocatePoolWithQuotaTag(), PsChargePoolQuota(), PsChargeProcessNonPagedPoolQuota(), and PsChargeProcessPagedPoolQuota().
◆ PsEstablishWin32Callouts()
| NTKERNELAPI VOID NTAPI PsEstablishWin32Callouts | ( | _In_ PWIN32_CALLOUTS_FPNS | CalloutData | ) |
◆ PsGetCurrentProcessSessionId()
| NTKERNELAPI ULONG NTAPI PsGetCurrentProcessSessionId | ( | VOID | ) |
Definition at line 1133 of file process.c.
1134{
1136}
Referenced by ExpWin32SessionCallout(), IntCreateDesktop(), IntDestroyMenuObject(), NtSetInformationObject(), NtUserSwitchDesktop(), ObpLookupObjectName(), and VideoPortUseDeviceInSession().
◆ PsGetCurrentProcessWin32Process()
| NTKERNELAPI PVOID NTAPI PsGetCurrentProcessWin32Process | ( | VOID | ) |
Definition at line 1183 of file process.c.
Referenced by _Function_class_(), CheckWinstaAttributeAccess(), co_IntGraphicsCheck(), co_IntSetParent(), co_IntSetWindowLongPtr(), co_IntUserManualGuiCheck(), co_UserDestroyWindow(), DC_bAllocDcAttr(), DC_vFreeDcAttr(), DecrementCurrentProcessGdiHandleCount(), DesktopHeapAddressToUser(), DesktopHeapGetUserDelta(), GDI_CleanupForProcess(), GetBrushAttrPool(), GetControlColor(), GetFontFamilyInfoForSubstitutes(), GetW32ProcessInfo(), handle_internal_message(), IdlePing(), IdlePong(), IncrementCurrentProcessGdiHandleCount(), IntAllowSetForegroundWindow(), IntGdiAddFontMemResource(), IntGdiCleanupPrivateFontsForProcess(), IntGdiLoadFontsFromMemory(), IntGdiRemoveFontMemResource(), IntGdiSetRegionOwner(), IntGetFontFamilyInfo(), IntLoadHookModule(), IntLoadSystenIcons(), IntLockSetForegroundWindow(), IntMapDesktopView(), IntUnmapDesktopView(), IntWinStaOkToClose(), NtUserCallHwndParam(), NtUserCallOneParam(), NtUserDestroyCursor(), NtUserFindExistingCursorIcon(), NtUserGetComboBoxInfo(), NtUserGetListBoxInfo(), NtUserSetSystemCursor(), NtUserSetWindowFNID(), REGION_bAllocRgnAttr(), REGION_vCleanup(), TextIntRealizeFont(), UserDbgAssertThreadInfo(), UserGetDCEx(), UserGetProcessWindowStation(), UserHeapAddressToUser(), UserSetProcessWindowStation(), UserSystemParametersInfo(), and UserUnregisterUserApiHook().
◆ PsGetCurrentThreadProcessId()
| NTKERNELAPI HANDLE NTAPI PsGetCurrentThreadProcessId | ( | VOID | ) |
Definition at line 755 of file thread.c.
Referenced by intDdCreateDirectDrawLocal().
◆ PsGetCurrentThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsGetCurrentThreadWin32Thread | ( | VOID | ) |
Definition at line 805 of file thread.c.
