Include dependency graph for psfuncs.h:
This graph shows which files directly or indirectly include this file:
Go to the source code of this file.
Function Documentation
◆ _In_reads_bytes_()
| _In_ THREADINFOCLASS _In_reads_bytes_ | ( | ThreadInformationLength | ) |
◆ _IRQL_requires_max_()
| _IRQL_requires_max_ | ( | PASSIVE_LEVEL | ) |
Queries information details about a security descriptor.
Computes the quota size of a security descriptor.
Assigns a security descriptor for a new object.
An extended function that assigns a security descriptor for a new object.
Frees a security descriptor.
An extended function that sets new information data to a security descriptor.
Modifies some information data about a security descriptor.
- Parameters
-
[in] SecurityInformation Security information details to be queried from a security descriptor. [out] SecurityDescriptor The returned security descriptor with security information data. [in,out] Length The returned length of a security descriptor. [in,out] ObjectsSecurityDescriptor The returned object security descriptor.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.
- Parameters
-
[in] Object If specified, the function will use this arbitrary object that points to an object security descriptor. [in] SecurityInformation Security information details to be set. [in] SecurityDescriptor A security descriptor where its info is to be changed. [in,out] ObjectsSecurityDescriptor The returned pointer to security descriptor objects. [in] PoolType Pool type for the new security descriptor to allocate. [in] GenericMapping The generic mapping of access rights masks.
- Returns
- See SeSetSecurityDescriptorInfoEx.
- Parameters
-
[in] Object If specified, the function will use this arbitrary object that points to an object security descriptor. [in] SecurityInformation Security information details to be set. [in] SecurityDescriptor A security descriptor where its info is to be changed. [in,out] ObjectsSecurityDescriptor The returned pointer to security descriptor objects. [in] AutoInheritFlags Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place. [in] PoolType Pool type for the new security descriptor to allocate. [in] GenericMapping The generic mapping of access rights masks.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.
- Parameters
-
[in] SecurityDescriptor A security descriptor to be freed from memory.
- Returns
- Returns STATUS_SUCCESS.
- Parameters
-
[in] _ParentDescriptor A security descriptor of the parent object that is being created. [in] _ExplicitDescriptor An explicit security descriptor that is applied to a new object. [out] NewDescriptor The new allocated security descriptor. [in] ObjectType The type of the new object. [in] IsDirectoryObject Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE. [in] AutoInheritFlags Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited. [in] SubjectContext Security subject context of the new object. [in] GenericMapping Generic mapping of access mask rights. [in] PoolType This parameter is unused.
- Returns
- Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.
- Parameters
-
[in] ParentDescriptor A security descriptor of the parent object that is being created. [in] ExplicitDescriptor An explicit security descriptor that is applied to a new object. [out] NewDescriptor The new allocated security descriptor. [in] IsDirectoryObject Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE. [in] SubjectContext Security subject context of the new object. [in] GenericMapping Generic mapping of access mask rights. [in] PoolType This parameter is unused.
- Returns
- See SeAssignSecurityEx.
- Parameters
-
[in] SecurityDescriptor A security descriptor. [out] QuotaInfoSize The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.
- Returns
- Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.
Definition at line 923 of file Messaging.c.
75{
76 PFLT_SERVER_PORT_OBJECT PortObject;
78
79 /* The caller must allow at least one connection */
81 {
83 }
84
85 /* The request must be for a kernel handle */
87 {
89 }
90
91 /*
92 * Get rundown protection on the target to stop the owner
93 * from unloading whilst this port object is open. It gets
94 * removed in the FltpServerPortClose callback
95 */
98 {
100 }
101
102 /* Create the server port object for this filter */
104 ServerPortObjectType,
105 ObjectAttributes,
106 KernelMode,
107 NULL,
109 0,
110 0,
111 (PVOID *)&PortObject);
113 {
114 /* Zero out the struct */
116
117 /* Increment the ref count on the target filter */
119
120 /* Setup the filter port object */
127
128 /* Insert the object */
130 NULL,
132 0,
133 NULL,
136 {
137 /* Lock the connection list */
139
140 /* Add the new port object to the connection list and increment the count */
143
144 /* Unlock the connection list*/
146 }
147 }
148
150 {
151 /* Allow the filter to be cleaned up */
153 }
154
156}
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback
Definition: fltkernel.h:1877
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback
Definition: fltkernel.h:1875
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID ServerPortCookie
Definition: fltkernel.h:1874
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback
Definition: fltkernel.h:1876
ULONG FltpObjectPointerReference(_In_ PFLT_OBJECT Object)
Definition: Object.c:322
Definition: nsiface.idl:2307
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
Definition: obhandle.c:2957
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
Definition: oblife.c:1040
Definition: fltmgrint.h:26
Definition: fltmgrint.h:189
PFLT_DISCONNECT_NOTIFY DisconnectNotify
Definition: fltmgrint.h:192
◆ NtAlertResumeThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtAlertResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ NtAlertThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtAlertThread | ( | _In_ HANDLE | ThreadHandle | ) |
◆ NtApphelpCacheControl()
| NTSYSCALLAPI NTSTATUS NTAPI NtApphelpCacheControl | ( | _In_ APPHELPCACHESERVICECLASS | Service, |
| _In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP | ServiceData | ||
| ) |
Definition at line 728 of file apphelp.c.
731{
735
737 {
740 }
742 {
748 break;
754 break;
759 {
763 }
764 break;
766 /* FIXME: Check for admin or system here. */
768 break;
771 break;
774 ApphelpCacheFlush();
777 break;
781 break;
782 default:
784 break;
785 }
787 {
789 }
791}
NTSTATUS ApphelpCacheRemoveEntry(_In_ PUNICODE_STRING ImageName)
Definition: apphelp.c:587
VOID ApphelpFreeUnicodeString(_Inout_ PUNICODE_STRING String)
Definition: apphelp.c:161
NTSTATUS ApphelpCacheUpdateEntry(_In_ PUNICODE_STRING ImageName, _In_ HANDLE ImageHandle)
Definition: apphelp.c:616
NTSTATUS ApphelpValidateData(_In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP ServiceData, _Out_ PUNICODE_STRING ImageName, _Out_ PHANDLE ImageHandle)
Definition: apphelp.c:474
NTSTATUS ApphelpCacheLookupEntry(_In_ PUNICODE_STRING ImageName, _In_ HANDLE ImageHandle)
Definition: apphelp.c:531
Definition: env_spec_w32.h:368
Referenced by BaseDumpAppcompatCache(), BaseFlushAppcompatCache(), BasepShimCacheRemoveEntry(), BasepShimCacheSearch(), and CallApphelp().
◆ NtAssignProcessToJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtAssignProcessToJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ HANDLE | ProcessHandle | ||
| ) |
◆ NtCreateJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateJobObject | ( | _Out_ PHANDLE | JobHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes | ||
| ) |
◆ NtCreateJobSet()
| NTSTATUS NTAPI NtCreateJobSet | ( | _In_ ULONG | NumJob, |
| _In_ PJOB_SET_ARRAY | UserJobSet, | ||
| _In_ ULONG | Flags | ||
| ) |
◆ NtCreateProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ BOOLEAN | InheritObjectTable, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort | ||
| ) |
◆ NtCreateProcessEx()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcessEx | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ ULONG | Flags, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort, | ||
| _In_ BOOLEAN | InJob | ||
| ) |
◆ NtCreateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtCreateThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ProcessHandle, | ||
| _Out_ PCLIENT_ID | ClientId, | ||
| _In_ PCONTEXT | ThreadContext, | ||
| _In_ PINITIAL_TEB | UserStack, | ||
| _In_ BOOLEAN | CreateSuspended | ||
| ) |
◆ NtCurrentTeb()
| FORCEINLINE struct _TEB * NtCurrentTeb | ( | VOID | ) |
Definition at line 420 of file psfuncs.h.
421{
422#if defined(_M_IX86)
424#elif defined (_M_AMD64)
426#elif defined (_M_ARM)
427 // return (struct _TEB *)KeGetPcr()->Used_Self;
429#elif defined (_M_ARM64)
431// #elif defined(_M_PPC)
432// return (struct _TEB *)_read_teb_dword(0x18);
433#else
434#error Unsupported architecture
435#endif
436}
PPC_QUAL unsigned long __readfsdword(const unsigned long Offset)
Definition: intrin_ppc.h:382
Definition: compat.h:710
Definition: compat.h:836
◆ NtImpersonateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtImpersonateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ HANDLE | ThreadToImpersonate, | ||
| _In_ PSECURITY_QUALITY_OF_SERVICE | SecurityQualityOfService | ||
| ) |
◆ NtIsProcessInJob()
| NTSYSCALLAPI NTSTATUS NTAPI NtIsProcessInJob | ( | _In_ HANDLE | ProcessHandle, |
| _In_opt_ HANDLE | JobHandle | ||
| ) |
◆ NtOpenProcess()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_opt_ PCLIENT_ID | ClientId | ||
| ) |
◆ NtOpenProcessToken()
| _Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcessToken | ( | _In_ HANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
◆ NtOpenThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ PCLIENT_ID | ClientId | ||
| ) |
◆ NtOpenThreadToken()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadToken | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Opens a token that is tied to a thread handle.
- Parameters
-
[out] ThreadHandle Thread handle where the token is about to be opened. [in] DesiredAccess The request access right for the token. [in] OpenAsSelf If set to TRUE, the access check will be made with the security context of the process of the calling thread (opening as self). Otherwise the access check will be made with the security context of the calling thread instead. [out] TokenHandle The opened token handle returned to the caller for use.
- Returns
- See NtOpenThreadTokenEx.
Definition at line 2475 of file token.c.
2480{
2482 TokenHandle);
2483}
NTSTATUS NTAPI NtOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2332
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2664
Referenced by BaseGetNamedObjectDirectory(), CheckTokenMembership(), CreateProcessAsUserCommon(), CsrGetProcessLuid(), GetCallerLuid(), LsarSetSecurityObject(), NetpGetClientLogonId(), NpGetUserNamep(), OpenThreadToken(), RSetServiceObjectSecurity(), RtlDefaultNpAcl(), RtlNewSecurityGrantedAccess(), RtlpGetImpersonationToken(), and START_TEST().
◆ NtOpenThreadTokenEx()
| NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadTokenEx | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _In_ ULONG | HandleAttributes, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Opens a token that is tied to a thread handle.
- Parameters
-
[out] ThreadHandle Thread handle where the token is about to be opened. [in] DesiredAccess The request access right for the token. [in] OpenAsSelf If set to TRUE, the access check will be made with the security context of the process of the calling thread (opening as self). Otherwise the access check will be made with the security context of the calling thread instead. [in] HandleAttributes Handle attributes for the opened thread token handle. [out] TokenHandle The opened token handle returned to the caller for use.
- Returns
- Returns STATUS_SUCCESS if the function has successfully opened the thread token. STATUS_CANT_OPEN_ANONYMOUS is returned if a token has SecurityAnonymous as impersonation level and we cannot open it. A failure NTSTATUS code is returned otherwise.
Definition at line 2332 of file token.c.
2338{
2340 HANDLE hToken;
2348
2349 PAGED_CODE();
2350
2352
2353 /* Ensure that we can give the handle to the caller */
2355 {
2356 _SEH2_TRY
2357 {
2359 }
2361 {
2362 /* Return the exception code */
2364 }
2365 _SEH2_END;
2366 }
2367
2368 /* Validate object attributes */
2370
2371 /*
2372 * At first open the thread token for information access and verify
2373 * that the token associated with the thread is valid.
