ReactOS 0.4.15-dev-6694-g4ba8af9
psfuncs.h
Go to the documentation of this file.
1/*++ NDK Version: 0098
2
3Copyright (c) Alex Ionescu. All rights reserved.
4
5Header Name:
6
7 psfuncs.h
8
9Abstract:
10
11 Function definitions for the Process Manager
12
13Author:
14
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
16
17--*/
18
19#ifndef _PSFUNCS_H
20#define _PSFUNCS_H
21
22//
23// Dependencies
24//
25#include <umtypes.h>
26#include <pstypes.h>
27
28#ifdef __cplusplus
29extern "C" {
30#endif
31
32#ifndef NTOS_MODE_USER
33
34//
35// Win32K Process/Thread Functions
36//
41 VOID
42);
43
48 VOID
49);
50
56);
57
63 _In_opt_ PVOID Win32Process,
64 _In_opt_ PVOID OldWin32Process
65);
66
72 _In_opt_ PVOID Win32Thread,
73 _In_opt_ PVOID OldWin32Thread
74);
75
81);
82
88);
89
91VOID
95 _In_opt_ PVOID WindowStation
96);
97
99PTEB
100NTAPI
103);
104
106HANDLE
107NTAPI
110);
111
114NTAPI
117);
118
120ULONG
121NTAPI
124);
125
128NTAPI
131);
132
134VOID
135NTAPI
139);
140
142VOID
143NTAPI
145 _In_ PWIN32_CALLOUTS_FPNS CalloutData
146);
147
149VOID
150NTAPI
154);
155
157ULONG
158NTAPI
160 VOID
161);
162
163//
164// Process Impersonation Functions
165//
168NTAPI
171);
172
174VOID
175NTAPI
178);
179
180//
181// Misc. Functions
182//
185NTAPI
187 _In_ PCLIENT_ID Cid,
190);
191
193NTAPI
196);
197
200NTAPI
203);
204
205VOID
206NTAPI
210);
211
212HANDLE
213NTAPI
216);
217
220NTAPI
223);
224
226ULONG
227NTAPI
230);
231
234NTAPI
237);
238
239//
240// Quota Functions
241//
243VOID
244NTAPI
249);
250
253NTAPI
257);
258
261NTAPI
265);
266
269NTAPI
274);
275
277VOID
278NTAPI
283);
284
286VOID
287NTAPI
291);
292
294VOID
295NTAPI
299);
300
302PVOID
303NTAPI
306);
307
310NTAPI
313 _In_ PVOID SecurityPort
314);
315
317HANDLE
318NTAPI
320 VOID
321);
322
323#endif
324
325//
326// Native Calls
327//
330NTAPI
332 _In_ HANDLE ThreadHandle,
333 _Out_opt_ PULONG SuspendCount
334);
335
338NTAPI
342);
343
346NTAPI
348 _In_ HANDLE ThreadHandle
349);
350
353NTAPI
355 _In_ HANDLE JobHandle,
357);
358
361NTAPI
363 _Out_ PHANDLE JobHandle,
366);
367
369NTAPI
371 _In_ ULONG NumJob,
372 _In_ PJOB_SET_ARRAY UserJobSet,
374);
375
378NTAPI
383 _In_ HANDLE ParentProcess,
384 _In_ BOOLEAN InheritObjectTable,
385 _In_opt_ HANDLE SectionHandle,
386 _In_opt_ HANDLE DebugPort,
387 _In_opt_ HANDLE ExceptionPort
388);
389
392NTAPI
397 _In_ HANDLE ParentProcess,
399 _In_opt_ HANDLE SectionHandle,
400 _In_opt_ HANDLE DebugPort,
401 _In_opt_ HANDLE ExceptionPort,
402 _In_ BOOLEAN InJob
403);
404
407NTAPI
409 _Out_ PHANDLE ThreadHandle,
414 _In_ PCONTEXT ThreadContext,
415 _In_ PINITIAL_TEB UserStack,
416 _In_ BOOLEAN CreateSuspended
417);
418
419#ifndef NTOS_MODE_USER
421{
422#if defined(_M_IX86)
423 return (PTEB)__readfsdword(0x18);
424#elif defined (_M_AMD64)
425 return (struct _TEB *)__readgsqword(FIELD_OFFSET(NT_TIB, Self));
426#elif defined (_M_ARM)
427 return (struct _TEB *)KeGetPcr()->Used_Self;
428#endif
429}
430#else
431struct _TEB * NtCurrentTeb(void);
432#endif
433
436NTAPI
438 _In_ HANDLE ThreadHandle,
439 _In_ HANDLE ThreadToImpersonate,
440 _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