Referenced by AllocateUserMessage(), CaretSystemTimerProc(), co_HOOK_CallHooks(), co_IntActivateKeyboardLayout(), co_IntCallHookProc(), co_IntCallSentMessageCallback(), co_IntCallWindowProc(), co_IntClientLoadLibrary(), co_IntClientThreadSetup(), co_IntCreateDefaultImeWindow(), co_IntFixCaret(), co_IntGetPeekMessage(), co_IntLoadDefaultCursors(), co_IntLoadKeyboardLayoutEx(), co_IntLoadSysMenuTemplate(), co_IntPaintWindows(), co_IntPeekMessage(), co_IntProcessKeyboardMessage(), co_IntProcessMouseMessage(), co_IntSendActivateMessages(), co_IntSendMessageTimeoutSingle(), co_IntSendMessageWithCallBack(), co_IntSetActiveWindow(), co_IntSetCaretPos(), co_IntSetForegroundAndFocusWindow(), co_IntWaitMessage(), co_MsqDispatchOneSentMessage(), co_MsqReplyMessage(), co_MsqSendMessage(), co_MsqSendMessageAsync(), co_UserDestroyWindow(), co_UserHideCaret(), co_UserSetCapture(), co_UserSetFocus(), co_UserShowCaret(), co_WinPosSearchChildren(), co_WinPosSetWindowPos(), co_WinPosShowWindow(), DECREASE_THREAD_LOCK_COUNT(), DefWndDoSizeMove(), DefWndStartSizeMove(), DesktopHeapGetUserDelta(), DesktopThreadMain(), GetW32ThreadInfo(), handle_internal_message(), IdlePing(), INCREASE_THREAD_LOCK_COUNT(), IntAddAtom(), IntCallWndProc(), IntCallWndProcRet(), IntCbAllocateMemory(), IntCbFreeMemory(), IntCreateDesktop(), IntDeactivateWindow(), IntDefWindowProc(), IntDeRegisterShellHookWindow(), IntDesktopOkToClose(), IntDestroyOwnedWindows(), IntDispatchMessage(), IntDrawScrollBar(), IntGetAndReferenceClass(), IntGetAtomName(), IntGetCapture(), IntGetCurrentThreadDesktopWindow(), IntGetImeCompatFlags(), IntGetNextHook(), IntGetQueueStatus(), IntGetThreadDesktopWindow(), IntGetThreadFocusWindow(), IntInitMessagePumpHook(), IntInvalidateWindows(), IntIsClipboardOpenByMe(), IntMsqClearWakeMask(), IntMsqSetWakeMask(), IntNotifyImeShowStatus(), IntNotifyWinEvent(), IntQueryTrackMouseEvent(), IntRegisterShellHookWindow(), IntReleaseCapture(), IntRemoveHook(), IntSendDestroyMsg(), IntSendSyncPaint(), IntSetThreadDesktop(), IntSetTimer(), IntTrackMouseEvent(), IntTrackPopupMenuEx(), IntTranslateKbdMessage(), IntUnhookWindowsHook(), IntUninitMessagePumpHook(), IntUserSetActiveWindow(), MENU_DoNextMenu(), MENU_InitTracking(), MENU_TrackMenu(), MsqGetMessageExtraInfo(), MsqSetMessageExtraInfo(), NtUserBlockInput(), NtUserCallNoParam(), NtUserCallOneParam(), NtUserCallTwoParam(), NtUserCreateAcceleratorTable(), NtUserCreateCaret(), NtUserGetAppImeLevel(), NtUserGetCaretPos(), NtUserGetGUIThreadInfo(), NtUserGetKeyboardLayoutName(), NtUserGetKeyboardState(), NtUserGetKeyNameText(), NtUserGetThreadState(), NtUserLockWorkStation(), NtUserMapVirtualKeyEx(), NtUserQueryWindow(), NtUserSendInput(), NtUserSetAppImeLevel(), NtUserSetKeyboardState(), NtUserSetThreadState(), NtUserSetWindowsHookEx(), NtUserSetWinEventHook(), NtUserToUnicodeEx(), NtUserValidateTimerCallback(), NtUserVkKeyScanEx(), NtUserWaitForInputIdle(), PostTimerMessages(), UserCreateInputContext(), UserDbgAssertThreadInfo(), UserDerefObjectCo(), UserDestroyMenu(), UserEnterExclusive(), UserGetActiveWindow(), UserGetCPD(), UserGetKeyboardLayout(), UserGetKeyState(), UserGhostThreadEntry(), UserInitialize(), UserOpenClipboard(), UserOpenInputDesktop(), UserRefObjectCo(), UserRegisterHotKey(), UserRegisterUserApiHook(), UserSendKeyboardInput(), UserSendMouseInput(), UserSetActiveWindow(), UserSetCursor(), UserShowCursor(), and UserUnregisterUserApiHook().
