65{
88
89
94 ProcessInformation,
95 ProcessInformationLength,
100 {
101 DPRINT1(
"NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n",
Status, ProcessInformationClass);
103 }
104
108 {
109
110
111
112
113
115 }
116
117
118 switch (ProcessInformationClass)
119 {
120
122
124 {
126 break;
127 }
128
129
131
132
140
141
143 {
144
149 UniqueProcessId;
153
154 }
156 {
157
159 }
161
162
164 break;
165
166
168
170 {
172 break;
173 }
174
176
177
185
186
188
190 {
191
196
197
200
201
203 {
204
208 }
209 else
210 {
211
218 }
219 }
221 {
222
224 }
226
227
229 break;
230
232
233 if (ProcessInformationLength !=
sizeof(
IO_COUNTERS))
234 {
236 break;
237 }
238
240
241
249
250
252
254 {
256 }
258 {
259
260 }
262
263
265
266
268 break;
269
270
272
273
275 {
277 break;
278 }
279
281
282
290
291
293 {
294
300 }
302 {
303
305 }
307
308
310 break;
311
312
314
315 if (ProcessInformationLength !=
sizeof(
HANDLE))
316 {
318 break;
319 }
320
321
323
324
332
333
335 {
336
339 }
341 {
342
344 }
346
347
349 break;
350
352
353 if (ProcessInformationLength !=
sizeof(
ULONG))
354 {
356 break;
357 }
358
359
361
362
370
371
373
374
376 {
377
378 *(
PULONG)ProcessInformation = HandleCount;
379 }
381 {
382
384 }
386
387
389 break;
390
391
393
395 {
397 break;
398 }
399
400
402
403
411
412
414 {
415
417 }
419 {
420
422 }
424
425
427 break;
428
429
431
432
433 if ((ProcessInformationLength !=
sizeof(
VM_COUNTERS)) &&
435 {
437 break;
438 }
439
440
448
449
451 {
452
464
465
466
467
468 Length = ProcessInformationLength;
469 }
471 {
472
474 }
476
477
479 break;
480
481
483
484 if (ProcessInformationLength !=
sizeof(
ULONG))
485 {
487 break;
488 }
489
490
492
493
501
502
504 {
505
507 DefaultHardErrorProcessing;
508 }
510 {
511
513 }
515
516
518 break;
519
520
522
523 if (ProcessInformationLength !=
sizeof(
ULONG))
524 {
526 break;
527 }
528
529
531
532
540
541
543 {
544
547 }
549 {
550
552 }
554
555
557 break;
558
559
561
563 {
564
566 {
568
570 }
572 {
573
576 }
578
579
582 {
584 break;
585 }
586 }
587 else
588 {
589
591 {
593 break;
594 }
595
596
598 }
599
600
601 Length = ProcessInformationLength;
602
603
611
612
614 ProcessInformation,
616
617
619 break;
620
621
623
625 {
627 break;
628 }
629
630
632
633
641
642
644 {
645
648 }
650 {
651
653 }
655
656
658 break;
659
661
662
670
671
674 {
675
678
679
680 if (
Length <= ProcessInformationLength)
681 {
682
684 {
685
689
690
693 }
695 {
696
698 }
700 }
701 else
702 {
703
705 }
706
707
709 }
710
712 break;
713
715
716 if (ProcessInformationLength !=
sizeof(
ULONG))
717 {
719 break;
720 }
721
722
724
725
733
734
736 {
737
738 *(
PULONG)ProcessInformation =
Process->NoDebugInherit ? 0 : 1;
739 }
741 {
742
744 }
746
747
749 break;
750
752
753 if (ProcessInformationLength !=
sizeof(
ULONG))
754 {
756 break;
757 }
758
759
761
762
770
771
773 {
774
776 }
778 {
779
781 }
783
784
786 break;
787
788
790
791 if (ProcessInformationLength !=
sizeof(
ULONG))
792 {
793
795 break;
796 }
797
798
802 {
806
807
811 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart;
812
813
815 NewCookie,
818
819
821 }
822
823
825
826
828 {
829
831 }
833 {
834
836 }
838 break;
839
841
843 {
844
846 break;
847 }
848
849
851
852
854 {
856 }
858 {
859
861 }
863
864
866 break;
867
869
870 if (ProcessInformationLength !=
sizeof(
HANDLE))
871 {
873 break;
874 }
875
876
878
879
887
888
890
891
893
894
896 {
897
898 *(
PHANDLE)ProcessInformation = DebugPort;
899 }
901 {
902
904 }
906 break;
907
909 DPRINT1(
