65{
70
72
73
78 ProcessInformation,
79 ProcessInformationLength,
84 {
85 DPRINT1(
"NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n",
Status, ProcessInformationClass);
87 }
88
92 {
93
94
95
96
97
99 }
100
101
102 switch (ProcessInformationClass)
103 {
104
106 {
108
110 {
112 break;
113 }
114
115
117
118
126
127
129 {
130
135 UniqueProcessId;
139
140 }
142 {
143
145 }
147
148
150 break;
151 }
152
153
155 {
158
161 {
163 break;
164 }
165
166
167 Length = ProcessInformationLength;
169
170
178
179
181
183
184
189
190
192
193
195 {
196
200 }
201 else
202 {
203
210 }
211
212
213 if (Extended)
214 {
215 QuotaLimits.
Flags |= (
Process->Vm.Flags.MaximumWorkingSetHard ?
217 QuotaLimits.
Flags |= (
Process->Vm.Flags.MinimumWorkingSetHard ?
219
220
221
223 }
224
225
227 {
229 }
231 {
232
234 }
236
237
239 break;
240 }
241
243 {
246
247 if (ProcessInformationLength !=
sizeof(
IO_COUNTERS))
248 {
250 break;
251 }
252
254
255
263
264
266
268 {
270 }
272 {
273
274 }
276
277
279
280
282 break;
283 }
284
285
287 {
290
291
293 {
295 break;
296 }
297
299
300
308
309
311 {
312
318 }
320 {
321
323 }
325
326
328 break;
329 }
330
331
333
334 if (ProcessInformationLength !=
sizeof(
HANDLE))
335 {
337 break;
338 }
339
340
342
343
351
352
354 {
355
358 }
360 {
361
363 }
365
366
368 break;
369
371 {
373
374 if (ProcessInformationLength !=
sizeof(
ULONG))
375 {
377 break;
378 }
379
380
382
383
391
392
394
395
397 {
398
399 *(
PULONG)ProcessInformation = HandleCount;
400 }
402 {
403
405 }
407
408
410 break;
411 }
412
413
415 {
417
419 {
421 break;
422 }
423
424
426
427
435
436
438 {
439
441 }
443 {
444
446 }
448
449
451 break;
452 }
453
454
456 {
458
459
460 if ((ProcessInformationLength !=
sizeof(
VM_COUNTERS)) &&
462 {
464 break;
465 }
466
467
475
476
478 {
479
491
492
493
494
495 Length = ProcessInformationLength;
496 }
498 {
499
501 }
503
504
506 break;
507 }
508
509
511
512 if (ProcessInformationLength !=
sizeof(
ULONG))
513 {
515 break;
516 }
517
518
520
521
529
530
532 {
533
535 DefaultHardErrorProcessing;
536 }
538 {
539
541 }
543
544
546 break;
547
548
550
551 if (ProcessInformationLength !=
sizeof(
ULONG))
552 {
554 break;
555 }
556
557
559
560
568
569
571 {
572
575 }
577 {
578
580 }
582
583
585 break;
586
587
589 {
591
593 {
594
596 {
598
600 }
602 {
603
606 }
608
609
612 {
614 break;
615 }
616 }
617 else
618 {
619
621 {
623 break;
624 }
625
626
628 }
629
630
631 Length = ProcessInformationLength;
632
633
641
642
644 ProcessInformation,
646
647
649 break;
650 }
651
652
654 {
656
658 {
660 break;
661 }
662
663
665
666
674
675
677 {
678
681 }
683 {
684
686 }
688
689
691 break;
692 }
693
695 {
697
698
706
707
710 {
711
714
715
716 if (
Length <= ProcessInformationLength)
717 {
718
720 {
721
725
726
729 }
731 {
732
734 }
736 }
737 else
738 {
739
741 }
742
743
745 }
746
748 break;
749 }
750
752
753 if (ProcessInformationLength !=
sizeof(
ULONG))
754 {
756 break;
757 }
758
759
761
762
770
771
773 {
774
775 *(
PULONG)ProcessInformation =
Process->NoDebugInherit ? 0 : 1;
776 }
778 {
779
781 }
783
784
786 break;
787
789
790 if (ProcessInformationLength !=
sizeof(
ULONG))
791 {
793 break;
794 }
795
796
798
799
807
808
810 {
811
813 }
815 {
816
818 }
820
821
823 break;
824
825
827 {
829
830 if (ProcessInformationLength !=
sizeof(
ULONG))
831 {
832
834 break;
835 }
836
837
841 {
845
846
850 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart;
851
852
854 NewCookie,
857
858
860 }
861
862
864
865
867 {
868
870 }
872 {
873
875 }
877 break;
878 }
879
881
883 {
884
886 break;
887 }
888
889
891
892
894
895
897 {
899 }
901 {
902
904 }
906 break;
907
909 {
911
912 if (ProcessInformationLength !=
sizeof(
HANDLE))
913 {
915 break;
916 }
917
918
920
921
929
930