◆ PsGetProcessExitProcessCalled()
| NTKERNELAPI BOOLEAN NTAPI PsGetProcessExitProcessCalled | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessExitStatus()
| NTKERNELAPI NTSTATUS NTAPI PsGetProcessExitStatus | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessInheritedFromUniqueProcessId()
◆ PsGetProcessSecurityPort()
| NTKERNELAPI PVOID NTAPI PsGetProcessSecurityPort | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessSessionId()
| NTKERNELAPI ULONG NTAPI PsGetProcessSessionId | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessWin32Process()
| NTKERNELAPI PVOID NTAPI PsGetProcessWin32Process | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessWin32WindowStation()
| NTKERNELAPI PVOID NTAPI PsGetProcessWin32WindowStation | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetThreadFreezeCount()
| NTKERNELAPI ULONG NTAPI PsGetThreadFreezeCount | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadHardErrorsAreDisabled()
| NTKERNELAPI BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadId()
| NTKERNELAPI HANDLE NTAPI PsGetThreadId | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadProcess()
| NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadTeb()
| NTKERNELAPI PTEB NTAPI PsGetThreadTeb | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsGetThreadWin32Thread | ( | _In_ PETHREAD | Thread | ) |
◆ PsIsProtectedProcess()
◆ PsIsSystemProcess()
| NTKERNELAPI BOOLEAN NTAPI PsIsSystemProcess | ( | _In_ PEPROCESS | Process | ) |
◆ PsIsThreadImpersonating()
| NTKERNELAPI BOOLEAN NTAPI PsIsThreadImpersonating | ( | _In_ PETHREAD | Thread | ) |
◆ PsLookupProcessThreadByCid()
| NTKERNELAPI NTSTATUS NTAPI PsLookupProcessThreadByCid | ( | _In_ PCLIENT_ID | Cid, |
| _Out_opt_ PEPROCESS * | Process, | ||
| _Out_ PETHREAD * | Thread | ||
| ) |
◆ PsReturnPoolQuota()
| NTKERNELAPI VOID NTAPI PsReturnPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Returns the pool quota that the process was taking up.
- Parameters
-
[in] Process The process which quota is to be returned. [in] PoolType The type of quota pool to return (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 907 of file quota.c.
911{
912 /* Don't do anything for the system process */
914
916 Process->QuotaBlock,
918 Amount);
919}
VOID NTAPI PspReturnProcessQuotaSpecifiedPool(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ PS_QUOTA_TYPE QuotaType, _In_ SIZE_T Amount)
Internal kernel function that provides the bulk logic of process quota returning. It returns (takes a...
Definition: quota.c:345
Referenced by ExFreePoolWithTag(), ExReturnPoolQuota(), PsReturnProcessNonPagedPoolQuota(), and PsReturnProcessPagedPoolQuota().
◆ PsReturnProcessNonPagedPoolQuota()
| NTKERNELAPI VOID NTAPI PsReturnProcessNonPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Returns the non paged quota pool that the process was taking up.
- Parameters
-
[in] Process The process which non paged quota is to be returned. [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 938 of file quota.c.
941{
942 /* Don't do anything for the system process */
944
946}
VOID NTAPI PsReturnPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Returns the pool quota that the process was taking up.
Definition: quota.c:907
Referenced by MiCreatePebOrTeb(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), MiUnmapLockedPagesInUserSpace(), MiUnmapViewOfSection(), MmCleanProcessAddressSpace(), MmDeleteTeb(), NtAllocateVirtualMemory(), NtFreeVirtualMemory(), PspDeleteProcess(), and START_TEST().
◆ PsReturnProcessPagedPoolQuota()
Returns the paged pool quota that the process was taking up.
- Parameters
-
[in] Process The process which paged pool quota is to be returned. [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 965 of file quota.c.
968{
969 /* Don't do anything for the system process */
971
973}
Referenced by ExpAllocateHandleTable(), ExpFreeHandleTable(), ExpFreeTablePagedPool(), FsRtlCancelNotify(), FsRtlNotifyCleanup(), FsRtlNotifyCompleteIrp(), FsRtlNotifyFilterReportChange(), and START_TEST().