2374 */
2377 NULL);
2379 {
2382 }
2383
2384 /* Reference the token from the thread */
2386 &ImpersonationLevel);
2388 {
2392 }
2393
2394 /* Ensure the token has no anonymous security */
2396 {
2401 }
2402
2403 /* Revert to self if OpenAsSelf is specified */
2405 {
2407 &ImpersonationState);
2408 }
2409
2410 /* Call the private function to do the job */
2412 ThreadHandle,
2413 Token,
2414 DesiredAccess,
2415 HandleAttributes,
2416 EffectiveOnly,
2417 CopyOnOpen,
2418 ImpersonationLevel,
2419 PreviousMode,
2420 &hToken);
2421
2422 /* Restore the impersonation back if needed */
2423 if (RestoreImpersonation)
2424 {
2426 }
2427
2428 /* Dereference the access token and the associated thread */
2431
2433 {
2436 }
2437
2438 /* Give the opened token handle to the caller */
2439 _SEH2_TRY
2440 {
2441 *TokenHandle = hToken;
2442 }
2444 {
2446 }
2447 _SEH2_END;
2448
2450}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
Definition: KdSystemDebugControl.c:35
Definition: tokenizer.hpp:28
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG HandleAttributes
Definition: obfuncs.h:442
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ BOOLEAN EffectiveOnly
Definition: sefuncs.h:410
BOOLEAN NTAPI PsDisableImpersonation(IN PETHREAD Thread, OUT PSE_IMPERSONATION_STATE ImpersonationState)
Definition: security.c:937
VOID NTAPI PsRestoreImpersonation(IN PETHREAD Thread, IN PSE_IMPERSONATION_STATE ImpersonationState)
Definition: security.c:987
PACCESS_TOKEN NTAPI PsReferenceImpersonationToken(IN PETHREAD Thread, OUT PBOOLEAN CopyOnOpen, OUT PBOOLEAN EffectiveOnly, OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
Definition: security.c:871
static NTSTATUS SepOpenThreadToken(_In_ PETHREAD Thread, _In_ HANDLE ThreadHandle, _In_ PTOKEN ThreadToken, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ BOOLEAN EffectiveOnly, _In_ BOOLEAN CopyOnOpen, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _In_ KPROCESSOR_MODE PreviousMode, _Out_ PHANDLE OpenedTokenHandle)
Internal private function that returns an opened handle of an access token associated with a thread.
Definition: token.c:1170
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
Definition: ob_x.h:22
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:493
Definition: pstypes.h:1197
Definition: setypes.h:115
Definition: setypes.h:216
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
Definition: psfuncs.h:157
◆ NtQueryInformationJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _Out_bytecap_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength, | ||
| _Out_ PULONG | ReturnLength | ||
| ) |
◆ NtQueryInformationProcess()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Definition at line 211 of file query.c.
218{
223
224 PAGED_CODE();
225
226 /* Validate the information class */
228 PsProcessInfoClass,
230 ICIF_PROBE_READ,
231 ProcessInformation,
232 ProcessInformationLength,
233 ReturnLength,
234 NULL,
235 PreviousMode);
237 {
238#if DBG
239 DPRINT1("NtQueryInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
240 PspDumpProcessInfoClassName(ProcessInformationClass), Status);
241#endif
243 }
244
246 (ProcessInformationClass == ProcessImageInformation)) &&
248 {
249 /*
250 * Retrieving the process cookie is only allowed for the calling process
251 * itself! XP only allows NtCurrentProcess() as process handles even if
252 * a real handle actually represents the current process.
253 */
255 }
256
257 /* Check the information class */
258 switch (ProcessInformationClass)
259 {
260 /* Basic process information */
262 {
264
266 {
268 break;
269 }
270
271 /* Set the return length */
273
274 /* Reference the process */
277 PsProcessType,
278 PreviousMode,
280 NULL);
282
283 /* Protect writes with SEH */
284 _SEH2_TRY
285 {
286 /* Write all the information from the EPROCESS/KPROCESS */
291 UniqueProcessId;
292 ProcessBasicInfo->InheritedFromUniqueProcessId =
295
296 }
298 {
299 /* Get exception code */
301 }
302 _SEH2_END;
303
304 /* Dereference the process */
306 break;
307 }
308
309 /* Process quota limits */
311 {
312 QUOTA_LIMITS_EX QuotaLimits;
313 BOOLEAN Extended;
314
317 {
319 break;
320 }
321
322 /* Set the return length */
323 Length = ProcessInformationLength;
325
326 /* Reference the process */
329 PsProcessType,
330 PreviousMode,
332 NULL);
334
335 /* Indicate success */
337
339
340 /* Get max/min working set sizes */
341 QuotaLimits.MaximumWorkingSetSize =
343 QuotaLimits.MinimumWorkingSetSize =
345
346 /* Get default time limits */
348
349 /* Is quota block a default one? */
351 {
352 /* Get default pools and pagefile limits */
356 }
357 else
358 {
359 /* Get limits from non-default quota block */
360 QuotaLimits.PagedPoolLimit =
362 QuotaLimits.NonPagedPoolLimit =
364 QuotaLimits.PagefileLimit =
366 }
367
368 /* Get additional information, if needed */
369 if (Extended)
370 {
375
376 /* FIXME: Get the correct information */
377 //QuotaLimits.WorkingSetLimit = (SIZE_T)-1; // Not used on Win2k3, it is set to 0
379 }
380
381 /* Protect writes with SEH */
382 _SEH2_TRY
383 {
385 }
387 {
388 /* Get exception code */
390 }
391 _SEH2_END;
392
393 /* Dereference the process */
395 break;
396 }
397
399 {
401 PROCESS_VALUES ProcessValues;
402
404 {
406 break;
407 }
408
410
411 /* Reference the process */
414 PsProcessType,
415 PreviousMode,
417 NULL);
419
420 /* Query IO counters from the process */
422
423 _SEH2_TRY
424 {
426 }
428 {
429 /* Ignore exception */
430 }
431 _SEH2_END;
432
433 /* Set status to success in any case */
435
436 /* Dereference the process */
438 break;
439 }
440
441 /* Timing */
443 {
446
447 /* Set the return length */
449 {
451 break;
452 }
453
455
456 /* Reference the process */
459 PsProcessType,
460 PreviousMode,
462 NULL);
464
465 /* Protect writes with SEH */
466 _SEH2_TRY
467 {
468 /* Copy time information from EPROCESS/KPROCESS */
474 }
476 {
477 /* Get exception code */
479 }
480 _SEH2_END;
481
482 /* Dereference the process */
484 break;
485 }
486
487 /* Process Debug Port */
489
491 {
493 break;
494 }
495
496 /* Set the return length */
498
499 /* Reference the process */
502 PsProcessType,
503 PreviousMode,
505 NULL);
507
508 /* Protect write with SEH */
509 _SEH2_TRY
510 {
511 /* Return whether or not we have a debug port */
514 }
516 {
517 /* Get exception code */
519 }
520 _SEH2_END;
521
522 /* Dereference the process */
524 break;
525
527 {
529
531 {
533 break;
534 }
535
536 /* Set the return length*/
538
539 /* Reference the process */
542 PsProcessType,
543 PreviousMode,
545 NULL);
547
548 /* Count the number of handles this process has */
550
551 /* Protect write in SEH */
552 _SEH2_TRY
553 {
554 /* Return the count of handles */
556 }
558 {
559 /* Get the exception code */
561 }
562 _SEH2_END;
563
564 /* Dereference the process */
566 break;
567 }
568
569 /* Session ID for the process */
571 {
573
575 {
577 break;
578 }
579
580 /* Set the return length*/
582
583 /* Reference the process */
586 PsProcessType,
587 PreviousMode,
589 NULL);
591
592 /* Enter SEH for write safety */
593 _SEH2_TRY
594 {
595 /* Write back the Session ID */
597 }
599 {
600 /* Get the exception code */
602 }
603 _SEH2_END;
604
605 /* Dereference the process */
607 break;
608 }
609
610 /* Virtual Memory Statistics */
612 {
614
615 /* Validate the input length */
618 {
620 break;
621 }
622
623 /* Reference the process */
626 PsProcessType,
627 PreviousMode,
629 NULL);
631
632 /* Enter SEH for write safety */
633 _SEH2_TRY
634 {
635 /* Return data from EPROCESS */
647 //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
648 //
649
650 /* Set the return length */
651 Length = ProcessInformationLength;
652 }
654 {
655 /* Get the exception code */
657 }
658 _SEH2_END;
659
660 /* Dereference the process */
662 break;
663 }
664
665 /* Hard Error Processing Mode */
667
669 {
671 break;
672 }
673
674 /* Set the return length*/
676
677 /* Reference the process */
680 PsProcessType,
681 PreviousMode,
683 NULL);
685
686 /* Enter SEH for writing back data */
687 _SEH2_TRY
688 {
689 /* Write the current processing mode */
691 DefaultHardErrorProcessing;
692 }
694 {
695 /* Get the exception code */
697 }
698 _SEH2_END;
699
700 /* Dereference the process */
702 break;
703
704 /* Priority Boosting status */
706
708 {
710 break;
711 }
712
713 /* Set the return length */
715
716 /* Reference the process */
719 PsProcessType,
720 PreviousMode,
722 NULL);
724
725 /* Enter SEH for writing back data */
726 _SEH2_TRY
727 {
728 /* Return boost status */
731 }
733 {
734 /* Get the exception code */
736 }
737 _SEH2_END;
738
739 /* Dereference the process */
741 break;
742
743 /* DOS Device Map */
745 {
747
749 {
750 /* Protect read in SEH */
751 _SEH2_TRY
752 {
753 PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
754
756 }
758 {
759 /* Get the exception code */
762 }
763 _SEH2_END;
764
765 /* Only one flag is supported and it needs LUID mappings */
767 !ObIsLUIDDeviceMapsEnabled())
768 {
770 break;
771 }
772 }
773 else
774 {
775 /* This has to be the size of the Query union field for x64 compatibility! */
777 {
779 break;
780 }
781
782 /* No flags for standard call */
783 Flags = 0;
784 }
785
786 /* Set the return length */
787 Length = ProcessInformationLength;
788
789 /* Reference the process */
792 PsProcessType,
793 PreviousMode,
795 NULL);
797
798 /* Query the device map information */
800 ProcessInformation,
801 Flags);
802
803 /* Dereference the process */
805 break;
806 }
807
808 /* Priority class */
810 {
812
814 {
816 break;
817 }
818
819 /* Set the return length*/
821
822 /* Reference the process */
825 PsProcessType,
826 PreviousMode,
828 NULL);
830
831 /* Enter SEH for writing back data */
832 _SEH2_TRY
833 {
834 /* Return current priority class */
837 }
839 {
840 /* Get the exception code */
842 }
843 _SEH2_END;
844
845 /* Dereference the process */
847 break;
848 }
849
851 {
853
854 /* Reference the process */
857 PsProcessType,
858 PreviousMode,
860 NULL);
862
863 /* Get the image path */
866 {
867 /* Set the return length */
870
871 /* Make sure it's large enough */
873 {
874 /* Enter SEH to protect write */
875 _SEH2_TRY
876 {
877 /* Copy it */
878 RtlCopyMemory(ProcessInformation,
879 ImageName,
880 Length);
881
882 /* Update pointer */
883 ((PUNICODE_STRING)ProcessInformation)->Buffer =
885 }
887 {
888 /* Get the exception code */
890 }
891 _SEH2_END;
892 }
893 else
894 {
895 /* Buffer too small */
897 }
898
899 /* Free the image path */
901 }
902 /* Dereference the process */
904 break;
905 }
906
907#if (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
909 {
912
913 /* Reference the process */
915 // FIXME: Use PROCESS_QUERY_LIMITED_INFORMATION when implemented
917 PsProcessType,
918 PreviousMode,
920 NULL);
922 {
923 break;
924 }
925
926 /* Get the image path */
930 {
931 break;
932 }
936 {
937 break;
938 }
939
940 /* Determine return length and output */
943 {
944 _SEH2_TRY
945 {
950 {
953 ObjectNameInformation->Name.Buffer,
954 ObjectNameInformation->Name.MaximumLength);
955 }
956 else
957 {
960 }
961 }
963 {
965 }
966 _SEH2_END;
967 }
968 else
969 {
971 }
973
974 break;
975 }
976#endif /* (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA) */
977
979
981 {
983 break;
984 }
985
986 /* Set the return length*/
988
989 /* Reference the process */
992 PsProcessType,
993 PreviousMode,
995 NULL);
997
998 /* Enter SEH for writing back data */
999 _SEH2_TRY
1000 {
1001 /* Return the debug flag state */
1003 }
1005 {
1006 /* Get the exception code */
1008 }
1009 _SEH2_END;
1010
1011 /* Dereference the process */
1013 break;
1014
1016
1018 {
1020 break;
1021 }
1022
1023 /* Set the return length */
1025
1026 /* Reference the process */
1029 PsProcessType,
1030 PreviousMode,
1032 NULL);
1034
1035 /* Enter SEH for writing back data */
1036 _SEH2_TRY
1037 {
1038 /* Return the BreakOnTermination state */
1040 }
1042 {
1043 /* Get the exception code */
1045 }
1046 _SEH2_END;
1047
1048 /* Dereference the process */
1050 break;
1051
1052 /* Per-process security cookie */
1054 {
1056
1058 {
1059 /* Length size wrong, bail out */
1061 break;
1062 }
1063
1064 /* Get the current process and cookie */
1068 {
1069 LARGE_INTEGER SystemTime;
1070 ULONG NewCookie;
1071 PKPRCB Prcb;
1072
1073 /* Generate a new cookie */
1074 KeQuerySystemTime(&SystemTime);
1075 Prcb = KeGetCurrentPrcb();
1078
1079 /* Set the new cookie or return the current one */
1081 NewCookie,
1082 Cookie);
1084
1085 /* Set the return length */
1087 }
1088
1089 /* Indicate success */
1091
1092 /* Enter SEH to protect write */
1093 _SEH2_TRY
1094 {
1095 /* Write back the cookie */
1097 }
1099 {
1100 /* Get the exception code */
1102 }
1103 _SEH2_END;
1104 break;
1105 }
1106
1108
1110 {
1111 /* Break out */
1113 break;
1114 }
1115
1116 /* Set the length required and validate it */
1118
1119 /* Indicate success */
1121
1122 /* Enter SEH to protect write */
1123 _SEH2_TRY
1124 {
1126 }
1128 {
1129 /* Get the exception code */
1131 }
1132 _SEH2_END;
1133 break;
1134
1136 {
1138
1140 {
1142 break;
1143 }
1144
1145 /* Set the return length */
1147
1148 /* Reference the process */
1151 PsProcessType,
1152 PreviousMode,
1154 NULL);
1156
1157 /* Get the debug port. Continue even if this fails. */
1159
1160 /* Let go of the process */
1162
1163 /* Protect write in SEH */
1164 _SEH2_TRY
1165 {
1166 /* Return debug port's handle */
1167 *(PHANDLE)ProcessInformation = DebugPort;
1168 }
1170 {
1171 if (DebugPort)
1173
1174 /* Get the exception code.