441);
442
445NTAPI
448 _In_opt_ HANDLE JobHandle
449);
450
454NTAPI
460);
461
466NTAPI
471);
472
475NTAPI
477 _Out_ PHANDLE ThreadHandle,
481);
482
485NTAPI
487 _In_ HANDLE ThreadHandle,
491);
492
495NTAPI
497 _In_ HANDLE ThreadHandle,
502);
503
506NTAPI
508 _In_ HANDLE JobHandle,
509 _In_ JOBOBJECTINFOCLASS JobInformationClass,
510 _Out_bytecap_(JobInformationLength) PVOID JobInformation,
511 _In_ ULONG JobInformationLength,
513);
514
515#ifndef _NTDDK_
519NTAPI
522 _In_ PROCESSINFOCLASS ProcessInformationClass,
523 _Out_ PVOID ProcessInformation,
524 _In_ ULONG ProcessInformationLength,
526);
527#endif
528
531NTAPI
533 _In_ HANDLE ThreadHandle,
535 _Out_ PVOID ThreadInformation,
538);
539
542NTAPI
544 _In_ HANDLE TerminationPort
545);
546
549NTAPI
551 _In_ HANDLE ThreadHandle,
552 _Out_opt_ PULONG SuspendCount
553);
554
557NTAPI
560);
561
564NTAPI
566 _In_ HANDLE JobHandle,
567 _In_ JOBOBJECTINFOCLASS JobInformationClass,
568 _In_bytecount_(JobInformationLength) PVOID JobInformation,
569 _In_ ULONG JobInformationLength
570);
571
574NTAPI
577 _In_ PROCESSINFOCLASS ProcessInformationClass,
578 _In_ PVOID ProcessInformation,
579 _In_ ULONG ProcessInformationLength
580);
581
585NTAPI
587 _In_ HANDLE ThreadHandle,
591);
592
595NTAPI
598);
599
602NTAPI
604 _In_ HANDLE ThreadHandle,
605 _In_ PULONG PreviousSuspendCount
606);
607
610NTAPI
614);
615
618NTAPI
620 _In_ HANDLE ThreadHandle,
622);
623
626NTAPI
628 _In_ HANDLE JobHandle,
630);
631
634NTAPI
636 _In_ HANDLE ThreadHandle,
637 _Out_opt_ PULONG SuspendCount
638);
639
642NTAPI
644 _In_ HANDLE ThreadHandle
645);
646
649NTAPI
651 _In_ HANDLE JobHandle,
653);
654
657NTAPI
659 _Out_ PHANDLE JobHandle,
662);
663
666NTAPI
671 _In_ HANDLE ParentProcess,
672 _In_ BOOLEAN InheritObjectTable,
673 _In_opt_ HANDLE SectionHandle,
674 _In_opt_ HANDLE DebugPort,
675 _In_opt_ HANDLE ExceptionPort
676);
677
680NTAPI
682 _Out_ PHANDLE ThreadHandle,
687 _In_ PCONTEXT ThreadContext,
688 _In_ PINITIAL_TEB UserStack,
689 _In_ BOOLEAN CreateSuspended
690);
691
694NTAPI
696 _In_ HANDLE ThreadHandle,
697 _In_ HANDLE ThreadToImpersonate,
698 _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
699);
700
703NTAPI
706 _In_opt_ HANDLE JobHandle
707);
708
712NTAPI
718);
719
722NTAPI
724 _Out_ PHANDLE ThreadHandle,
728);
729
732NTAPI
734 _In_ HANDLE ThreadHandle,
738);
739
742NTAPI
744 _In_ HANDLE ThreadHandle,
749);
750
753NTAPI
755 _In_ HANDLE JobHandle,
756 _In_ JOBOBJECTINFOCLASS JobInformationClass,
757 _Out_bytecap_(JobInformationLength) PVOID JobInformation,
758 _In_ ULONG JobInformationLength,
760);
761
764NTAPI
767 _In_ PROCESSINFOCLASS ProcessInformationClass,
768 _Out_ PVOID ProcessInformation,
769 _In_ ULONG ProcessInformationLength,
771);
772
775NTAPI
777 _In_ HANDLE ThreadHandle,
779 _Out_ PVOID ThreadInformation,
782);
783
786NTAPI
788 _In_ HANDLE TerminationPort
789);
790
793NTAPI
795 _In_ HANDLE ThreadHandle,
796 _Out_opt_ PULONG SuspendCount
797);
798
801NTAPI
804);
805
808NTAPI
810 _In_ HANDLE JobHandle,
811 _In_ JOBOBJECTINFOCLASS JobInformationClass,
812 _In_ PVOID JobInformation,