932
933
935
936
938 {
939
940 *(
PHANDLE)ProcessInformation = DebugPort;
941 }
943 {
944 if (DebugPort)
946
947
948
950 }
952 break;
953 }
954
956 DPRINT1(
"Handle tracing Not implemented: %lx\n", ProcessInformationClass);
958 break;
959
961
962 if (ProcessInformationLength !=
sizeof(
ULONG))
963 {
965 break;
966 }
967
968
970
971
973
974
976 {
977
979 }
981 {
982
984 }
986 break;
987
989
990 if (ProcessInformationLength !=
sizeof(
ULONG))
991 {
993 break;
994 }
995
996
998
999
1007
1008
1010 {
1011
1013 }
1015 {
1016
1018 }
1020
1021
1023 break;
1024
1026 {
1028
1029 if (ProcessInformationLength !=
sizeof(
ULONG_PTR))
1030 {
1032 break;
1033 }
1034
1035
1037
1038
1046
1047#ifdef _WIN64
1048
1050 {
1051
1053
1055 }
1056#endif
1057
1058
1060
1061
1063 {
1064
1066 }
1068 {
1069
1071 }
1073 break;
1074 }
1075
1077 {
1078 ULONG ExecuteOptions = 0;
1079
1080 if (ProcessInformationLength !=
sizeof(
ULONG))
1081 {
1083 break;
1084 }
1085
1086
1088
1090 {
1092 break;
1093 }
1094
1095
1098 {
1099
1101 {
1102
1103 *(
PULONG)ProcessInformation = ExecuteOptions;
1104 }
1106 {
1107
1109 }
1111 }
1112 break;
1113 }
1114
1116 DPRINT1(
"VDM/16-bit not implemented: %lx\n", ProcessInformationClass);
1118 break;
1119
1121 DPRINT1(
"WS Watch Not implemented: %lx\n", ProcessInformationClass);
1123 break;
1124
1126 DPRINT1(
"Pool limits Not implemented: %lx\n", ProcessInformationClass);
1128 break;
1129
1130
1131 default:
1132 DPRINT1(
"Unsupported info class: %lx\n", ProcessInformationClass);
1134 }
1135
1136
1138 {
1139
1141 {
1143 }
1145 {
1146
1147
1149 }
1151 }
1152
1154}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
@ ProcessBreakOnTermination
@ ProcessBasicInformation
@ ProcessWow64Information
#define STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
UNICODE_STRING * PUNICODE_STRING
#define KeQuerySystemTime(t)
#define ExReleaseRundownProtection
#define ExGetPreviousMode
#define ExAcquireRundownProtection
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
#define PROCESS_QUERY_INFORMATION
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
@ ProcessLUIDDeviceMapsEnabled
@ ProcessSessionInformation
@ ProcessImageInformation
@ ProcessPooledUsageAndLimits
@ ProcessDefaultHardErrorMode
@ ProcessDebugObjectHandle
struct _VM_COUNTERS_ * PVM_COUNTERS
#define EXCEPTION_EXECUTE_HANDLER
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
#define PROCESS_LUID_DOSDEVICES_ONLY
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
struct _VM_COUNTERS_EX VM_COUNTERS_EX
struct _IO_COUNTERS * PIO_COUNTERS
#define InterlockedCompareExchange
#define RTL_FIELD_SIZE(type, field)
#define ExFreePoolWithTag(_P, _T)
static const char * ImageName
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
_In_ HANDLE ProcessHandle
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
#define NtCurrentProcess()
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
_In_ ULONG _In_ ULONG _In_ ULONG Length
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
POBJECT_TYPE PsProcessType
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
#define STATUS_INVALID_INFO_CLASS
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
static const INFORMATION_CLASS_INFO PsProcessInfoClass[]
#define _SEH2_YIELD(__stmt)
SIZE_T MaximumWorkingSetSize
RATE_QUOTA_LIMIT CpuRateLimit
SIZE_T MinimumWorkingSetSize
SIZE_T QuotaPeakPagedPoolUsage
SIZE_T PeakWorkingSetSize
SIZE_T QuotaPeakNonPagedPoolUsage
SIZE_T QuotaNonPagedPoolUsage
SIZE_T QuotaPagedPoolUsage
#define RtlCopyMemory(Destination, Source, Length)
#define STATUS_INFO_LENGTH_MISMATCH
struct _LARGE_INTEGER::@2473 u
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define ObDereferenceObject
#define PsGetCurrentProcess