ReactOS 0.4.15-dev-8339-g4028de8
psfuncs.h
Go to the documentation of this file.
1/*++ NDK Version: 0098
2
3Copyright (c) Alex Ionescu. All rights reserved.
4
5Header Name:
6
7 psfuncs.h
8
9Abstract:
10
11 Function definitions for the Process Manager
12
13Author:
14
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
16
17--*/
18
19#ifndef _PSFUNCS_H
20#define _PSFUNCS_H
21
22//
23// Dependencies
24//
25#include <umtypes.h>
26#include <pstypes.h>
27
28#ifdef __cplusplus
29extern "C" {
30#endif
31
32#ifndef NTOS_MODE_USER
33
34//
35// Win32K Process/Thread Functions
36//
41 VOID
42);
43
48 VOID
49);
50
56);
57
63 _In_opt_ PVOID Win32Process,
64 _In_opt_ PVOID OldWin32Process
65);
66
72 _In_opt_ PVOID Win32Thread,
73 _In_opt_ PVOID OldWin32Thread
74);
75
81);
82
88);
89
91VOID
95 _In_opt_ PVOID WindowStation
96);
97
99PTEB
100NTAPI
103);
104
106HANDLE
107NTAPI
110);
111
114NTAPI
117);
118
120ULONG
121NTAPI
124);
125
128NTAPI
131);
132
134VOID
135NTAPI
139);
140
142VOID
143NTAPI
145 _In_ PWIN32_CALLOUTS_FPNS CalloutData
146);
147
149VOID
150NTAPI
154);
155
157ULONG
158NTAPI
160 VOID
161);
162
163//
164// Process Impersonation Functions
165//
168NTAPI
171);
172
174VOID
175NTAPI
178);
179
180//
181// Misc. Functions
182//
185NTAPI
187 _In_ PCLIENT_ID Cid,
190);
191
193NTAPI
196);
197
200NTAPI
203);
204
205VOID
206NTAPI
210);
211
212HANDLE
213NTAPI
216);
217
220NTAPI
223);
224
226ULONG
227NTAPI
230);
231
234NTAPI
237);
238
239//
240// Quota Functions
241//
243VOID
244NTAPI
249);
250
253NTAPI
257);
258
261NTAPI
265);
266
269NTAPI
274);
275
277VOID
278NTAPI
283);
284
286VOID
287NTAPI
291);
292
294VOID
295NTAPI
299);
300
302PVOID
303NTAPI
306);
307
310NTAPI
313 _In_ PVOID SecurityPort
314);
315
317HANDLE
318NTAPI
320 VOID
321);
322
323#endif
324
325//
326// Native Calls
327//
330NTAPI
332 _In_ HANDLE ThreadHandle,
333 _Out_opt_ PULONG SuspendCount
334);
335
338NTAPI
342);
343
346NTAPI
348 _In_ HANDLE ThreadHandle
349);
350
353NTAPI
355 _In_ HANDLE JobHandle,
357);
358
361NTAPI
363 _Out_ PHANDLE JobHandle,
366);
367
369NTAPI
371 _In_ ULONG NumJob,
372 _In_ PJOB_SET_ARRAY UserJobSet,
374);
375
378NTAPI
383 _In_ HANDLE ParentProcess,
384 _In_ BOOLEAN InheritObjectTable,
385 _In_opt_ HANDLE SectionHandle,
386 _In_opt_ HANDLE DebugPort,
387 _In_opt_ HANDLE ExceptionPort
388);
389
392NTAPI
397 _In_ HANDLE ParentProcess,
399 _In_opt_ HANDLE SectionHandle,
400 _In_opt_ HANDLE DebugPort,
401 _In_opt_ HANDLE ExceptionPort,
402 _In_ BOOLEAN InJob
403);
404
407NTAPI
409 _Out_ PHANDLE ThreadHandle,
414 _In_ PCONTEXT ThreadContext,
415 _In_ PINITIAL_TEB UserStack,
416 _In_ BOOLEAN CreateSuspended
417);
418
419#ifndef NTOS_MODE_USER
421{
422#if defined(_M_IX86)
423 return (struct _TEB *)__readfsdword(0x18);
424#elif defined (_M_AMD64)
425 return (struct _TEB *)__readgsqword(FIELD_OFFSET(NT_TIB, Self));
426#elif defined (_M_ARM)
427 // return (struct _TEB *)KeGetPcr()->Used_Self;