813 _In_ ULONG JobInformationLength
814);
815
818NTAPI
821 _In_ PROCESSINFOCLASS ProcessInformationClass,
822 _In_ PVOID ProcessInformation,
823 _In_ ULONG ProcessInformationLength
824);
825
829NTAPI
830ZwSetInformationThread(
831 _In_ HANDLE ThreadHandle,
835);
836
839NTAPI
842);
843
846NTAPI
848 _In_ HANDLE ThreadHandle,
849 _In_ PULONG PreviousSuspendCount
850);
851
855NTAPI
856ZwTerminateProcess (
859 );
860
863NTAPI
865 _In_ HANDLE ThreadHandle,
867);
868
871NTAPI
873 _In_ HANDLE JobHandle,
875);
876
877#ifdef __cplusplus
878}
879#endif
880
881#endif
unsigned char BOOLEAN
Type
Definition: Type.h:7
LONG NTSTATUS
Definition: precomp.h:26
#define NTSYSAPI
Definition: ntoskrnl.h:12
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
enum _THREADINFOCLASS THREADINFOCLASS
Definition: thread.c:101
#define _IRQL_requires_max_(irql)
Definition: driverspecs.h:230
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
Definition: dumpinfo.c:43
#define PASSIVE_LEVEL
Definition: env_spec_w32.h:693
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
_Must_inspect_result_ _In_ LONGLONG _In_ LONGLONG Amount
Definition: fsrtlfuncs.h:551
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
enum _JOBOBJECTINFOCLASS JOBOBJECTINFOCLASS
enum _APPHELPCACHESERVICECLASS APPHELPCACHESERVICECLASS
enum _PSPROCESSPRIORITYMODE PSPROCESSPRIORITYMODE
enum _PROCESSINFOCLASS PROCESSINFOCLASS
Definition: loader.c:63
PPC_QUAL unsigned long __readfsdword(const unsigned long Offset)
Definition: intrin_ppc.h:382
#define NtCurrentTeb
@ Disabled
Definition: mountmgr.h:158
#define _Out_opt_
Definition: ms_sal.h:346
#define _In_reads_bytes_(size)
Definition: ms_sal.h:321
#define _Inout_
Definition: ms_sal.h:378
#define _Must_inspect_result_
Definition: ms_sal.h:558
#define _Out_
Definition: ms_sal.h:345
#define _In_
Definition: ms_sal.h:308
#define _In_opt_
Definition: ms_sal.h:309
#define _Out_bytecap_(size)
Definition: ms_sal.h:854
#define _In_bytecount_(size)
Definition: ms_sal.h:812
_In_ HANDLE ProcessHandle
Definition: mmfuncs.h:403
NTKERNELAPI PVOID NTAPI PsGetThreadWin32Thread(_In_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread(_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _Out_ PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)
NTSYSAPI NTSTATUS NTAPI ZwImpersonateThread(_In_ HANDLE ThreadHandle, _In_ HANDLE ThreadToImpersonate, _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
NTSYSCALLAPI NTSTATUS NTAPI NtAlertResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationThread(_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _Out_ PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)
NTSYSCALLAPI NTSTATUS NTAPI NtTerminateJobObject(_In_ HANDLE JobHandle, _In_ NTSTATUS ExitStatus)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadToken(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2472
NTKERNELAPI BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled(_In_ PETHREAD Thread)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateJobObject(_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTKERNELAPI NTSTATUS NTAPI PsSetProcessWin32Process(_Inout_ PEPROCESS Process, _In_opt_ PVOID Win32Process, _In_opt_ PVOID OldWin32Process)