"Handle tracing Not implemented: %lx\n", ProcessInformationClass);
911 break;
912
914
915 if (ProcessInformationLength !=
sizeof(
ULONG))
916 {
918 break;
919 }
920
921
923
924
926
927
929 {
930
932 }
934 {
935
937 }
939 break;
940
942
943 if (ProcessInformationLength !=
sizeof(
ULONG))
944 {
946 break;
947 }
948
949
951
952
960
961
963 {
964
966 }
968 {
969
971 }
973
974
976 break;
977
979
980 if (ProcessInformationLength !=
sizeof(
ULONG_PTR))
981 {
983 break;
984 }
985
986
988
989
997
998
1000 {
1001
1002#ifdef _WIN64
1004#else
1005 Wow64 = 0;
1006#endif
1007
1009 }
1010
1011
1013 {
1014
1016 }
1018 {
1019
1021 }
1023
1024
1026 break;
1027
1029
1030 if (ProcessInformationLength !=
sizeof(
ULONG))
1031 {
1033 break;
1034 }
1035
1036
1038
1040 {
1042 }
1043
1044
1047 {
1048
1050 {
1051
1052 *(
PULONG)ProcessInformation = ExecuteOptions;
1053 }
1055 {
1056
1058 }
1060 }
1061 break;
1062
1064 DPRINT1(
"VDM/16-bit not implemented: %lx\n", ProcessInformationClass);
1066 break;
1067
1069 DPRINT1(
"WS Watch Not implemented: %lx\n", ProcessInformationClass);
1071 break;
1072
1074 DPRINT1(
"Pool limits Not implemented: %lx\n", ProcessInformationClass);
1076 break;
1077
1078
1079 default:
1080 DPRINT1(
"Unsupported info class: %lx\n", ProcessInformationClass);
1082 }
1083
1084
1086 {
1087
1089 }
1091 {
1092
1094 }
1096
1098}
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
#define STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
UNICODE_STRING * PUNICODE_STRING
#define KeQuerySystemTime(t)
#define ExReleaseRundownProtection
#define ExGetPreviousMode
#define ExAcquireRundownProtection
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
#define PROCESS_QUERY_INFORMATION
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
@ ProcessBreakOnTermination
@ ProcessBasicInformation
@ ProcessWow64Information
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
@ ProcessLUIDDeviceMapsEnabled
@ ProcessSessionInformation
@ ProcessImageInformation
@ ProcessPooledUsageAndLimits
@ ProcessDefaultHardErrorMode
@ ProcessDebugObjectHandle
struct _VM_COUNTERS_ * PVM_COUNTERS
#define EXCEPTION_EXECUTE_HANDLER
#define PROCESS_LUID_DOSDEVICES_ONLY
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
struct _IO_COUNTERS * PIO_COUNTERS
#define InterlockedCompareExchange
#define RTL_FIELD_SIZE(type, field)
struct _QUOTA_LIMITS QUOTA_LIMITS
struct _QUOTA_LIMITS * PQUOTA_LIMITS
#define ExFreePoolWithTag(_P, _T)
static const char * ImageName
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
_In_ HANDLE ProcessHandle
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
#define NtCurrentProcess()
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
_In_ ULONG _In_ ULONG _In_ ULONG Length
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
POBJECT_TYPE PsProcessType
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
#define STATUS_INVALID_INFO_CLASS
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
static const INFORMATION_CLASS_INFO PsProcessInfoClass[]
#define _SEH2_YIELD(__stmt)
INT64 MaximumWorkingSetSize
INT64 MinimumWorkingSetSize
SIZE_T QuotaPeakPagedPoolUsage
SIZE_T PeakWorkingSetSize
SIZE_T QuotaPeakNonPagedPoolUsage
SIZE_T QuotaNonPagedPoolUsage
SIZE_T QuotaPagedPoolUsage
#define RtlCopyMemory(Destination, Source, Length)
#define STATUS_INFO_LENGTH_MISMATCH
struct _LARGE_INTEGER::@2302 u
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define ObDereferenceObject
#define PsGetCurrentProcess
_In_ KPROCESSOR_MODE PreviousMode