1175 * Note: This overwrites any previous failure status. */
1177 }
1178 _SEH2_END;
1179 break;
1180 }
1181
1185 break;
1186
1188
1190 {
1192 break;
1193 }
1194
1195 /* Set the return length */
1197
1198 /* Indicate success */
1200
1201 /* Protect write in SEH */
1202 _SEH2_TRY
1203 {
1204 /* Query Ob */
1206 }
1208 {
1209 /* Get the exception code */
1211 }
1212 _SEH2_END;
1213 break;
1214
1216
1218 {
1220 break;
1221 }
1222
1223 /* Set the return length */
1225
1226 /* Reference the process */
1229 PsProcessType,
1230 PreviousMode,
1232 NULL);
1234
1235 /* Protect write in SEH */
1236 _SEH2_TRY
1237 {
1238 /* Return if the flag is set */
1240 }
1242 {
1243 /* Get the exception code */
1245 }
1246 _SEH2_END;
1247
1248 /* Dereference the process */
1250 break;
1251
1253 {
1254 ULONG_PTR Wow64 = 0;
1255
1257 {
1259 break;
1260 }
1261
1262 /* Set the return length */
1264
1265 /* Reference the process */
1268 PsProcessType,
1269 PreviousMode,
1271 NULL);
1273
1274#if defined(_WIN64) && defined(BUILD_WOW64_ENABLED)
1275 /* Make sure the process isn't dying */
1277 {
1278 /* FIXME: A two-part hack: delay setting Process->Wow64Process,
1279 so 64-bit NTDLL can use IO to init stuff. */
1281 {
1283 Process->Wow64Process = ExAllocatePoolWithTag(NonPagedPool, sizeof(WOW64_PROCESS), TAG_PS_WOW64);
1285 {
1287
1290 }
1291 else
1292 {
1293 Process->Wow64Process->Wow64 = (PVOID)((ULONG_PTR)(Process->Peb) + ROUND_TO_PAGES(sizeof(PEB)));
1294 }
1295 }
1296
1297 /* Get the WOW64 process structure */
1299 {
1300 Wow64 = 0;
1301 }
1302 /* FIXME */
1304 {
1305 Wow64 = TRUE;
1306 }
1307 else
1308 {
1310 }
1311
1312 /* Release the lock */
1314 }
1315#endif
1316
1317 /* Dereference the process */
1319
1320 /* Protect write with SEH */
1321 _SEH2_TRY
1322 {
1323 /* Return the Wow64 process information */
1324 *(PULONG_PTR)ProcessInformation = Wow64;
1325 }
1327 {
1328 /* Get exception code */
1330 }
1331 _SEH2_END;
1332 break;
1333 }
1334
1336 {
1337 ULONG ExecuteOptions = 0;
1338
1340 {
1342 break;
1343 }
1344
1345 /* Set the return length */
1347
1349 {
1351 break;
1352 }
1353
1354 /* Get the options */
1357 {
1358 /* Protect write with SEH */
1359 _SEH2_TRY
1360 {
1361 /* Return them */
1362 *(PULONG)ProcessInformation = ExecuteOptions;
1363 }
1365 {
1366 /* Get exception code */
1368 }
1369 _SEH2_END;
1370 }
1371 break;
1372 }
1373
1377 break;
1378
1382 break;
1383
1387 break;
1388
1389 /* Not supported by Server 2003 */
1390 default:
1391#if DBG
1393#endif
1395 }
1396
1397 /* Check if caller wants the return length and if there is one */
1399 {
1400 /* Protect write with SEH */
1401 _SEH2_TRY
1402 {
1404 }
1406 {
1407 /* Get exception code.
1408 * Note: This overwrites any previous failure status. */
1410 }
1411 _SEH2_END;
1412 }
1413
1415}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
Definition: KdSystemDebugControl.c:34
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
Definition: dbgkobj.c:1526
struct _UNICODE_STRING UNICODE_STRING
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
struct _IO_COUNTERS * PIO_COUNTERS
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
Definition: procobj.c:860
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
Definition: procobj.c:525
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
Definition: section.c:1623
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
Definition: pagfault.c:2669
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
Definition: probe.h:219
NTSTATUS NTAPI IoQueryFileDosDeviceName(IN PFILE_OBJECT FileObject, OUT POBJECT_NAME_INFORMATION *ObjectNameInformation)
Definition: file.c:3662
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
Definition: process.c:1163
NTSTATUS NTAPI PsReferenceProcessFilePointer(_In_ PEPROCESS Process, _Outptr_ PFILE_OBJECT *FileObject)
Definition: query.c:24
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
Definition: audit.c:199
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
Definition: obhandle.c:56
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
Definition: devicemap.c:539
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3406
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the non paged pool quota of a given process.
Definition: quota.c:811
VOID NTAPI PsReturnProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the non paged quota pool that the process was taking up.
Definition: quota.c:938
Definition: pstypes.h:1368
Definition: pstypes.h:82
Definition: winternl.h:2373
Definition: ketypes.h:660
Definition: nt_native.h:1272
Definition: btrfs_drv.h:1907
Definition: winternl.h:404
ULONG_PTR InheritedFromUniqueProcessId
Definition: pstypes.h:362
Definition: pstypes.h:392
Definition: pstypes.h:380
Definition: pstypes.h:1045
Definition: pstypes.h:405
Definition: ke.h:45
Definition: pstypes.h:67
Definition: lsa.idl:286
Definition: mmtypes.h:340
Definition: mmdrv.h:130
Definition: winternl.h:3130
SIZE_T QuotaPeakNonPagedPoolUsage
Definition: winternl.h:3138
Definition: ke.h:15
Definition: typedefs.h:103
struct _LARGE_INTEGER::@2524 u
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
struct _VM_COUNTERS * PVM_COUNTERS
struct _VM_COUNTERS_EX VM_COUNTERS_EX
#define ROUND_TO_PAGES(Size)
◆ NtQueryInformationThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Definition at line 3017 of file query.c.
3024{
3028 ULONG Access;
3030
3031 PAGED_CODE();
3032
3033 /* Validate the information class */
3035 PsThreadInfoClass,
3037 ICIF_PROBE_READ,
3038 ThreadInformation,
3039 ThreadInformationLength,
3040 ReturnLength,
3041 NULL,
3042 PreviousMode);
3044 {
3045#if DBG
3046 DPRINT1("NtQueryInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
3048#endif
3050 }
3051
3052 /* Check what class this is */
3053 Access = THREAD_QUERY_INFORMATION;
3054
3055 /* Check what kind of information class this is */
3057 {
3058 /* Basic thread information */
3060 {
3061 PTHREAD_BASIC_INFORMATION ThreadBasicInfo =
3062 (PTHREAD_BASIC_INFORMATION)ThreadInformation;
3063
3064 /* Set the return length */
3066
3068 {
3070 break;
3071 }
3072
3073 /* Reference the thread */
3075 Access,
3076 PsThreadType,
3077 PreviousMode,
3079 NULL);
3081 break;
3082
3083 /* Protect writes with SEH */
3084 _SEH2_TRY
3085 {
3086 /* Write all the information from the ETHREAD/KTHREAD */
3093 }
3095 {
3096 /* Get exception code */
3098 }
3099 _SEH2_END;
3100
3101 /* Dereference the thread */
3103 break;
3104 }
3105
3106 /* Thread time information */
3108 {
3110
3111 /* Set the return length */
3113
3115 {
3117 break;
3118 }
3119
3120 /* Reference the thread */
3122 Access,
3123 PsThreadType,
3124 PreviousMode,
3126 NULL);
3128 break;
3129
3130 /* Protect writes with SEH */
3131 _SEH2_TRY
3132 {
3133 /* Copy time information from ETHREAD/KTHREAD */
3137
3138 /* Exit time is in a union and only valid on actual exit! */
3140 {
3142 }
3143 else
3144 {
3146 }
3147 }
3149 {
3150 /* Get exception code */
3152 }
3153 _SEH2_END;
3154
3155 /* Dereference the thread */
3157 break;
3158 }
3159
3161 {
3162 /* Set the return length*/
3164
3166 {
3168 break;
3169 }
3170
3171 /* Reference the thread */
3173 Access,
3174 PsThreadType,
3175 PreviousMode,
3177 NULL);
3179 break;
3180
3181 /* Protect write with SEH */
3182 _SEH2_TRY
3183 {
3184 /* Return the Win32 Start Address */
3186 }
3188 {
3189 /* Get exception code */
3191 }
3192 _SEH2_END;
3193
3194 /* Dereference the thread */
3196 break;
3197 }
3198
3200 {
3201 /* Set the return length*/
3203
3205 {
3207 break;
3208 }
3209
3210 /* Reference the thread */
3212 Access,
3213 PsThreadType,
3214 PreviousMode,
3216 NULL);
3218 break;
3219
3220 /* Protect write with SEH */
3221 _SEH2_TRY
3222 {
3223 /* FIXME */
3224 (*(PLARGE_INTEGER)ThreadInformation).QuadPart = 0;
3225 }
3227 {
3228 /* Get exception code */
3230 }
3231 _SEH2_END;
3232
3233 /* Dereference the thread */
3235 break;
3236 }
3237
3239 {
3240 /* Set the return length*/
3242
3244 {
3246 break;
3247 }
3248
3249 /* Reference the thread */
3251 Access,
3252 PsThreadType,
3253 PreviousMode,
3255 NULL);
3257 break;
