95 ProcessInformationLength,
101 DPRINT1(
"NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n",
Status, ProcessInformationClass);
118 switch (ProcessInformationClass)
233 if (ProcessInformationLength !=
sizeof(
IO_COUNTERS))
315 if (ProcessInformationLength !=
sizeof(
HANDLE))
353 if (ProcessInformationLength !=
sizeof(
ULONG))
378 *(
PULONG)ProcessInformation = HandleCount;
433 if ((ProcessInformationLength !=
sizeof(
VM_COUNTERS)) &&
468 Length = ProcessInformationLength;
484 if (ProcessInformationLength !=
sizeof(
ULONG))
507 DefaultHardErrorProcessing;
523 if (ProcessInformationLength !=
sizeof(
ULONG))
601 Length = ProcessInformationLength;
680 if (
Length <= ProcessInformationLength)
716 if (ProcessInformationLength !=
sizeof(
ULONG))
738 *(
PULONG)ProcessInformation =
Process->NoDebugInherit ? 0 : 1;
753 if (ProcessInformationLength !=
sizeof(
ULONG))
791 if (ProcessInformationLength !=
sizeof(
ULONG))
811 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart;
870 if (ProcessInformationLength !=
sizeof(
HANDLE))
898 *(
PHANDLE)ProcessInformation = DebugPort;
909 DPRINT1(
"Handle tracing Not implemented: %lx\n", ProcessInformationClass);
915 if (ProcessInformationLength !=
sizeof(
ULONG))
943 if (ProcessInformationLength !=
sizeof(
ULONG))
980 if (ProcessInformationLength !=
sizeof(
ULONG_PTR))
1030 if (ProcessInformationLength !=
sizeof(
ULONG))
1052 *(
PULONG)ProcessInformation = ExecuteOptions;
1064 DPRINT1(
"VDM/16-bit not implemented: %lx\n", ProcessInformationClass);
1069 DPRINT1(
"WS Watch Not implemented: %lx\n", ProcessInformationClass);
1074 DPRINT1(
"Pool limits Not implemented: %lx\n", ProcessInformationClass);
1080 DPRINT1(
"Unsupported info class: %lx\n", ProcessInformationClass);
struct _LARGE_INTEGER::@2253 u
#define KeQuerySystemTime(t)
#define RTL_FIELD_SIZE(type, field)
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
struct _VM_COUNTERS_ * PVM_COUNTERS
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define STATUS_INFO_LENGTH_MISMATCH
#define PROCESS_QUERY_INFORMATION
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
#define STATUS_INVALID_PARAMETER
SIZE_T QuotaPagedPoolUsage
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
#define ExAcquireRundownProtection
SIZE_T QuotaPeakPagedPoolUsage
#define InterlockedCompareExchange
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
SIZE_T QuotaPeakNonPagedPoolUsage
struct _QUOTA_LIMITS QUOTA_LIMITS
return STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
struct _QUOTA_LIMITS * PQUOTA_LIMITS
#define PsGetCurrentProcess
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
SIZE_T QuotaNonPagedPoolUsage
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
#define NtCurrentProcess()
_In_ KPROCESSOR_MODE PreviousMode
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
_Must_inspect_result_ _In_ ULONG Flags
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
#define NT_SUCCESS(StatCode)
#define EXCEPTION_EXECUTE_HANDLER
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define ObDereferenceObject
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
static const char * ImageName
#define STATUS_INVALID_INFO_CLASS
#define PROCESS_LUID_DOSDEVICES_ONLY
INT64 MinimumWorkingSetSize
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
INT64 MaximumWorkingSetSize
UNICODE_STRING * PUNICODE_STRING
struct _IO_COUNTERS IO_COUNTERS
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
#define RtlCopyMemory(Destination, Source, Length)
#define _SEH2_EXCEPT(...)
SIZE_T PeakWorkingSetSize
#define _SEH2_GetExceptionCode()
#define _SEH2_YIELD(__stmt)
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
_In_ HANDLE ProcessHandle
#define ExFreePoolWithTag(_P, _T)
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
POBJECT_TYPE PsProcessType
static const INFORMATION_CLASS_INFO PsProcessInfoClass[]
struct _IO_COUNTERS * PIO_COUNTERS