Definition: process.c:1257
_In_ NTSTATUS ExitStatus
Definition: psfuncs.h:859
NTSYSCALLAPI NTSTATUS NTAPI NtSuspendThread(_In_ HANDLE ThreadHandle, _In_ PULONG PreviousSuspendCount)
NTKERNELAPI PVOID NTAPI PsGetCurrentProcessWin32Process(VOID)
Definition: process.c:1183
NTSYSAPI NTSTATUS NTAPI ZwTerminateThread(_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)
NTKERNELAPI HANDLE NTAPI PsGetThreadId(_In_ PETHREAD Thread)
NTSYSCALLAPI NTSTATUS NTAPI NtSuspendProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI BOOLEAN NTAPI PsIsThreadImpersonating(_In_ PETHREAD Thread)
NTKERNELAPI VOID NTAPI PsSetProcessWindowStation(_Inout_ PEPROCESS Process, _In_opt_ PVOID WindowStation)
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the paged pool quota of a given process.
Definition: quota.c:839
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId)
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)
NTSYSCALLAPI NTSTATUS NTAPI NtAlertThread(_In_ HANDLE ThreadHandle)
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
Definition: psfuncs.h:718
NTSYSCALLAPI NTSTATUS NTAPI NtAssignProcessToJobObject(_In_ HANDLE JobHandle, _In_ HANDLE ProcessHandle)
NTKERNELAPI VOID NTAPI PsEstablishWin32Callouts(_In_ PWIN32_CALLOUTS_FPNS CalloutData)
NTKERNELAPI BOOLEAN NTAPI PsGetProcessExitProcessCalled(_In_ PEPROCESS Process)
VOID NTAPI PsSetProcessPriorityByClass(_In_ PEPROCESS Process, _In_ PSPROCESSPRIORITYMODE Type)
NTSYSCALLAPI NTSTATUS NTAPI NtIsProcessInJob(_In_ HANDLE ProcessHandle, _In_opt_ HANDLE JobHandle)
NTKERNELAPI NTSTATUS NTAPI PsGetProcessExitStatus(_In_ PEPROCESS Process)
NTKERNELAPI BOOLEAN NTAPI PsIsSystemProcess(_In_ PEPROCESS Process)
_In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength
Definition: psfuncs.h:835
NTSYSAPI NTSTATUS NTAPI ZwOpenThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PCLIENT_ID ClientId)
NTKERNELAPI PVOID NTAPI PsGetProcessSecurityPort(_In_ PEPROCESS Process)
NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)
NTKERNELAPI NTSTATUS NTAPI PsLookupProcessThreadByCid(_In_ PCLIENT_ID Cid, _Out_opt_ PEPROCESS *Process, _Out_ PETHREAD *Thread)
NTSYSAPI NTSTATUS NTAPI ZwSetInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _In_ PVOID JobInformation, _In_ ULONG JobInformationLength)
NTKERNELAPI VOID NTAPI PsSetThreadHardErrorsAreDisabled(_Inout_ PETHREAD Thread, _In_ BOOLEAN Disabled)
NTKERNELAPI PTEB NTAPI PsGetThreadTeb(_In_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwSuspendThread(_In_ HANDLE ThreadHandle, _In_ PULONG PreviousSuspendCount)
NTSYSCALLAPI NTSTATUS NTAPI NtResumeProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI PVOID NTAPI PsGetProcessWin32WindowStation(_In_ PEPROCESS Process)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
Definition: query.c:59
HANDLE NTAPI PsGetProcessInheritedFromUniqueProcessId(_In_ PEPROCESS Process)
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the non paged pool quota of a given process.