3258
3259 /* Protect write with SEH */
3260 _SEH2_TRY
3261 {
3262 /* Return whether or not we are the last thread */
3265 &Thread->ThreadsProcess->
3266 ThreadListHead) ?
3268 }
3270 {
3271 /* Get exception code */
3273 }
3274 _SEH2_END;
3275
3276 /* Dereference the thread */
3278 break;
3279 }
3280
3282 {
3284
3285 /* Set the return length*/
3287
3289 {
3291 break;
3292 }
3293
3294 /* Reference the thread */
3296 Access,
3297 PsThreadType,
3298 PreviousMode,
3300 NULL);
3302 break;
3303
3304 /* Raise the IRQL to protect the IRP list */
3306
3307 /* Protect write with SEH */
3308 _SEH2_TRY
3309 {
3310 /* Check if the IRP list is empty or not */
3312 }
3314 {
3315 /* Get exception code */
3317 }
3318 _SEH2_END;
3319
3320 /* Lower IRQL back */
3322
3323 /* Dereference the thread */
3325 break;
3326 }
3327
3328 /* LDT and GDT information */
3330 {
3331#if defined(_X86_)
3332 /* Reference the thread */
3334 Access,
3335 PsThreadType,
3336 PreviousMode,
3338 NULL);
3340 break;
3341
3342 /* Call the worker routine */
3344 ThreadInformation,
3345 ThreadInformationLength,
3346 ReturnLength);
3347
3348 /* Dereference the thread */
3350#else
3351 /* Only implemented on x86 */
3353#endif
3354 break;
3355 }
3356
3358 {
3359 /* Set the return length*/
3361
3363 {
3365 break;
3366 }
3367
3368 /* Reference the thread */
3370 Access,
3371 PsThreadType,
3372 PreviousMode,
3374 NULL);
3376 break;
3377
3378 _SEH2_TRY
3379 {
3381 }
3383 {
3385 }
3386 _SEH2_END;
3387
3388 /* Dereference the thread */
3390 break;
3391 }
3392
3393#if (NTDDI_VERSION >= NTDDI_VISTA)
3395 {
3396 /* Set the return length */
3398
3400 {
3402 break;
3403 }
3404
3405 /* Reference the thread */
3407 Access,
3408 PsThreadType,
3409 PreviousMode,
3411 NULL);
3413 break;
3414
3415 /* Protect write with SEH */
3416 _SEH2_TRY
3417 {
3419 }
3421 {
3422 /* Get exception code */
3424 }
3425 _SEH2_END;
3426
3427 /* Dereference the thread */
3429 break;
3430 }
3431#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
3432
3434 {
3435 /* Set the return length */
3437
3439 {
3441 break;
3442 }
3443
3444 /* Reference the thread */
3446 Access,
3447 PsThreadType,
3448 PreviousMode,
3450 NULL);
3452 break;
3453
3454 _SEH2_TRY
3455 {
3457 }
3459 {
3461 }
3462 _SEH2_END;
3463
3464 /* Dereference the thread */
3466 break;
3467 }
3468
3470 {
3471 ULONG ThreadTerminated;
3472
3473 /* Set the return length*/
3475
3477 {
3479 break;
3480 }
3481
3482 /* Reference the thread */
3484 Access,
3485 PsThreadType,
3486 PreviousMode,
3488 NULL);
3490 break;
3491
3493
3494 _SEH2_TRY
3495 {
3496 *(PULONG)ThreadInformation = ThreadTerminated ? 1 : 0;
3497 }
3499 {
3501 }
3502 _SEH2_END;
3503
3504 /* Dereference the thread */
3506 break;
3507 }
3508
3509#if (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__)
3511 {
3512 PUNICODE_STRING ThreadName;
3513
3514 /* Reference the thread */
3516 // FIXME: Use THREAD_QUERY_LIMITED_INFORMATION when implemented
3517 THREAD_QUERY_INFORMATION,
3518 PsThreadType,
3519 PreviousMode,
3521 NULL);
3523 break;
3524
3526
3528
3529 /* Set the return length (REMARK: We only
3530 * consider Length instead of MaximumLength) */
3534 {
3538 /* As on Windows, and *not* STATUS_INFO_LENGTH_MISMATCH */
3539 break;
3540 }
3541
3542 /* Protect writes with SEH */
3543 _SEH2_TRY
3544 {
3545 PTHREAD_NAME_INFORMATION NameInfo =
3546 (PTHREAD_NAME_INFORMATION)ThreadInformation;
3548 {
3553 ThreadName->Buffer,
3554 ThreadName->Length);
3555 }
3556 else
3557 {
3559 }
3560 }
3562 {
3563 /* Get exception code */
3565 }
3566 _SEH2_END;
3567
3569
3570 /* Dereference the thread */
3572 break;
3573 }
3574#endif /* (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__) */
3575
3576 /* Anything else */
3577 default:
3578 /* Not yet implemented */
3579#if DBG
3581#endif
3583 }
3584
3585 /* Protect write with SEH */
3586 _SEH2_TRY
3587 {
3588 /* Check if caller wanted return length */
3590 }
3592 {
3593 /* Get exception code */
3595 }
3596 _SEH2_END;
3597
3599}
struct _THREAD_BASIC_INFORMATION THREAD_BASIC_INFORMATION
struct _THREAD_BASIC_INFORMATION * PTHREAD_BASIC_INFORMATION
struct _THREAD_NAME_INFORMATION * PTHREAD_NAME_INFORMATION
_In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength
Definition: psfuncs.h:844
LONG NTAPI KeQueryBasePriorityThread(IN PKTHREAD Thread)
Definition: thrdobj.c:52
BOOLEAN NTAPI PsIsThreadTerminating(IN PETHREAD Thread)
Definition: thread.c:868
FORCEINLINE VOID PspUnlockThreadSecurityShared(IN PETHREAD Thread)
Definition: ps_x.h:166
FORCEINLINE VOID PspLockThreadSecurityShared(IN PETHREAD Thread)
Definition: ps_x.h:155
NTSTATUS NTAPI PspQueryDescriptorThread(IN PETHREAD Thread, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
Definition: psldt.c:43
Definition: compat.h:926
Definition: pstypes.h:1095
union _LARGE_INTEGER LARGE_INTEGER
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
Definition: kefuncs.h:778
◆ NtRegisterThreadTerminatePort()
| NTSYSCALLAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort | ( | _In_ HANDLE | TerminationPort | ) |
◆ NtResumeProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtResumeProcess | ( | _In_ HANDLE | ProcessHandle | ) |
◆ NtResumeThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ NtSetInformationJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _In_bytecount_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength | ||
| ) |
◆ NtSetInformationProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_reads_bytes_(ProcessInformationLength) PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
Definition at line 1422 of file query.c.
1427{
1430 ACCESS_MASK Access;
1436 PROCESS_PRIORITY_CLASS PriorityClass = {0};
1437 PROCESS_FOREGROUND_BACKGROUND Foreground = {0};
1438 PVOID ExceptionPort;
1439 ULONG Break;
1441 KPRIORITY BasePriority = 0;
1442 UCHAR MemoryPriority = 0;
1443 BOOLEAN DisableBoost = 0;
1444 ULONG DefaultHardErrorMode = 0;
1445 ULONG DebugFlags = 0, EnableFixup = 0, Boost = 0;
1446 ULONG NoExecute = 0, VdmPower = 0;
1450 PAGED_CODE();
1451
1452 /* Validate the information class */
1454 PsProcessInfoClass,
1456 ProcessInformation,
1457 ProcessInformationLength,
1458 PreviousMode);
1460 {
1461#if DBG
1462 DPRINT1("NtSetInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
1463 PspDumpProcessInfoClassName(ProcessInformationClass), Status);
1464#endif
1466 }
1467
1468 /* Check what class this is */
1469 Access = PROCESS_SET_INFORMATION;
1471 {
1472 /* Setting the Session ID needs a special mask */
1473 Access |= PROCESS_SET_SESSIONID;
1474 }
1476 {
1477 /* Setting the exception port needs a special mask */
1478 Access |= PROCESS_SUSPEND_RESUME;
1479 }
1480
1481 /* Reference the process */
1483 Access,
1484 PsProcessType,
1485 PreviousMode,
1487 NULL);
1489
1490 /* Check what kind of information class this is */
1491 switch (ProcessInformationClass)
1492 {
1494
1495 /* Check buffer length */
1497 {
1499 break;
1500 }
1501
1502 /* Use SEH for capture */
1503 _SEH2_TRY
1504 {
1505 /* Capture the boolean */
1506 VdmPower = *(PULONG)ProcessInformation;
1507 }
1509 {
1510 /* Get the exception code */
1513 }
1514 _SEH2_END;
1515
1516 /* Getting VDM powers requires the SeTcbPrivilege */
1518 {
1519 /* We don't hold the privilege, bail out */
1522 break;
1523 }
1524
1525 /* Set or clear the flag */
1526 if (VdmPower)
1527 {
1529 }
1530 else
1531 {
1533 }
1534 break;
1535
1536 /* Error/Exception Port */
1538
1539 /* Check buffer length */
1541 {
1543 break;
1544 }
1545
1546 /* Use SEH for capture */
1547 _SEH2_TRY
1548 {
1549 /* Capture the handle */
1550 PortHandle = *(PHANDLE)ProcessInformation;
1551 }
1553 {
1554 /* Get the exception code */
1557 }
1558 _SEH2_END;
1559
1560 /* Setting the error port requires the SeTcbPrivilege */
1562 {
1563 /* We don't hold the privilege, bail out */
1565 break;
1566 }
1567
1568 /* Get the LPC Port */
1570 0,
1571 LpcPortObjectType,
1572 PreviousMode,
1573 (PVOID)&ExceptionPort,
1574 NULL);
1576
1577 /* Change the pointer */
1579 ExceptionPort,
1580 NULL))
1581 {
1582 /* We already had one, fail */
1583 ObDereferenceObject(ExceptionPort);
1585 }
1586 break;
1587
1588 /* Security Token */
1590
1591 /* Check buffer length */
1593 {
1595 break;
1596 }
1597
1598 /* Use SEH for capture */
1599 _SEH2_TRY
1600 {
1601 /* Save the token handle */
1603 Token;
1604 }
1606 {
1607 /* Get the exception code */
1610 }
1611 _SEH2_END;
1612
1613 /* Assign the actual token */
1615 break;
1616
1617 /* Hard error processing */
1619
1620 /* Check buffer length */
1622 {
1624 break;
1625 }
1626
1627 /* Enter SEH for direct buffer read */
1628 _SEH2_TRY
1629 {
1630 DefaultHardErrorMode = *(PULONG)ProcessInformation;
1631 }
1633 {
1634 /* Get exception code */
1637 }
1638 _SEH2_END;
1639
1640 /* Set the mode */
1641 Process->DefaultHardErrorProcessing = DefaultHardErrorMode;
1642
1643 /* Call Ke for the update */
1645 {
1647 }
1648 else
1649 {
1651 }
1653 break;
1654
1655 /* Session ID */
1657
1658 /* Check buffer length */
1660 {
1662 break;
1663 }
1664
1665 /* Enter SEH for capture */
1666 _SEH2_TRY
1667 {
1668 /* Capture the caller's buffer */
1670 }
1672 {
1673 /* Get the exception code */
1676 }
1677 _SEH2_END;
1678
1679 /* Setting the session id requires the SeTcbPrivilege */
1681 {
1682 /* We don't hold the privilege, bail out */
1684 break;
1685 }
1686
1687 /*
1688 * Since we cannot change the session ID of the given
1689 * process anymore because it is set once and for all
1690 * at process creation time and because it is stored
1691 * inside the Process->Session structure managed by MM,
1692 * we fake changing it: we just return success if the
1693 * user-defined value is the same as the session ID of
1694 * the process, and otherwise we fail.