428 return (struct _TEB *)(ULONG_PTR)_MoveFromCoprocessor(CP15_TPIDRURW);
429#elif defined (_M_ARM64)
430 //UNIMPLEMENTED;
431 return 0;
432// #elif defined(_M_PPC)
433// return (struct _TEB *)_read_teb_dword(0x18);
434#else
435#error Unsupported architecture
436#endif
437}
438#else
439struct _TEB * NtCurrentTeb(VOID);
440#endif
441
444NTAPI
446 _In_ HANDLE ThreadHandle,
447 _In_ HANDLE ThreadToImpersonate,
448 _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
449);
450
453NTAPI
456 _In_opt_ HANDLE JobHandle
457);
458
462NTAPI
468);
469
474NTAPI
479);
480
483NTAPI
485 _Out_ PHANDLE ThreadHandle,
489);
490
493NTAPI
495 _In_ HANDLE ThreadHandle,
499);
500
503NTAPI
505 _In_ HANDLE ThreadHandle,
510);
511
514NTAPI
516 _In_ HANDLE JobHandle,
517 _In_ JOBOBJECTINFOCLASS JobInformationClass,
518 _Out_bytecap_(JobInformationLength) PVOID JobInformation,
519 _In_ ULONG JobInformationLength,
521);
522
523#ifndef _NTDDK_
527NTAPI
530 _In_ PROCESSINFOCLASS ProcessInformationClass,
531 _Out_ PVOID ProcessInformation,
532 _In_ ULONG ProcessInformationLength,
534);
535#endif
536
539NTAPI
541 _In_ HANDLE ThreadHandle,
543 _Out_ PVOID ThreadInformation,
546);
547
550NTAPI
552 _In_ HANDLE TerminationPort
553);
554
557NTAPI
559 _In_ HANDLE ThreadHandle,
560 _Out_opt_ PULONG SuspendCount
561);
562
565NTAPI
568);
569
572NTAPI
574 _In_ HANDLE JobHandle,
575 _In_ JOBOBJECTINFOCLASS JobInformationClass,
576 _In_bytecount_(JobInformationLength) PVOID JobInformation,
577 _In_ ULONG JobInformationLength
578);
579
582NTAPI
585 _In_ PROCESSINFOCLASS ProcessInformationClass,
586 _In_ PVOID ProcessInformation,
587 _In_ ULONG ProcessInformationLength
588);
589
593NTAPI
595 _In_ HANDLE ThreadHandle,
599);
600
603NTAPI
606);
607
610NTAPI
612 _In_ HANDLE ThreadHandle,
613 _In_ PULONG PreviousSuspendCount
614);
615
618NTAPI
622);
623
626NTAPI
628 _In_ HANDLE ThreadHandle,
630);
631
634NTAPI
636 _In_ HANDLE JobHandle,
638);
639
642NTAPI
644 _In_ HANDLE ThreadHandle,
645 _Out_opt_ PULONG SuspendCount
646);
647
650NTAPI
652 _In_ HANDLE ThreadHandle
653);
654
657NTAPI
659 _In_ HANDLE JobHandle,
661);
662
665NTAPI
667 _Out_ PHANDLE JobHandle,
670);
671
674NTAPI
679 _In_ HANDLE ParentProcess,
680 _In_ BOOLEAN InheritObjectTable,
681 _In_opt_ HANDLE SectionHandle,
682 _In_opt_ HANDLE DebugPort,
683 _In_opt_ HANDLE ExceptionPort
684);
685
688NTAPI
690 _Out_ PHANDLE ThreadHandle,
695 _In_ PCONTEXT ThreadContext,
696 _In_ PINITIAL_TEB UserStack,
697 _In_ BOOLEAN CreateSuspended
698);
699
702NTAPI
704 _In_ HANDLE ThreadHandle,
705 _In_ HANDLE ThreadToImpersonate,
706 _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
707);
708
711NTAPI
714 _In_opt_ HANDLE JobHandle
715);
716
720NTAPI
726);
727
730NTAPI
732 _Out_ PHANDLE ThreadHandle,
736);
737
740NTAPI
742 _In_ HANDLE ThreadHandle,
746);
747
750NTAPI
752 _In_ HANDLE ThreadHandle,
757);
758
761NTAPI
763 _In_ HANDLE JobHandle,
764 _In_ JOBOBJECTINFOCLASS JobInformationClass,