◆ PsRevertThreadToSelf()
| NTKERNELAPI VOID NTAPI PsRevertThreadToSelf | ( | _Inout_ PETHREAD | Thread | ) |
◆ PsSetProcessPriorityByClass()
◆ PsSetProcessSecurityPort()
| NTKERNELAPI NTSTATUS NTAPI PsSetProcessSecurityPort | ( | _Inout_ PEPROCESS | Process, |
| _In_ PVOID | SecurityPort | ||
| ) |
◆ PsSetProcessWin32Process()
| NTKERNELAPI NTSTATUS NTAPI PsSetProcessWin32Process | ( | _Inout_ PEPROCESS | Process, |
| _In_opt_ PVOID | Win32Process, | ||
| _In_opt_ PVOID | OldWin32Process | ||
| ) |
Definition at line 1257 of file process.c.
1261{
1263
1264 /* Assume success */
1266
1267 /* Lock the process */
1268 KeEnterCriticalRegion();
1270
1271 /* Check if we set a new win32 process */
1273 {
1274 /* Check if the process is in the right state */
1277 {
1278 /* Set the new win32 process */
1279 Process->Win32Process = Win32Process;
1280 }
1281 else
1282 {
1283 /* Otherwise fail */
1285 }
1286 }
1287 else
1288 {
1289 /* Reset the win32 process, did the caller specify the correct old value? */
1291 {
1292 /* Yes, so reset the win32 process to NULL */
1294 }
1295 else
1296 {
1297 /* Otherwise fail */
1299 }
1300 }
1301
1302 /* Unlock the process */
1304 KeLeaveCriticalRegion();
1305
1307}
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1036
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1252
Referenced by AllocW32Process(), and ExitProcessCallback().
◆ PsSetProcessWindowStation()
| NTKERNELAPI VOID NTAPI PsSetProcessWindowStation | ( | _Inout_ PEPROCESS | Process, |
| _In_opt_ PVOID | WindowStation | ||
| ) |
◆ PsSetThreadHardErrorsAreDisabled()
| NTKERNELAPI VOID NTAPI PsSetThreadHardErrorsAreDisabled | ( | _Inout_ PETHREAD | Thread, |
| _In_ BOOLEAN | Disabled | ||
| ) |
◆ PsSetThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsSetThreadWin32Thread | ( | _Inout_ PETHREAD | Thread, |
| _In_opt_ PVOID | Win32Thread, | ||
| _In_opt_ PVOID | OldWin32Thread | ||
| ) |
◆ ZwAlertResumeThread()
| NTSYSAPI NTSTATUS NTAPI ZwAlertResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ ZwAlertThread()
◆ ZwAssignProcessToJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwAssignProcessToJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ HANDLE | ProcessHandle | ||
| ) |
◆ ZwCreateJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwCreateJobObject | ( | _Out_ PHANDLE | JobHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes | ||
| ) |
◆ ZwCreateProcess()
| NTSYSAPI NTSTATUS NTAPI ZwCreateProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ BOOLEAN | InheritObjectTable, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort | ||
| ) |
Referenced by RtlCreateUserProcess().
◆ ZwCreateThread()
| NTSYSAPI NTSTATUS NTAPI ZwCreateThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ProcessHandle, | ||
| _Out_ PCLIENT_ID | ClientId, | ||
| _In_ PCONTEXT | ThreadContext, | ||
| _In_ PINITIAL_TEB | UserStack, | ||
| _In_ BOOLEAN | CreateSuspended | ||
| ) |
Referenced by RtlCreateUserThread().
◆ ZwImpersonateThread()
| NTSYSAPI NTSTATUS NTAPI ZwImpersonateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ HANDLE | ThreadToImpersonate, | ||
| _In_ PSECURITY_QUALITY_OF_SERVICE | SecurityQualityOfService | ||
| ) |
◆ ZwIsProcessInJob()
◆ ZwOpenThread()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ PCLIENT_ID | ClientId | ||
| ) |
◆ ZwOpenThreadToken()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThreadToken | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Referenced by IntGetCurrentAccessToken(), RtlAdjustPrivilege(), and RtlpOpenThreadToken().