1695 */
1697 {
1699 }
1700 else
1701 {
1703 }
1704
1705 break;
1706
1708
1709 /* Check buffer length */
1711 {
1713 break;
1714 }
1715
1716 /* Enter SEH for capture */
1717 _SEH2_TRY
1718 {
1719 /* Capture the caller's buffer */
1720 PriorityClass = *(PPROCESS_PRIORITY_CLASS)ProcessInformation;
1721 }
1723 {
1724 /* Return the exception code */
1727 }
1728 _SEH2_END;
1729
1730 /* Check for invalid PriorityClass value */
1732 {
1734 break;
1735 }
1736
1739 {
1740 /* Check the privilege */
1742 ProcessHandle,
1743 PROCESS_SET_INFORMATION,
1744 PreviousMode);
1746 {
1750 }
1751 }
1752
1753 /* Check if we have a job */
1755 {
1757 }
1758
1759 /* Set process priority class */
1761
1762 /* Set process priority mode (foreground or background) */
1764 PriorityClass.Foreground ?
1765 PsProcessPriorityForeground :
1766 PsProcessPriorityBackground);
1768 break;
1769
1771
1772 /* Check buffer length */
1774 {
1776 break;
1777 }
1778
1779 /* Enter SEH for capture */
1780 _SEH2_TRY
1781 {
1782 /* Capture the caller's buffer */
1783 Foreground = *(PPROCESS_FOREGROUND_BACKGROUND)ProcessInformation;
1784 }
1786 {
1787 /* Return the exception code */
1790 }
1791 _SEH2_END;
1792
1793 /* Set process priority mode (foreground or background) */
1795 Foreground.Foreground ?
1796 PsProcessPriorityForeground :
1797 PsProcessPriorityBackground);
1799 break;
1800
1802
1803 /* Validate input length */
1805 {
1807 break;
1808 }
1809
1810 /* Enter SEH for direct buffer read */
1811 _SEH2_TRY
1812 {
1813 BasePriority = *(KPRIORITY*)ProcessInformation;
1814 }
1816 {
1817 /* Get exception code */
1818 Break = 0;
1821 }
1822 _SEH2_END;
1823
1824 /* Extract the memory priority out of there */
1825 if (BasePriority & 0x80000000)
1826 {
1827 MemoryPriority = MEMORY_PRIORITY_FOREGROUND;
1828 BasePriority &= ~0x80000000;
1829 }
1830 else
1831 {
1832 MemoryPriority = MEMORY_PRIORITY_BACKGROUND;
1833 }
1834
1835 /* Validate the number */
1837 {
1840 }
1841
1842 /* Check if the new base is higher */
1844 {
1846 ProcessHandle,
1847 PROCESS_SET_INFORMATION,
1848 PreviousMode);
1850 {
1852 DPRINT1("Privilege to change priority from %lx to %lx lacking\n", Process->Pcb.BasePriority, BasePriority);
1854 }
1855 }
1856
1857 /* Call Ke */
1859
1860 /* Now set the memory priority */
1863 break;
1864
1866
1867 /* Validate input length */
1869 {
1871 break;
1872 }
1873
1874 /* Enter SEH for direct buffer read */
1875 _SEH2_TRY
1876 {
1877 Boost = *(PULONG)ProcessInformation;
1878 }
1880 {
1881 /* Get exception code */
1882 Break = 0;
1885 }
1886 _SEH2_END;
1887
1888 /* Make sure the process isn't dying */
1890 {
1891 /* Lock it */
1892 KeEnterCriticalRegion();
1894
1895 /* Loop the threads */
1899 {
1900 /* Call Ke for the thread */
1903 }
1904
1905 /* Release the lock and rundown */
1907 KeLeaveCriticalRegion();
1909
1910 /* Set success code */
1912 }
1913 else
1914 {
1915 /* Avoid race conditions */
1917 }
1918 break;
1919
1921
1922 /* Check buffer length */
1924 {
1926 break;
1927 }
1928
1929 /* Enter SEH for direct buffer read */
1930 _SEH2_TRY
1931 {
1932 Break = *(PULONG)ProcessInformation;
1933 }
1935 {
1936 /* Get exception code */
1937 Break = 0;
1940 }
1941 _SEH2_END;
1942
1943 /* Setting 'break on termination' requires the SeDebugPrivilege */
1945 {
1946 /* We don't hold the privilege, bail out */
1948 break;
1949 }
1950
1951 /* Set or clear the flag */
1952 if (Break)
1953 {
1955 }
1956 else
1957 {
1959 }
1960
1961 break;
1962
1964
1965 /* Check buffer length */
1967 {
1969 break;
1970 }
1971
1972 /* Enter SEH for direct buffer read */
1973 _SEH2_TRY
1974 {
1976 }
1978 {
1979 /* Get exception code */
1980 Break = 0;
1983 }
1984 _SEH2_END;
1985
1986 /* Make sure it's valid for the CPUs present */
1989 {
1991 break;
1992 }
1993
1994 /* Check if it's within job affinity limits */
1996 {
1997 /* Not yet implemented */
1998 UNIMPLEMENTED;
2000 break;
2001 }
2002
2003 /* Make sure the process isn't dying */
2005 {
2006 /* Lock it */
2007 KeEnterCriticalRegion();
2009
2010 /* Call Ke to do the work */
2012
2013 /* Release the lock and rundown */
2015 KeLeaveCriticalRegion();
2017
2018 /* Set success code */
2020 }
2021 else
2022 {
2023 /* Avoid race conditions */
2025 }
2026 break;
2027
2028 /* Priority Boosting status */
2030
2031 /* Validate input length */
2033 {
2035 break;
2036 }
2037
2038 /* Enter SEH for direct buffer read */
2039 _SEH2_TRY
2040 {
2041 DisableBoost = *(PBOOLEAN)ProcessInformation;
2042 }
2044 {
2045 /* Get exception code */
2046 Break = 0;
2049 }
2050 _SEH2_END;
2051
2052 /* Make sure the process isn't dying */
2054 {
2055 /* Lock it */
2056 KeEnterCriticalRegion();
2058
2059 /* Call Ke to do the work */
2061
2062 /* Loop the threads too */
2066 {
2067 /* Call Ke for the thread */
2070 }
2071
2072 /* Release the lock and rundown */
2074 KeLeaveCriticalRegion();
2076
2077 /* Set success code */
2079 }
2080 else
2081 {
2082 /* Avoid race conditions */
2084 }
2085 break;
2086
2088
2089 /* Check buffer length */
2091 {
2093 break;
2094 }
2095
2096 /* Enter SEH for direct buffer read */
2097 _SEH2_TRY
2098 {
2099 DebugFlags = *(PULONG)ProcessInformation;
2100 }
2102 {
2103 /* Get exception code */
2106 }
2107 _SEH2_END;
2108
2109 /* Set the mode */
2110 if (DebugFlags & ~1)
2111 {
2113 }
2114 else
2115 {
2116 if (DebugFlags & 1)
2117 {
2119 }
2120 else
2121 {
2123 }
2124 }
2125
2126 /* Done */
2128 break;
2129
2131
2132 /* Check buffer length */
2134 {
2136 break;
2137 }
2138
2139 /* Enter SEH for direct buffer read */
2140 _SEH2_TRY
2141 {
2142 EnableFixup = *(PULONG)ProcessInformation;
2143 }
2145 {
2146 /* Get exception code */
2149 }
2150 _SEH2_END;
2151
2152 /* Set the mode */
2153 if (EnableFixup)
2154 {
2156 }
2157 else
2158 {
2159 Process->DefaultHardErrorProcessing &= ~SEM_NOALIGNMENTFAULTEXCEPT;
2160 }
2161
2162 /* Call Ke for the update */
2165 break;
2166
2168
2169 /* Only TCB can do this */
2171 {
2172 /* We don't hold the privilege, bail out */
2175 break;
2176 }
2177
2178 /* Only supported on x86 */
2179#if defined (_X86_)
2180 Ke386SetIOPL();
2181#elif defined(_M_AMD64)
2182 /* On x64 this function isn't implemented.
2183 On Windows 2003 it returns success.
2184 On Vista+ it returns STATUS_NOT_IMPLEMENTED. */
2186 (RtlRosGetAppcompatVersion() > _WIN32_WINNT_WS03))
2187 {
2189 }
2190#else
2192#endif
2193 /* Done */
2194 break;
2195
2197
2198 /* Check buffer length */
2200 {
2202 break;
2203 }
2204
2206 {
2208 break;
2209 }
2210
2211 /* Enter SEH for direct buffer read */
2212 _SEH2_TRY
2213 {
2214 NoExecute = *(PULONG)ProcessInformation;
2215 }
2217 {
2218 /* Get exception code */
2221 }
2222 _SEH2_END;
2223
2224 /* Call Mm for the update */
2226 break;
2227
2229
2230 /* Check buffer length */
2232 {
2234 break;
2235 }
2236
2237 /* Use SEH for capture */
2238 _SEH2_TRY
2239 {
2240 /* Capture the handle */
2242 }
2244 {
2245 /* Get the exception code */
2248 }
2249 _SEH2_END;
2250
2251 /* Call Ob to set the device map */
2253 break;
2254
2255
2256 /* We currently don't implement any of these */
2262 break;
2263
2265
2267 1,
2268 ProcessInformation,
2269 ProcessInformationLength,
2270 PreviousMode);
2271 break;
2272
2276 break;
2277
2281 break;
2282
2283 /* Anything else is invalid */
2284 default:
2285#if DBG
2286 DPRINT1("Invalid Server 2003 Info Class: %s\n", PspDumpProcessInfoClassName(ProcessInformationClass));
2287#endif
2289 }
2290
2291 /* Dereference and return status */
2294}
FORCEINLINE VOID ExAcquirePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1108
FORCEINLINE VOID ExReleasePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1216
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
Definition: pstypes.h:108
struct _PROCESS_FOREGROUND_BACKGROUND * PPROCESS_FOREGROUND_BACKGROUND
#define LOW_PRIORITY
#define HIGH_PRIORITY
#define InterlockedCompareExchangePointer
Definition: interlocked.h:144
struct _PROCESS_ACCESS_TOKEN * PPROCESS_ACCESS_TOKEN
KAFFINITY NTAPI KeSetAffinityProcess(IN PKPROCESS Process, IN KAFFINITY Affinity)
Definition: procobj.c:265
BOOLEAN NTAPI KeSetDisableBoostProcess(IN PKPROCESS Process, IN BOOLEAN Disable)
Definition: procobj.c:331
BOOLEAN NTAPI KeSetDisableBoostThread(IN OUT PKTHREAD Thread, IN BOOLEAN Disable)
Definition: thrdobj.c:86
BOOLEAN NTAPI KeSetAutoAlignmentProcess(IN PKPROCESS Process, IN BOOLEAN Enable)
Definition: procobj.c:313
VOID NTAPI KeBoostPriorityThread(IN PKTHREAD Thread, IN KPRIORITY Increment)
Definition: thrdobj.c:220
KPRIORITY NTAPI KeSetPriorityAndQuantumProcess(IN PKPROCESS Process, IN KPRIORITY Priority, IN UCHAR Quantum OPTIONAL)
Definition: procobj.c:349
NTSTATUS NTAPI MmSetExecuteOptions(IN ULONG ExecuteOptions)
Definition: pagfault.c:2711
NTSTATUS NTAPI MmSetMemoryPriorityProcess(IN PEPROCESS Process, IN UCHAR MemoryPriority)
Definition: procsup.c:543
static __inline NTSTATUS DefaultSetInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ PVOID Buffer, _In_ ULONG BufferLength, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtSet*** system call is invoked from u...
Definition: probe.h:70
BOOLEAN NTAPI SeCheckPrivilegedObject(_In_ LUID PrivilegeValue, _In_ HANDLE ObjectHandle, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE PreviousMode)
Checks a privileged object if such object has the specific privilege submitted by the caller.
Definition: priv.c:803
VOID NTAPI PsSetProcessPriorityByClass(IN PEPROCESS Process, IN PSPROCESSPRIORITYMODE Type)
Definition: process.c:1325
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
Definition: priv.c:744
NTSTATUS NTAPI ObSetDeviceMap(IN PEPROCESS Process, IN HANDLE DirectoryHandle)
Definition: devicemap.c:24
NTSTATUS NTAPI PspSetPrimaryToken(IN PEPROCESS Process, IN HANDLE TokenHandle OPTIONAL, IN PACCESS_TOKEN Token OPTIONAL)
Definition: security.c:215
NTSTATUS NTAPI PspSetQuotaLimits(_In_ PEPROCESS Process, _In_ ULONG Unused, _In_ PVOID QuotaLimits, _In_ ULONG QuotaLimitsLength, _In_ KPROCESSOR_MODE PreviousMode)
This function adjusts the working set limits of a process and sets up new quota limits when necessary...
Definition: quota.c:1045
STDMETHOD() Next(THIS_ ULONG celt, IAssociationElement *pElement, ULONG *pceltFetched) PURE
Definition: typedefs.h:120
Definition: ntddk.h:9
Definition: pstypes.h:1054
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
Definition: halfuncs.h:174
Referenced by _main(), CreateProcessInternalW(), CSR_API(), CsrCreateProcess(), CsrpSetDefaultProcessHardErrorMode(), CsrSbCreateSession(), CsrSetBackgroundPriority(), CsrSetForegroundPriority(), CsrSetToNormalPriority(), CsrSetToShutdownPriority(), EmptyWorkingSet(), InitFunctionPtrs(), InitializeProcessForWsWatch(), InsertTokenToProcessCommon(), LdrpInitializeProcess(), QuerySetProcessValidator(), SetErrorMode(), SetPriorityClass(), SetProcessAffinityMask(), SetProcessInformation(), SetProcessPriorityBoost(), SetProcessWorkingSetSizeEx(), SmpInit(), SmpSbCreateSession(), SmpSetProcessMuSessionId(), test_exec_memory_writes(), Test_ProcBasePriorityClass(), test_process_instrumentation_callback(), Test_ProcessWx86InformationClass(), Test_ProcForegroundBackgroundClass(), and Test_ProcRaisePriorityClass().