765 _Out_bytecap_(JobInformationLength) PVOID JobInformation,
766 _In_ ULONG JobInformationLength,
768);
769
772NTAPI
775 _In_ PROCESSINFOCLASS ProcessInformationClass,
776 _Out_ PVOID ProcessInformation,
777 _In_ ULONG ProcessInformationLength,
779);
780
783NTAPI
785 _In_ HANDLE ThreadHandle,
787 _Out_ PVOID ThreadInformation,
790);
791
794NTAPI
796 _In_ HANDLE TerminationPort
797);
798
801NTAPI
803 _In_ HANDLE ThreadHandle,
804 _Out_opt_ PULONG SuspendCount
805);
806
809NTAPI
812);
813
816NTAPI
818 _In_ HANDLE JobHandle,
819 _In_ JOBOBJECTINFOCLASS JobInformationClass,
820 _In_ PVOID JobInformation,
821 _In_ ULONG JobInformationLength
822);
823
826NTAPI
829 _In_ PROCESSINFOCLASS ProcessInformationClass,
830 _In_ PVOID ProcessInformation,
831 _In_ ULONG ProcessInformationLength
832);
833
837NTAPI
838ZwSetInformationThread(
839 _In_ HANDLE ThreadHandle,
843);
844
847NTAPI
850);
851
854NTAPI
856 _In_ HANDLE ThreadHandle,
857 _In_ PULONG PreviousSuspendCount
858);
859
863NTAPI
864ZwTerminateProcess (
867 );
868
871NTAPI
873 _In_ HANDLE ThreadHandle,
875);
876
879NTAPI
881 _In_ HANDLE JobHandle,
883);
884
885#ifdef __cplusplus
886}
887#endif
888
889#endif
unsigned char BOOLEAN
Type
Definition: Type.h:7
LONG NTSTATUS
Definition: precomp.h:26
#define NTSYSAPI
Definition: ntoskrnl.h:12
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
enum _THREADINFOCLASS THREADINFOCLASS
Definition: thread.c:101
#define ULONG_PTR
Definition: config.h:101
#define _IRQL_requires_max_(irql)
Definition: driverspecs.h:230
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
Definition: dumpinfo.c:43
#define PASSIVE_LEVEL
Definition: env_spec_w32.h:693
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
_Must_inspect_result_ _In_ LONGLONG _In_ LONGLONG Amount
Definition: fsrtlfuncs.h:551
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
enum _JOBOBJECTINFOCLASS JOBOBJECTINFOCLASS
enum _APPHELPCACHESERVICECLASS APPHELPCACHESERVICECLASS
enum _PSPROCESSPRIORITYMODE PSPROCESSPRIORITYMODE
enum _PROCESSINFOCLASS PROCESSINFOCLASS
Definition: loader.c:63
PPC_QUAL unsigned long __readfsdword(const unsigned long Offset)
Definition: intrin_ppc.h:382
#define NtCurrentTeb
@ Disabled
Definition: mountmgr.h:178
#define _Out_opt_
Definition: ms_sal.h:346
#define _In_reads_bytes_(size)
Definition: ms_sal.h:321
#define _Inout_
Definition: ms_sal.h:378
#define _Must_inspect_result_
Definition: ms_sal.h:558
#define _Out_
Definition: ms_sal.h:345
#define _In_
Definition: ms_sal.h:308
#define _In_opt_
Definition: ms_sal.h:309
#define _Out_bytecap_(size)
Definition: ms_sal.h:854
#define _In_bytecount_(size)
Definition: ms_sal.h:812
#define CP15_TPIDRURW
Definition: ketypes.h:131
_In_ HANDLE ProcessHandle
Definition: mmfuncs.h:403
NTKERNELAPI PVOID NTAPI PsGetThreadWin32Thread(_In_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread(_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _Out_ PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)