Definition: quota.c:811
NTSYSCALLAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort(_In_ HANDLE TerminationPort)
NTKERNELAPI ULONG NTAPI PsGetCurrentProcessSessionId(VOID)
Definition: process.c:1133
NTSTATUS NTAPI NtCreateJobSet(_In_ ULONG NumJob, _In_ PJOB_SET_ARRAY UserJobSet, _In_ ULONG Flags)
NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess(_In_ PETHREAD Thread)
NTSYSCALLAPI NTSTATUS NTAPI NtImpersonateThread(_In_ HANDLE ThreadHandle, _In_ HANDLE ThreadToImpersonate, _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
Opens a token that is tied to a thread handle.
Definition: token.c:2329
NTSYSCALLAPI NTSTATUS NTAPI NtCreateThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, _Out_ PCLIENT_ID ClientId, _In_ PCONTEXT ThreadContext, _In_ PINITIAL_TEB UserStack, _In_ BOOLEAN CreateSuspended)
NTKERNELAPI PVOID NTAPI PsSetThreadWin32Thread(_Inout_ PETHREAD Thread, _In_opt_ PVOID Win32Thread, _In_opt_ PVOID OldWin32Thread)
NTKERNELAPI VOID NTAPI PsReturnProcessPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the paged pool quota that the process was taking up.
Definition: quota.c:965
NTKERNELAPI ULONG NTAPI PsGetProcessSessionId(_In_ PEPROCESS Process)
NTKERNELAPI VOID NTAPI PsReturnProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the non paged quota pool that the process was taking up.
Definition: quota.c:938
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
Definition: quota.c:872
NTKERNELAPI PVOID NTAPI PsGetProcessWin32Process(_In_ PEPROCESS Process)
NTSYSAPI NTSTATUS NTAPI ZwCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcessEx(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ ULONG Flags, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort, _In_ BOOLEAN InJob)
NTKERNELAPI PVOID NTAPI PsGetCurrentThreadWin32Thread(VOID)
Definition: thread.c:805
_In_ THREADINFOCLASS ThreadInformationClass
Definition: psfuncs.h:832
NTKERNELAPI VOID NTAPI PsReturnPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Returns the pool quota that the process was taking up.