◆ NtSetInformationThread()
| __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _In_reads_bytes_(ThreadInformationLength) PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength | ||
| ) |
Definition at line 2301 of file query.c.
2306{
2312 PTEB Teb;
2313
2314 PAGED_CODE();
2315
2316 /* Validate the information class */
2318 PsThreadInfoClass,
2320 ThreadInformation,
2321 ThreadInformationLength,
2322 PreviousMode);
2324 {
2325#if DBG
2326 DPRINT1("NtSetInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
2328#endif
2330 }
2331
2332 /* Check what kind of information class this is */
2334 {
2335 /* Thread priority */
2337 {
2338 /* Check buffer length */
2340 {
2342 break;
2343 }
2344
2345 /* Use SEH for capture */
2346 _SEH2_TRY
2347 {
2348 /* Get the priority */
2350 }
2352 {
2353 /* Get the exception code */
2356 }
2357 _SEH2_END;
2358
2359 /* Validate it */
2362 {
2363 /* Fail */
2365 break;
2366 }
2367
2368 /* Check for the required privilege */
2370 {
2373 ThreadHandle,
2374 THREAD_SET_INFORMATION,
2375 PreviousMode);
2377 {
2380 }
2381 }
2382
2383 /* Reference the thread */
2385 THREAD_SET_INFORMATION,
2386 PsThreadType,
2387 PreviousMode,
2389 NULL);
2391 break;
2392
2393 /* Set the priority */
2395
2396 /* Dereference the thread */
2398 break;
2399 }
2400
2402 {
2403 /* Check buffer length */
2405 {
2407 break;
2408 }
2409
2410 /* Use SEH for capture */
2411 _SEH2_TRY
2412 {
2413 /* Get the priority */
2415 }
2417 {
2418 /* Get the exception code */
2421 }
2422 _SEH2_END;
2423
2424 /* Validate it */
2427 {
2428 /* These ones are OK */
2431 {
2432 /* Check if the process is real time */
2435 {
2436 /* It isn't, fail */
2438 break;
2439 }
2440 }
2441 }
2442
2443 /* Reference the thread */
2445 THREAD_SET_INFORMATION,
2446 PsThreadType,
2447 PreviousMode,
2449 NULL);
2451 break;
2452
2453 /* Set the base priority */
2455
2456 /* Dereference the thread */
2458 break;
2459 }
2460
2462 {
2464
2465 /* Check buffer length */
2467 {
2469 break;
2470 }
2471
2472 /* Use SEH for capture */
2473 _SEH2_TRY
2474 {
2475 /* Get the priority */
2477 }
2479 {
2480 /* Get the exception code */
2483 }
2484 _SEH2_END;
2485
2486 /* Validate it */
2488 {
2489 /* Fail */
2491 break;
2492 }
2493
2494 /* Reference the thread */
2496 THREAD_SET_INFORMATION,
2497 PsThreadType,
2498 PreviousMode,
2500 NULL);
2502 break;
2503
2504 /* Get the process */
2506
2507 /* Try to acquire rundown */
2509 {
2510 /* Lock it */
2511 KeEnterCriticalRegion();
2513
2514 /* Combine masks */
2517 {
2518 /* Fail */
2520 }
2521 else
2522 {
2523 /* Set the affinity */
2525 }
2526
2527 /* Release the lock and rundown */
2529 KeLeaveCriticalRegion();
2531 }
2532 else
2533 {
2534 /* Too late */
2536 }
2537
2538 /* Dereference the thread */
2540 break;
2541 }
2542
2544 {
2546
2547 /* Check buffer length */
2549 {
2551 break;
2552 }
2553
2554 /* Use SEH for capture */
2555 _SEH2_TRY
2556 {
2557 /* Save the token handle */
2559 }
2561 {
2562 /* Get the exception code */
2565 }
2566 _SEH2_END;
2567
2568 /* Reference the thread */
2570 THREAD_SET_THREAD_TOKEN,
2571 PsThreadType,
2572 PreviousMode,
2574 NULL);
2576 break;
2577
2578 /* Assign the actual token */
2580
2581 /* Dereference the thread */
2583 break;
2584 }
2585
2587 {
2589
2590 /* Check buffer length */
2592 {
2594 break;
2595 }
2596
2597 /* Use SEH for capture */
2598 _SEH2_TRY
2599 {
2600 /* Get the priority */
2602 }
2604 {
2605 /* Get the exception code */
2608 }
2609 _SEH2_END;
2610
2611 /* Reference the thread */
2613 THREAD_SET_INFORMATION,
2614 PsThreadType,
2615 PreviousMode,
2617 NULL);
2619 break;
2620
2621 /* Set the address */
2623
2624 /* Dereference the thread */
2626 break;
2627 }
2628
2630 {
2631 ULONG_PTR IdealProcessor;
2632
2633 /* Check buffer length */
2635 {
2637 break;
2638 }
2639
2640 /* Use SEH for capture */
2641 _SEH2_TRY
2642 {
2643 /* Get the priority */
2644 IdealProcessor = *(PULONG_PTR)ThreadInformation;
2645 }
2647 {
2648 /* Get the exception code */
2651 }
2652 _SEH2_END;
2653
2654 /* Validate it */
2656 {
2657 /* Fail */
2659 break;
2660 }
2661
2662 /* Reference the thread */
2664 THREAD_SET_INFORMATION,
2665 PsThreadType,
2666 PreviousMode,
2668 NULL);
2670 break;
2671
2672 /* Set the ideal */
2674 (CCHAR)IdealProcessor);
2675
2676 /* Get the TEB and protect the thread */
2679 {
2680 /* Save the ideal processor */
2682
2683 /* Release rundown protection */
2685 }
2686
2687 /* Dereference the thread */
2689 break;
2690 }
2691
2693 {
2694 ULONG_PTR DisableBoost;
2695
2696 /* Check buffer length */
2698 {
2700 break;
2701 }
2702
2703 /* Use SEH for capture */
2704 _SEH2_TRY
2705 {
2706 /* Get the priority */
2707 DisableBoost = *(PULONG_PTR)ThreadInformation;
2708 }
2710 {
2711 /* Get the exception code */
2714 }
2715 _SEH2_END;
2716
2717 /* Reference the thread */
2719 THREAD_SET_INFORMATION,
2720 PsThreadType,
2721 PreviousMode,
2723 NULL);
2725 break;
2726
2727 /* Call the kernel */
2729
2730 /* Dereference the thread */
2732 break;
2733 }
2734
2736 {
2738 PETHREAD ProcThread;
2739
2740 /* Check buffer length */
2742 {
2744 break;
2745 }
2746
2747 /* Use SEH for capture */
2748 _SEH2_TRY
2749 {
2750 /* Get the priority */
2752 }
2754 {
2755 /* Get the exception code */
2758 }
2759 _SEH2_END;
2760
2761 /* Reference the thread */
2763 THREAD_SET_INFORMATION,
2764 PsThreadType,
2765 PreviousMode,
2767 NULL);
2769 break;
2770
2771 /* This is only valid for the current thread */
2773 {
2774 /* Fail */
2777 break;
2778 }
2779
2780 /* Get the process */
2782
2783 /* Loop the threads */
2785 while (ProcThread)
2786 {
2787 /* Acquire rundown */
2789 {
2790 /* Get the TEB */
2792 if (Teb)
2793 {
2794 /* Check if we're in the expansion range */
2796 {
2798 TLS_EXPANSION_SLOTS) - 1)
2799 {
2800 /* Check if we have expansion slots */
2802 if (ExpansionSlots)
2803 {
2804 /* Clear the index */
2806 }
2807 }
2808 }
2809 else
2810 {
2811 /* Clear the index */
2813 }
2814 }
2815
2816 /* Release rundown */
2818 }
2819
2820 /* Go to the next thread */
2822 }
2823
2824 /* Dereference the thread */
2826 break;
2827 }
2828
2830 {
2831 ULONG Break;
2832
2833 /* Check buffer length */
2835 {
2837 break;
2838 }
2839
2840 /* Enter SEH for direct buffer read */
2841 _SEH2_TRY
2842 {
2843 Break = *(PULONG)ThreadInformation;
2844 }
2846 {
2847 /* Get exception code */
2848 Break = 0;
2851 }
2852 _SEH2_END;
2853
2854 /* Setting 'break on termination' requires the SeDebugPrivilege */
2856 {
2857 /* We don't hold the privilege, bail out */
2859 break;
2860 }
2861
2862 /* Reference the thread */
2864 THREAD_SET_INFORMATION,
2865 PsThreadType,
2866 PreviousMode,
2868 NULL);
2870 break;
2871
2872 /* Set or clear the flag */
2873 if (Break)
2874 {
2876 }
2877 else
2878 {
2880 }
2881
2882 /* Dereference the thread */
2884 break;
2885 }
2886
2888 {
2889 /* Check buffer length */
2891 {
2893 break;
2894 }
2895
2896 /* Reference the thread */
2898 THREAD_SET_INFORMATION,
2899 PsThreadType,
2900 PreviousMode,
2902 NULL);
2904 break;
2905
2906 /* Set the flag */
2908
2909 /* Dereference the thread */
2911 break;
2912 }
2913
2914#if (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__)
2916 {
2917 UNICODE_STRING CapturedThreadName;
2918 PUNICODE_STRING NewThreadName;
2919
2920 /* Check buffer length */
2922 {
2924 break;
2925 }
2926
2927 /* Reference the thread.
2928 * NOTE: Win10+ uses THREAD_SET_LIMITED_INFORMATION instead;
2929 * however some tools misuse thread names to perform suspicious
2930 * operations; therefore we try to mess with these by requiring
2931 * a bit more of access rights. */
2933 THREAD_SET_INFORMATION,
2934 PsThreadType,
2935 PreviousMode,
2937 NULL);
2939 break;
2940
2941 /* Probe and capture the thread name */
2943 PreviousMode,
2944 (PUNICODE_STRING)ThreadInformation);
2946 {
2948 break;
2949 }
2950
2951 /* Allocate a new buffer only if the thread name isn't empty
2952 * (REMARK: We only consider Length instead of MaximumLength).
2953 * If empty, just reset the thread name pointer to NULL instead
2954 * of allocating an empty UNICODE_STRING. */
2955 NewThreadName = NULL;
2957 {
2961 if (!NewThreadName)
2962 {
2964 }
2965 else
2966 {
2967 /* Copy the new thread name */
2968 NewThreadName->Length =
2972 CapturedThreadName.Buffer,
2973 CapturedThreadName.Length);
2974 }
2975 }
2976
2977 /* Free the captured string */
2979
2980 /* Replace the original thread name with the new one */
2982 {
2983 PUNICODE_STRING OldThreadName;
2988
2989 /* Free the old thread name */
2990 if (OldThreadName)
2992 }
2993
2994 /* Dereference the thread */
2996 break;
2997 }
2998#endif /* (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__) */
2999
3000 /* Anything else */
3001 default:
3002 /* Not yet implemented */
3003#if DBG
3005#endif
3007 }
3008
3010}
#define LOW_REALTIME_PRIORITY
NTSTATUS NTAPI PsAssignImpersonationToken(IN PETHREAD Thread, IN HANDLE TokenHandle)
Definition: security.c:502
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
Definition: process.c:75
FORCEINLINE VOID PspLockThreadSecurityExclusive(IN PETHREAD Thread)
Definition: ps_x.h:177
FORCEINLINE VOID PspUnlockThreadSecurityExclusive(IN PETHREAD Thread)
Definition: ps_x.h:188
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239
UCHAR NTAPI KeSetIdealProcessorThread(IN PKTHREAD Thread, IN UCHAR Processor)
Definition: thrdobj.c:1066
LONG NTAPI KeSetBasePriorityThread(IN PKTHREAD Thread, IN LONG Increment)
Definition: thrdobj.c:1157
KPRIORITY NTAPI KeSetPriorityThread(IN PKTHREAD Thread, IN KPRIORITY Priority)
Definition: thrdobj.c:1300
KAFFINITY NTAPI KeSetAffinityThread(IN PKTHREAD Thread, IN KAFFINITY Affinity)
Definition: thrdobj.c:1276
_In_ WDFINTERRUPT _In_ WDF_INTERRUPT_POLICY _In_ WDF_INTERRUPT_PRIORITY Priority
Definition: wdfinterrupt.h:655
◆ NtSuspendProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtSuspendProcess | ( | _In_ HANDLE | ProcessHandle | ) |
◆ NtSuspendThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtSuspendThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ PULONG | PreviousSuspendCount | ||
| ) |
◆ NtTerminateJobObject()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ NtTerminateProcess()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ NtTerminateThread()
| NTSYSCALLAPI NTSTATUS NTAPI NtTerminateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ NTSTATUS | ExitStatus | ||
| ) |
◆ PsChargePoolQuota()
| NTKERNELAPI VOID NTAPI PsChargePoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the PoolType parameter.