NTSYSAPI NTSTATUS NTAPI ZwImpersonateThread(_In_ HANDLE ThreadHandle, _In_ HANDLE ThreadToImpersonate, _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
NTSYSCALLAPI NTSTATUS NTAPI NtAlertResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationThread(_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _Out_ PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)
NTSYSCALLAPI NTSTATUS NTAPI NtTerminateJobObject(_In_ HANDLE JobHandle, _In_ NTSTATUS ExitStatus)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadToken(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2474
NTKERNELAPI BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled(_In_ PETHREAD Thread)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateJobObject(_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTKERNELAPI NTSTATUS NTAPI PsSetProcessWin32Process(_Inout_ PEPROCESS Process, _In_opt_ PVOID Win32Process, _In_opt_ PVOID OldWin32Process)
Definition: process.c:1257
_In_ NTSTATUS ExitStatus
Definition: psfuncs.h:867
NTSYSCALLAPI NTSTATUS NTAPI NtSuspendThread(_In_ HANDLE ThreadHandle, _In_ PULONG PreviousSuspendCount)
NTKERNELAPI PVOID NTAPI PsGetCurrentProcessWin32Process(VOID)
Definition: process.c:1183
NTSYSAPI NTSTATUS NTAPI ZwTerminateThread(_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)
NTKERNELAPI HANDLE NTAPI PsGetThreadId(_In_ PETHREAD Thread)
NTSYSCALLAPI NTSTATUS NTAPI NtSuspendProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI BOOLEAN NTAPI PsIsThreadImpersonating(_In_ PETHREAD Thread)
NTKERNELAPI VOID NTAPI PsSetProcessWindowStation(_Inout_ PEPROCESS Process, _In_opt_ PVOID WindowStation)
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the paged pool quota of a given process.
Definition: quota.c:839
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId)
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)
NTSYSCALLAPI NTSTATUS NTAPI NtAlertThread(_In_ HANDLE ThreadHandle)
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
Definition: psfuncs.h:726
NTSYSCALLAPI NTSTATUS NTAPI NtAssignProcessToJobObject(_In_ HANDLE JobHandle, _In_ HANDLE ProcessHandle)
NTKERNELAPI VOID NTAPI PsEstablishWin32Callouts(_In_ PWIN32_CALLOUTS_FPNS CalloutData)
NTKERNELAPI BOOLEAN NTAPI PsGetProcessExitProcessCalled(_In_ PEPROCESS Process)
VOID NTAPI PsSetProcessPriorityByClass(_In_ PEPROCESS Process, _In_ PSPROCESSPRIORITYMODE Type)
NTSYSCALLAPI NTSTATUS NTAPI NtIsProcessInJob(_In_ HANDLE ProcessHandle, _In_opt_ HANDLE JobHandle)
NTKERNELAPI NTSTATUS NTAPI PsGetProcessExitStatus(_In_ PEPROCESS Process)
NTKERNELAPI BOOLEAN NTAPI PsIsSystemProcess(_In_ PEPROCESS Process)
_In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength
Definition: psfuncs.h:843
NTSYSAPI NTSTATUS NTAPI ZwOpenThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PCLIENT_ID ClientId)
NTKERNELAPI PVOID NTAPI PsGetProcessSecurityPort(_In_ PEPROCESS Process)
NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)