Definition: quota.c:907
NTSYSCALLAPI NTSTATUS NTAPI NtOpenThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PCLIENT_ID ClientId)
NTSYSAPI NTSTATUS NTAPI ZwAlertThread(_In_ HANDLE ThreadHandle)
NTSYSAPI NTSTATUS NTAPI ZwIsProcessInJob(_In_ HANDLE ProcessHandle, _In_opt_ HANDLE JobHandle)
NTSYSAPI NTSTATUS NTAPI ZwCreateThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ProcessHandle, _Out_ PCLIENT_ID ClientId, _In_ PCONTEXT ThreadContext, _In_ PINITIAL_TEB UserStack, _In_ BOOLEAN CreateSuspended)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSYSAPI NTSTATUS NTAPI ZwOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
_In_ ACCESS_MASK _In_ ULONG HandleAttributes
Definition: psfuncs.h:716
NTSYSAPI NTSTATUS NTAPI ZwTerminateJobObject(_In_ HANDLE JobHandle, _In_ NTSTATUS ExitStatus)
NTSYSAPI NTSTATUS NTAPI ZwResumeProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI ULONG NTAPI PsGetThreadFreezeCount(_In_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwCreateJobObject(_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _In_bytecount_(JobInformationLength) PVOID JobInformation, _In_ ULONG JobInformationLength)
NTSYSAPI NTSTATUS NTAPI ZwResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTKERNELAPI VOID NTAPI PsRevertThreadToSelf(_Inout_ PETHREAD Thread)
NTSYSAPI NTSTATUS NTAPI ZwSuspendProcess(_In_ HANDLE ProcessHandle)
NTKERNELAPI NTSTATUS NTAPI PsSetProcessSecurityPort(_Inout_ PEPROCESS Process, _In_ PVOID SecurityPort)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
NTKERNELAPI HANDLE NTAPI PsGetCurrentThreadProcessId(VOID)
Definition: thread.c:755
NTSYSCALLAPI NTSTATUS NTAPI NtResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTSYSAPI NTSTATUS NTAPI ZwOpenThreadToken(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ BOOLEAN OpenAsSelf, _Out_ PHANDLE TokenHandle)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _Out_bytecap_(JobInformationLength) PVOID JobInformation, _In_ ULONG JobInformationLength, _Out_ PULONG ReturnLength)
BOOLEAN NTAPI PsIsProtectedProcess(_In_ PEPROCESS Process)
NTKERNELAPI VOID NTAPI PsChargePoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the Pool...
Definition: quota.c:775
_Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcessToken(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _Out_ PHANDLE TokenHandle)
NTSYSCALLAPI NTSTATUS NTAPI NtApphelpCacheControl(_In_ APPHELPCACHESERVICECLASS Service, _In_opt_ PAPPHELP_CACHE_SERVICE_LOOKUP ServiceData)
Definition: apphelp.c:728
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationThread(_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength)
NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationJobObject(_In_ HANDLE JobHandle, _In_ JOBOBJECTINFOCLASS JobInformationClass, _Out_bytecap_(JobInformationLength) PVOID JobInformation, _In_ ULONG JobInformationLength, _Out_ PULONG ReturnLength)
NTSYSAPI NTSTATUS NTAPI ZwAlertResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG SuspendCount)
NTSYSAPI NTSTATUS NTAPI ZwRegisterThreadTerminatePort(_In_ HANDLE TerminationPort)
NTSYSAPI NTSTATUS NTAPI ZwAssignProcessToJobObject(_In_ HANDLE JobHandle, _In_ HANDLE ProcessHandle)
NTSYSCALLAPI NTSTATUS NTAPI NtTerminateThread(_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)
NTSYSCALLAPI NTSTATUS NTAPI NtTerminateProcess(_In_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus)
NTSYSAPI NTSTATUS NTAPI ZwOpenProcessTokenEx(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle)
ULONG ACCESS_MASK
Definition: nt_native.h:40
#define NTSYSCALLAPI
Definition: ntbasedef.h:204
@ Service
Definition: ntsecapi.h:292
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:455
#define KeGetPcr()
Definition: ke.h:26
#define __kernel_entry
Definition: specstrings.h:355
Definition: compat.h:836
uint32_t * PULONG
Definition: typedefs.h:59
#define FIELD_OFFSET(t, f)
Definition: typedefs.h:255
INT POOL_TYPE
Definition: typedefs.h:78
#define NTAPI
Definition: typedefs.h:36
ULONG_PTR SIZE_T
Definition: typedefs.h:80
uint32_t ULONG
Definition: typedefs.h:59
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2658
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
Definition: wdfdevice.h:3815
#define FORCEINLINE
Definition: wdftypes.h:67
#define NTKERNELAPI
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_Out_ PCLIENT_ID ClientId
Definition: kefuncs.h:1165
_In_ ACCESS_MASK _In_ BOOLEAN OpenAsSelf
Definition: zwfuncs.h:700