- Parameters
-
[in] Process The process which quota is to be charged. [in] PoolType The pool type to choose to charge quotas (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to charge into a process.
- Returns
- Nothing.
- Remarks
- The function raises an exception if STATUS_QUOTA_EXCEEDED status code is returned. Callers are responsible on their own to handle the raised exception.
Definition at line 775 of file quota.c.
779{
782
783 /* Don't do anything for the system process */
785
786 /* Charge the usage */
789}
NTSTATUS NTAPI PsChargeProcessPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
Definition: quota.c:872
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
Definition: wdfdevice.h:3821
Referenced by FsRtlCancelNotify(), and FsRtlNotifyFilterReportChange().
◆ PsChargeProcessNonPagedPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Charges the non paged pool quota of a given process.
- Parameters
-
[in] Process The process which non paged quota is to be charged. [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 811 of file quota.c.
814{
815 /* Call the general function */
817}
Referenced by MiCreatePebOrTeb(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), NtAllocateVirtualMemory(), NtFreeVirtualMemory(), NtQueryInformationProcess(), and START_TEST().
◆ PsChargeProcessPagedPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Charges the paged pool quota of a given process.
- Parameters
-
[in] Process The process which paged quota is to be charged. [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 839 of file quota.c.
842{
843 /* Call the general function */
845}
Referenced by ExpAllocateHandleTable(), ExpAllocateTablePagedPool(), ExpAllocateTablePagedPoolNoZero(), and START_TEST().
◆ PsChargeProcessPoolQuota()
| NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
- Parameters
-
[in] Process The process which quota is to be charged. [in] PoolType The type of quota pool to charge (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to charge into a process.
- Returns
- Returns STATUS_SUCCESS if quota charing has suceeded, STATUS_QUOTA_EXCEEDED is returned otherwise to indicate the caller attempted to charge quotas over the limits.
Definition at line 872 of file quota.c.
876{
877 /* Don't do anything for the system process */
879
881 Process->QuotaBlock,
883 Amount);
884}
NTSTATUS NTAPI PspChargeProcessQuotaSpecifiedPool(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ PS_QUOTA_TYPE QuotaType, _In_ SIZE_T Amount)
Internal kernel function that provides the bulk logic of process quota charging, necessary for export...
Definition: quota.c:195
Referenced by ExAllocatePoolWithQuotaTag(), PsChargePoolQuota(), PsChargeProcessNonPagedPoolQuota(), and PsChargeProcessPagedPoolQuota().
◆ PsEstablishWin32Callouts()
| NTKERNELAPI VOID NTAPI PsEstablishWin32Callouts | ( | _In_ PWIN32_CALLOUTS_FPNS | CalloutData | ) |
◆ PsGetCurrentProcessSessionId()
| NTKERNELAPI ULONG NTAPI PsGetCurrentProcessSessionId | ( | VOID | ) |
Definition at line 1133 of file process.c.
1134{
1136}
Referenced by ExpWin32SessionCallout(), IntCreateDesktopSwitchEvent(), IntCreateWindowStation(), IntDesktopObjectParse(), IntDestroyMenuObject(), NtSetInformationObject(), NtUserSwitchDesktop(), ObpLookupObjectName(), UserCreateWinstaDirectory(), and VideoPortUseDeviceInSession().
◆ PsGetCurrentProcessWin32Process()
| NTKERNELAPI PVOID NTAPI PsGetCurrentProcessWin32Process | ( | VOID | ) |
Definition at line 1183 of file process.c.
Referenced by _Function_class_(), CheckWinstaAttributeAccess(), co_IntGraphicsCheck(), co_IntSetParent(), co_IntSetWindowLongPtr(), co_IntUserManualGuiCheck(), co_UserDestroyWindow(), DC_bAllocDcAttr(), DC_vFreeDcAttr(), DecrementCurrentProcessGdiHandleCount(), DesktopHeapAddressToUser(), DesktopHeapGetUserDelta(), FontLink_PrepareFontInfo(), GDI_CleanupForProcess(), GetBrushAttrPool(), GetControlColor(), GetFontFamilyInfoForSubstitutes(), GetW32ProcessInfo(), handle_internal_message(), IdlePing(), IdlePong(), IncrementCurrentProcessGdiHandleCount(), IntAllowSetForegroundWindow(), IntFixWindowCoordinates(), IntGdiAddFontMemResource(), IntGdiCleanupPrivateFontsForProcess(), IntGdiLoadFontsFromMemory(), IntGdiRemoveFontMemResource(), IntGdiSetRegionOwner(), IntGetFontFamilyInfo(), IntLoadHookModule(), IntLoadSystenIcons(), IntLockSetForegroundWindow(), IntMapDesktopView(), IntUnmapDesktopView(), IntWinStaOkToClose(), NtUserCallHwndParam(), NtUserCallOneParam(), NtUserDestroyCursor(), NtUserFindExistingCursorIcon(), NtUserGetComboBoxInfo(), NtUserGetListBoxInfo(), NtUserSetSystemCursor(), NtUserSetWindowFNID(), REGION_bAllocRgnAttr(), REGION_vCleanup(), TextIntRealizeFont(), UserDbgAssertThreadInfo(), UserGetDCEx(), UserGetProcessWindowStation(), UserHeapAddressToUser(), UserSetProcessWindowStation(), UserSystemParametersInfo(), and UserUnregisterUserApiHook().
◆ PsGetCurrentThreadProcessId()
| NTKERNELAPI HANDLE NTAPI PsGetCurrentThreadProcessId | ( | VOID | ) |
Definition at line 755 of file thread.c.
Referenced by intDdCreateDirectDrawLocal().
◆ PsGetCurrentThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsGetCurrentThreadWin32Thread | ( | VOID | ) |
Definition at line 805 of file thread.c.
Referenced by AllocateUserMessage(), CaretSystemTimerProc(), co_HOOK_CallHooks(), co_IntActivateKeyboardLayout(), co_IntCallHookProc(), co_IntCallSentMessageCallback(), co_IntCallWindowProc(), co_IntClientLoadLibrary(), co_IntClientThreadSetup(), co_IntCreateDefaultImeWindow(), co_IntFixCaret(), co_IntGetPeekMessage(), co_IntLoadDefaultCursors(), co_IntLoadSysMenuTemplate(), co_IntPaintWindows(), co_IntPeekMessage(), co_IntProcessKeyboardMessage(), co_IntProcessMouseMessage(), co_IntSendActivateMessages(), co_IntSendMessageTimeoutSingle(), co_IntSendMessageWithCallBack(), co_IntSetActiveWindow(), co_IntSetCaretPos(), co_IntSetForegroundAndFocusWindow(), co_IntWaitMessage(), co_MsqDispatchOneSentMessage(), co_MsqReplyMessage(), co_MsqSendMessage(), co_MsqSendMessageAsync(), co_UserDestroyWindow(), co_UserHideCaret(), co_UserSetCapture(), co_UserSetFocus(), co_UserShowCaret(), co_WinPosSearchChildren(), co_WinPosSetWindowPos(), co_WinPosShowWindow(), DECREASE_THREAD_LOCK_COUNT(), DefWndDoSizeMove(), DefWndStartSizeMove(), DesktopHeapGetUserDelta(), DesktopThreadMain(), GetW32ThreadInfo(), handle_internal_message(), IdlePing(), INCREASE_THREAD_LOCK_COUNT(), IntAddAtom(), IntCallWndProc(), IntCallWndProcRet(), IntCbAllocateMemory(), IntCbFreeMemory(), IntCreateDesktop(), IntDeactivateWindow(), IntDefWindowProc(), IntDeRegisterShellHookWindow(), IntDesktopOkToClose(), IntDestroyOwnedWindows(), IntDispatchMessage(), IntDrawScrollBar(), IntGetAndReferenceClass(), IntGetAtomName(), IntGetCapture(), IntGetCurrentThreadDesktopWindow(), IntGetImeCompatFlags(), IntGetNextHook(), IntGetQueueStatus(), IntGetThreadDesktopWindow(), IntGetThreadFocusWindow(), IntInitMessagePumpHook(), IntInvalidateWindows(), IntIsClipboardOpenByMe(), IntMsqClearWakeMask(), IntMsqSetWakeMask(), IntNotifyImeShowStatus(), IntNotifyWinEvent(), IntQueryTrackMouseEvent(), IntRegisterShellHookWindow(), IntReleaseCapture(), IntRemoveHook(), IntSendDestroyMsg(), IntSendSyncPaint(), IntSetThreadDesktop(), IntSetTimer(), IntTrackMouseEvent(), IntTrackPopupMenuEx(), IntTranslateKbdMessage(), IntUnhookWindowsHook(), IntUninitMessagePumpHook(), IntUserSetActiveWindow(), MENU_DoNextMenu(), MENU_InitTracking(), MENU_TrackMenu(), MsqGetMessageExtraInfo(), MsqSetMessageExtraInfo(), NtUserBlockInput(), NtUserCallNoParam(), NtUserCallOneParam(), NtUserCallTwoParam(), NtUserCreateAcceleratorTable(), NtUserCreateCaret(), NtUserGetAppImeLevel(), NtUserGetCaretPos(), NtUserGetGUIThreadInfo(), NtUserGetKeyboardLayoutName(), NtUserGetKeyboardState(), NtUserGetKeyNameText(), NtUserGetThreadState(), NtUserLockWorkStation(), NtUserMapVirtualKeyEx(), NtUserQueryWindow(), NtUserSendInput(), NtUserSetAppImeLevel(), NtUserSetKeyboardState(), NtUserSetThreadState(), NtUserSetWindowsHookEx(), NtUserSetWinEventHook(), NtUserToUnicodeEx(), NtUserValidateTimerCallback(), NtUserVkKeyScanEx(), NtUserWaitForInputIdle(), PostTimerMessages(), UserCreateInputContext(), UserDbgAssertThreadInfo(), UserDerefObjectCo(), UserDestroyMenu(), UserEnterExclusive(), UserGetActiveWindow(), UserGetCPD(), UserGetKeyboardLayout(), UserGetKeyState(), UserGhostThreadEntry(), UserInitialize(), UserOpenClipboard(), UserOpenInputDesktop(), UserRefObjectCo(), UserRegisterHotKey(), UserRegisterUserApiHook(), UserSendKeyboardInput(), UserSendMouseInput(), UserSetActiveWindow(), UserSetCursor(), UserShowCursor(), and UserUnregisterUserApiHook().
◆ PsGetProcessExitProcessCalled()
| NTKERNELAPI BOOLEAN NTAPI PsGetProcessExitProcessCalled | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessExitStatus()
| NTKERNELAPI NTSTATUS NTAPI PsGetProcessExitStatus | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessInheritedFromUniqueProcessId()
◆ PsGetProcessSecurityPort()
| NTKERNELAPI PVOID NTAPI PsGetProcessSecurityPort | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessSessionId()
| NTKERNELAPI ULONG NTAPI PsGetProcessSessionId | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessWin32Process()
| NTKERNELAPI PVOID NTAPI PsGetProcessWin32Process | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetProcessWin32WindowStation()
| NTKERNELAPI PVOID NTAPI PsGetProcessWin32WindowStation | ( | _In_ PEPROCESS | Process | ) |
◆ PsGetThreadFreezeCount()
| NTKERNELAPI ULONG NTAPI PsGetThreadFreezeCount | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadHardErrorsAreDisabled()
| NTKERNELAPI BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadId()
| NTKERNELAPI HANDLE NTAPI PsGetThreadId | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadProcess()
| NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadTeb()
| NTKERNELAPI PTEB NTAPI PsGetThreadTeb | ( | _In_ PETHREAD | Thread | ) |
◆ PsGetThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsGetThreadWin32Thread | ( | _In_ PETHREAD | Thread | ) |
◆ PsIsProtectedProcess()
◆ PsIsSystemProcess()
| NTKERNELAPI BOOLEAN NTAPI PsIsSystemProcess | ( | _In_ PEPROCESS | Process | ) |
◆ PsIsThreadImpersonating()
| NTKERNELAPI BOOLEAN NTAPI PsIsThreadImpersonating | ( | _In_ PETHREAD | Thread | ) |
◆ PsLookupProcessThreadByCid()
| NTKERNELAPI NTSTATUS NTAPI PsLookupProcessThreadByCid | ( | _In_ PCLIENT_ID | Cid, |
| _Out_opt_ PEPROCESS * | Process, | ||
| _Out_ PETHREAD * | Thread | ||
| ) |
◆ PsReturnPoolQuota()
| NTKERNELAPI VOID NTAPI PsReturnPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ POOL_TYPE | PoolType, | ||
| _In_ SIZE_T | Amount | ||
| ) |
Returns the pool quota that the process was taking up.