NTKERNELAPI NTSTATUS NTAPI PsLookupProcessThreadByCid(_In_ PCLIENT_ID Cid, _Out_opt_ PEPROCESS *Process, _Out_ PETHREAD *Thread)
NTSYSAPI NTSTATUS NTAPI ZwSetInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _In_ PVOID JobInformation, _In_ ULONG JobInformationLength)
NTKERNELAPI VOID NTAPI PsSetThreadHardErrorsAreDisabled(_Inout_ PETHREAD Thread, _In_ BOOLEAN Disabled)
NTKERNELAPI PTEB NTAPI PsGetThreadTeb(_In_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwSuspendThread(_In_ HANDLE ThreadHandle, _In_ PULONG PreviousSuspendCount)
NTSYSCALLAPI NTSTATUS NTAPI NtResumeProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI PVOID NTAPI PsGetProcessWin32WindowStation(_In_ PEPROCESS Process)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
Definition: query.c:59
HANDLE NTAPI PsGetProcessInheritedFromUniqueProcessId(_In_ PEPROCESS Process)
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the non paged pool quota of a given process.
Definition: quota.c:811
NTSYSCALLAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort(_In_ HANDLE TerminationPort)
NTKERNELAPI ULONG NTAPI PsGetCurrentProcessSessionId(VOID)
Definition: process.c:1133
NTSTATUS NTAPI NtCreateJobSet(_In_ ULONG NumJob, _In_ PJOB_SET_ARRAY UserJobSet, _In_ ULONG Flags)
NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess(_In_ PETHREAD Thread)
NTSYSCALLAPI NTSTATUS NTAPI NtImpersonateThread(_In_ HANDLE ThreadHandle, _In_ HANDLE ThreadToImpersonate, _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2331
NTSYSCALLAPI NTSTATUS NTAPI NtCreateThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, _Out_ PCLIENT_ID ClientId, _In_ PCONTEXT ThreadContext, _In_ PINITIAL_TEB UserStack, _In_ BOOLEAN CreateSuspended)
NTKERNELAPI PVOID NTAPI PsSetThreadWin32Thread(_Inout_ PETHREAD Thread, _In_opt_ PVOID Win32Thread, _In_opt_ PVOID OldWin32Thread)
NTKERNELAPI VOID NTAPI PsReturnProcessPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the paged pool quota that the process was taking up.
Definition: quota.c:965
NTKERNELAPI ULONG NTAPI PsGetProcessSessionId(_In_ PEPROCESS Process)
NTKERNELAPI VOID NTAPI PsReturnProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the non paged quota pool that the process was taking up.
Definition: quota.c:938
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
Definition: quota.c:872
NTKERNELAPI PVOID NTAPI PsGetProcessWin32Process(_In_ PEPROCESS Process)
NTSYSAPI NTSTATUS NTAPI ZwCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcessEx(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ ULONG Flags, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort, _In_ BOOLEAN InJob)
NTKERNELAPI PVOID NTAPI PsGetCurrentThreadWin32Thread(VOID)
Definition: thread.c:805
_In_ THREADINFOCLASS ThreadInformationClass
Definition: psfuncs.h:840
NTKERNELAPI VOID NTAPI PsReturnPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Returns the pool quota that the process was taking up.