◆ ZwOpenThreadTokenEx()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThreadTokenEx | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _In_ ULONG | HandleAttributes, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Referenced by RtlFormatCurrentUserKeyPath().
◆ ZwQueryInformationJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _Out_bytecap_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength, | ||
| _Out_ PULONG | ReturnLength | ||
| ) |
◆ ZwQueryInformationProcess()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Referenced by lie_about_fs_type(), RtlCreateUserProcess(), RtlEncodePointer(), RtlSetProcessIsCritical(), and START_TEST().
◆ ZwQueryInformationThread()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_ PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Referenced by RtlSetThreadIsCritical().
◆ ZwRegisterThreadTerminatePort()
◆ ZwResumeProcess()
◆ ZwResumeThread()
Referenced by ExpLoadInitialProcess().
◆ ZwSetInformationJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwSetInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _In_ PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength | ||
| ) |
◆ ZwSetInformationProcess()
| NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
Referenced by RtlSetProcessIsCritical().
◆ ZwSuspendProcess()
◆ ZwSuspendThread()
| NTSYSAPI NTSTATUS NTAPI ZwSuspendThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ PULONG | PreviousSuspendCount | ||
| ) |
◆ ZwTerminateJobObject()
◆ ZwTerminateThread()
Referenced by RtlAssert().
Variable Documentation
◆ DesiredAccess
◆ ExitStatus
Definition at line 858 of file psfuncs.h.
Referenced by BaseExitThreadPoolThread(), BaseSrvBSMThread(), CdfsChkdsk(), ChkdskEx(), CsrDereferenceNtSession(), DbgkExitProcess(), DbgkExitThread(), Ext2Chkdsk(), NtfsChkdsk(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), PspExitThread(), PspTerminateProcess(), PspTerminateThreadByPointer(), PsTerminateProcess(), PsTerminateSystemThread(), RtlpExitThread(), test_query_process_basic(), VfatChkdsk(), and VfatxChkdsk().
◆ HandleAttributes
◆ ThreadInformationClass
| _In_ THREADINFOCLASS ThreadInformationClass |
Definition at line 832 of file psfuncs.h.
Referenced by NtQueryInformationThread(), NtSetInformationThread(), NtUserQueryInformationThread(), and NtUserSetInformationThread().
◆ ThreadInformationLength
| _In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength |
Definition at line 834 of file psfuncs.h.
Referenced by NtQueryInformationThread(), NtSetInformationThread(), NtUserSetInformationThread(), and PspQueryDescriptorThread().
◆ TokenHandle
Definition at line 717 of file psfuncs.h.
Referenced by AdjustTokenGroups(), AdjustTokenPrivileges(), BasepReplaceProcessThreadTokens(), CreateDefaultProcessSecurityCommon(), CreateProcessInternalW(), DuplicateTokenAsEffective(), GetCallerLuid(), GetSiteSidFromToken(), GetTokenInformation(), IntGetCurrentAccessToken(), IsPrivilegeEnabled(), IsTokenRestricted(), LogonUserExW(), LsapIsTrustedClient(), LsapLogonUser(), LsarSetSecurityObject(), MyLogonUser(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtCreateToken(), NtOpenProcessToken(), NtOpenProcessTokenEx(), NtOpenThreadToken(), NtOpenThreadTokenEx(), NtQueryInformationToken(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), OpenProcessToken(), OpenThreadToken(), PsAssignImpersonationToken(), PspSetPrimaryToken(), RtlAdjustPrivilege(), RtlCreateUserSecurityObject(), RtlDefaultNpAcl(), RtlFormatCurrentUserKeyPath(), RtlpGetImpersonationToken(), RtlpOpenThreadToken(), RtlRemovePrivileges(), SamrSetSecurityObject(), SepCreateToken(), SepOpenThreadToken(), SetThreadToken(), SetTokenInformation(), SHTestTokenMembership(), and START_TEST().