- Parameters
-
[in] Process The process which quota is to be returned. [in] PoolType The type of quota pool to return (e.g. PagedPool or NonPagedPool). [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 907 of file quota.c.
911{
912 /* Don't do anything for the system process */
914
916 Process->QuotaBlock,
918 Amount);
919}
VOID NTAPI PspReturnProcessQuotaSpecifiedPool(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock, _In_ PS_QUOTA_TYPE QuotaType, _In_ SIZE_T Amount)
Internal kernel function that provides the bulk logic of process quota returning. It returns (takes a...
Definition: quota.c:345
Referenced by ExFreePoolWithTag(), ExReturnPoolQuota(), PsReturnProcessNonPagedPoolQuota(), and PsReturnProcessPagedPoolQuota().
◆ PsReturnProcessNonPagedPoolQuota()
| NTKERNELAPI VOID NTAPI PsReturnProcessNonPagedPoolQuota | ( | _In_ PEPROCESS | Process, |
| _In_ SIZE_T | Amount | ||
| ) |
Returns the non paged quota pool that the process was taking up.
- Parameters
-
[in] Process The process which non paged quota is to be returned. [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 938 of file quota.c.
941{
942 /* Don't do anything for the system process */
944
946}
VOID NTAPI PsReturnPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Returns the pool quota that the process was taking up.
Definition: quota.c:907
Referenced by MiCreatePebOrTeb(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), MiUnmapLockedPagesInUserSpace(), MiUnmapViewOfSection(), MmCleanProcessAddressSpace(), MmDeleteTeb(), NtAllocateVirtualMemory(), NtFreeVirtualMemory(), NtQueryInformationProcess(), PspDeleteProcess(), and START_TEST().
◆ PsReturnProcessPagedPoolQuota()
Returns the paged pool quota that the process was taking up.
- Parameters
-
[in] Process The process which paged pool quota is to be returned. [in] Amount The amount of quotas to return from a process.
- Returns
- Nothing.
Definition at line 965 of file quota.c.
968{
969 /* Don't do anything for the system process */
971
973}
Referenced by ExpAllocateHandleTable(), ExpFreeHandleTable(), ExpFreeTablePagedPool(), FsRtlCancelNotify(), FsRtlNotifyCleanup(), FsRtlNotifyCompleteIrp(), FsRtlNotifyFilterReportChange(), and START_TEST().
◆ PsRevertThreadToSelf()
| NTKERNELAPI VOID NTAPI PsRevertThreadToSelf | ( | _Inout_ PETHREAD | Thread | ) |
◆ PsSetProcessPriorityByClass()
◆ PsSetProcessSecurityPort()
| NTKERNELAPI NTSTATUS NTAPI PsSetProcessSecurityPort | ( | _Inout_ PEPROCESS | Process, |
| _In_ PVOID | SecurityPort | ||
| ) |
◆ PsSetProcessWin32Process()
| NTKERNELAPI NTSTATUS NTAPI PsSetProcessWin32Process | ( | _Inout_ PEPROCESS | Process, |
| _In_opt_ PVOID | Win32Process, | ||
| _In_opt_ PVOID | OldWin32Process | ||
| ) |
Definition at line 1257 of file process.c.
1261{
1263
1264 /* Assume success */
1266
1267 /* Lock the process */
1268 KeEnterCriticalRegion();
1270
1271 /* Check if we set a new win32 process */
1273 {
1274 /* Check if the process is in the right state */
1277 {
1278 /* Set the new win32 process */
1279 Process->Win32Process = Win32Process;
1280 }
1281 else
1282 {
1283 /* Otherwise fail */
1285 }
1286 }
1287 else
1288 {
1289 /* Reset the win32 process, did the caller specify the correct old value? */
1291 {
1292 /* Yes, so reset the win32 process to NULL */
1294 }
1295 else
1296 {
1297 /* Otherwise fail */
1299 }
1300 }
1301
1302 /* Unlock the process */
1304 KeLeaveCriticalRegion();
1305
1307}
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1039
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1255
Referenced by AllocW32Process(), and ExitProcessCallback().
◆ PsSetProcessWindowStation()
| NTKERNELAPI VOID NTAPI PsSetProcessWindowStation | ( | _Inout_ PEPROCESS | Process, |
| _In_opt_ PVOID | WindowStation | ||
| ) |
◆ PsSetThreadHardErrorsAreDisabled()
| NTKERNELAPI VOID NTAPI PsSetThreadHardErrorsAreDisabled | ( | _Inout_ PETHREAD | Thread, |
| _In_ BOOLEAN | Disabled | ||
| ) |
◆ PsSetThreadWin32Thread()
| NTKERNELAPI PVOID NTAPI PsSetThreadWin32Thread | ( | _Inout_ PETHREAD | Thread, |
| _In_opt_ PVOID | Win32Thread, | ||
| _In_opt_ PVOID | OldWin32Thread | ||
| ) |
◆ ZwAlertResumeThread()
| NTSYSAPI NTSTATUS NTAPI ZwAlertResumeThread | ( | _In_ HANDLE | ThreadHandle, |
| _Out_opt_ PULONG | SuspendCount | ||
| ) |
◆ ZwAlertThread()
◆ ZwAssignProcessToJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwAssignProcessToJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ HANDLE | ProcessHandle | ||
| ) |
◆ ZwCreateJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwCreateJobObject | ( | _Out_ PHANDLE | JobHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes | ||
| ) |
◆ ZwCreateProcess()
| NTSYSAPI NTSTATUS NTAPI ZwCreateProcess | ( | _Out_ PHANDLE | ProcessHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ParentProcess, | ||
| _In_ BOOLEAN | InheritObjectTable, | ||
| _In_opt_ HANDLE | SectionHandle, | ||
| _In_opt_ HANDLE | DebugPort, | ||
| _In_opt_ HANDLE | ExceptionPort | ||
| ) |
Referenced by RtlCreateUserProcess().
◆ ZwCreateThread()
| NTSYSAPI NTSTATUS NTAPI ZwCreateThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_opt_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ HANDLE | ProcessHandle, | ||
| _Out_ PCLIENT_ID | ClientId, | ||
| _In_ PCONTEXT | ThreadContext, | ||
| _In_ PINITIAL_TEB | UserStack, | ||
| _In_ BOOLEAN | CreateSuspended | ||
| ) |
Referenced by RtlCreateUserThread().
◆ ZwImpersonateThread()
| NTSYSAPI NTSTATUS NTAPI ZwImpersonateThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ HANDLE | ThreadToImpersonate, | ||
| _In_ PSECURITY_QUALITY_OF_SERVICE | SecurityQualityOfService | ||
| ) |
◆ ZwIsProcessInJob()
◆ ZwOpenThread()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThread | ( | _Out_ PHANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ POBJECT_ATTRIBUTES | ObjectAttributes, | ||
| _In_ PCLIENT_ID | ClientId | ||
| ) |
◆ ZwOpenThreadToken()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThreadToken | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Referenced by IntGetCurrentAccessToken(), RtlAdjustPrivilege(), and RtlpOpenThreadToken().
◆ ZwOpenThreadTokenEx()
| NTSYSAPI NTSTATUS NTAPI ZwOpenThreadTokenEx | ( | _In_ HANDLE | ThreadHandle, |
| _In_ ACCESS_MASK | DesiredAccess, | ||
| _In_ BOOLEAN | OpenAsSelf, | ||
| _In_ ULONG | HandleAttributes, | ||
| _Out_ PHANDLE | TokenHandle | ||
| ) |
Referenced by RtlFormatCurrentUserKeyPath().
◆ ZwQueryInformationJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _Out_bytecap_(JobInformationLength) PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength, | ||
| _Out_ PULONG | ReturnLength | ||
| ) |
◆ ZwQueryInformationProcess()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Referenced by lie_about_fs_type(), RtlCreateUserProcess(), RtlEncodePointer(), RtlSetProcessIsCritical(), and START_TEST().
◆ ZwQueryInformationThread()
| NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_ PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Referenced by RtlSetThreadIsCritical().
◆ ZwRegisterThreadTerminatePort()
◆ ZwResumeProcess()
◆ ZwResumeThread()
Referenced by ExpLoadInitialProcess().
◆ ZwSetInformationJobObject()
| NTSYSAPI NTSTATUS NTAPI ZwSetInformationJobObject | ( | _In_ HANDLE | JobHandle, |
| _In_ JOBOBJECTINFOCLASS | JobInformationClass, | ||
| _In_ PVOID | JobInformation, | ||
| _In_ ULONG | JobInformationLength | ||
| ) |
◆ ZwSetInformationProcess()
| NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_ PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
Referenced by RtlSetProcessIsCritical().
◆ ZwSuspendProcess()
◆ ZwSuspendThread()
| NTSYSAPI NTSTATUS NTAPI ZwSuspendThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ PULONG | PreviousSuspendCount | ||
| ) |
◆ ZwTerminateJobObject()
◆ ZwTerminateThread()
Referenced by RtlAssert().
Variable Documentation
◆ DesiredAccess
◆ ExitStatus
Definition at line 867 of file psfuncs.h.
Referenced by BaseExitThreadPoolThread(), BaseSrvBSMThread(), CdfsChkdsk(), ChkdskEx(), CsrDereferenceNtSession(), DbgkExitProcess(), DbgkExitThread(), Ext2Chkdsk(), NtfsChkdsk(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), PspExitThread(), PspTerminateProcess(), PspTerminateThreadByPointer(), PsTerminateProcess(), PsTerminateSystemThread(), RtlpExitThread(), test_query_process_basic(), VfatChkdsk(), and VfatxChkdsk().
◆ HandleAttributes
◆ ThreadInformationClass
| _In_ THREADINFOCLASS ThreadInformationClass |
Definition at line 841 of file psfuncs.h.
Referenced by NtQueryInformationThread(), NtSetInformationThread(), NtUserQueryInformationThread(), and NtUserSetInformationThread().
◆ ThreadInformationLength
| _In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength |
Definition at line 843 of file psfuncs.h.
Referenced by NtQueryInformationThread(), NtSetInformationThread(), NtUserSetInformationThread(), and PspQueryDescriptorThread().
◆ TokenHandle
Definition at line 726 of file psfuncs.h.
Referenced by AdjustTokenGroups(), AdjustTokenPrivileges(), BasepReplaceProcessThreadTokens(), CreateDefaultProcessSecurityCommon(), CreateProcessInternalW(), DuplicateTokenAsEffective(), GetCallerLuid(), GetSiteSidFromToken(), GetTokenInformation(), IntGetCurrentAccessToken(), IsPrivilegeEnabled(), IsTokenRestricted(), LogonUserExW(), LsapIsTrustedClient(), LsapLogonUser(), LsarSetSecurityObject(), MyLogonUser(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtCreateToken(), NtOpenProcessToken(), NtOpenProcessTokenEx(), NtOpenThreadToken(), NtOpenThreadTokenEx(), NtQueryInformationToken(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), OpenProcessToken(), OpenThreadToken(), PsAssignImpersonationToken(), PspSetPrimaryToken(), RtlAdjustPrivilege(), RtlCreateUserSecurityObject(), RtlDefaultNpAcl(), RtlFormatCurrentUserKeyPath(), RtlpGetImpersonationToken(), RtlpOpenThreadToken(), RtlRemovePrivileges(), SamrSetSecurityObject(), SepCreateToken(), SepOpenThreadToken(), SetThreadToken(), SetTokenInformation(), SHTestTokenMembership(), and START_TEST().