Definition: quota.c:907
NTSYSCALLAPI NTSTATUS NTAPI NtOpenThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PCLIENT_ID ClientId)
NTSYSAPI NTSTATUS NTAPI ZwAlertThread(_In_ HANDLE ThreadHandle)
NTSYSAPI NTSTATUS NTAPI ZwIsProcessInJob(_In_ HANDLE ProcessHandle, _In_opt_ HANDLE JobHandle)
NTSYSAPI NTSTATUS NTAPI ZwCreateThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, _Out_ PCLIENT_ID ClientId, _In_ PCONTEXT ThreadContext, _In_ PINITIAL_TEB UserStack, _In_ BOOLEAN CreateSuspended)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSYSAPI NTSTATUS NTAPI ZwOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
_In_ ACCESS_MASK _In_ ULONG HandleAttributes
Definition: psfuncs.h:724
NTSYSAPI NTSTATUS NTAPI ZwTerminateJobObject(_In_ HANDLE JobHandle, _In_ NTSTATUS ExitStatus)
NTSYSAPI NTSTATUS NTAPI ZwResumeProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI ULONG NTAPI PsGetThreadFreezeCount(_In_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwCreateJobObject(_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _In_bytecount_(JobInformationLength) PVOID JobInformation, _In_ ULONG JobInformationLength)
NTSYSAPI NTSTATUS NTAPI ZwResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTKERNELAPI VOID NTAPI PsRevertThreadToSelf(_Inout_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwSuspendProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI NTSTATUS NTAPI PsSetProcessSecurityPort(_Inout_ PEPROCESS Process, _In_ PVOID SecurityPort)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
NTKERNELAPI HANDLE NTAPI PsGetCurrentThreadProcessId(VOID)
Definition: thread.c:755
NTSYSCALLAPI NTSTATUS NTAPI NtResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTSYSAPI NTSTATUS NTAPI ZwOpenThreadToken(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _Out_ PHANDLE TokenHandle)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _Out_bytecap_(JobInformationLength) PVOID JobInformation, _In_ ULONG JobInformationLength, _Out_ PULONG ReturnLength)
BOOLEAN NTAPI PsIsProtectedProcess(_In_ PEPROCESS Process)
NTKERNELAPI VOID NTAPI PsChargePoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the Pool...
Definition: quota.c:775
_Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcessToken(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _Out_ PHANDLE TokenHandle)
NTSYSCALLAPI NTSTATUS NTAPI NtApphelpCacheControl(_In_ APPHELPCACHESERVICECLASS Service, _In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP ServiceData)
Definition: apphelp.c:728
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationThread(_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength)
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _Out_bytecap_(JobInformationLength) PVOID JobInformation, _In_ ULONG JobInformationLength, _Out_ PULONG ReturnLength)
NTSYSAPI NTSTATUS NTAPI ZwAlertResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTSYSAPI NTSTATUS NTAPI ZwRegisterThreadTerminatePort(_In_ HANDLE TerminationPort)
NTSYSAPI NTSTATUS NTAPI ZwAssignProcessToJobObject(_In_ HANDLE JobHandle, _In_ HANDLE ProcessHandle)
NTSYSCALLAPI NTSTATUS NTAPI NtTerminateThread(_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)
NTSYSCALLAPI NTSTATUS NTAPI NtTerminateProcess(_In_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus)
NTSYSAPI NTSTATUS NTAPI ZwOpenProcessTokenEx(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
ULONG ACCESS_MASK
Definition: nt_native.h:40
#define NTSYSCALLAPI
Definition: ntbasedef.h:204
@ Service
Definition: ntsecapi.h:292
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:455
#define __kernel_entry
Definition: specstrings.h:355
Definition: compat.h:836
uint32_t * PULONG
Definition: typedefs.h:59
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:255
INT POOL_TYPE
Definition: typedefs.h:78
#define NTAPI
Definition: typedefs.h:36
ULONG_PTR SIZE_T
Definition: typedefs.h:80
uint32_t ULONG
Definition: typedefs.h:59
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2658
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
Definition: wdfdevice.h:3815
#define FORCEINLINE
Definition: wdftypes.h:67
#define NTKERNELAPI
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_Out_ PCLIENT_ID ClientId
Definition: kefuncs.h:1151
_In_ ACCESS_MASK _In_ BOOLEAN OpenAsSelf
Definition: zwfuncs.h:700