65{
70
72
73
78 ProcessInformation,
79 ProcessInformationLength,
84 {
85 DPRINT1(
"NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n",
Status, ProcessInformationClass);
87 }
88
92 {
93
94
95
96
97
99 }
100
101
102 switch (ProcessInformationClass)
103 {
104
106 {
108
110 {
112 break;
113 }
114
115
117
118
126
127
129 {
130
135 UniqueProcessId;
139
140 }
142 {
143
145 }
147
148
150 break;
151 }
152
153
155 {
158
161 {
163 break;
164 }
165
166
167 Length = ProcessInformationLength;
169
170
178
179
181
183
184
189
190
192
193
195 {
196
200 }
201 else
202 {
203
210 }
211
212
213 if (Extended)
214 {
215 QuotaLimits.
Flags |= (
Process->Vm.Flags.MaximumWorkingSetHard ?
217 QuotaLimits.
Flags |= (
Process->Vm.Flags.MinimumWorkingSetHard ?
219
220
221
223 }
224
225
227 {
229 }
231 {
232
234 }
236
237
239 break;
240 }
241
243 {
246
247 if (ProcessInformationLength !=
sizeof(
IO_COUNTERS))
248 {
250 break;
251 }
252
254
255
263
264
266
268 {
270 }
272 {
273
274 }
276
277
279
280
282 break;
283 }
284
285
287 {
290
291
293 {
295 break;
296 }
297
299
300
308
309
311 {
312
318 }
320 {
321
323 }
325
326
328 break;
329 }
330
331
333
334 if (ProcessInformationLength !=
sizeof(
HANDLE))
335 {
337 break;
338 }
339
340
342
343
351
352
354 {
355
358 }
360 {
361
363 }
365
366
368 break;
369
371 {
373
374 if (ProcessInformationLength !=
sizeof(
ULONG))
375 {
377 break;
378 }
379
380
382
383
391
392
394
395
397 {
398
399 *(
PULONG)ProcessInformation = HandleCount;
400 }
402 {
403
405 }
407
408
410 break;
411 }
412
413
415 {
417
419 {
421 break;
422 }
423
424
426
427
435
436
438 {
439
441 }
443 {
444
446 }
448
449
451 break;
452 }
453
454
456 {
458
459
460 if ((ProcessInformationLength !=
sizeof(
VM_COUNTERS)) &&
462 {
464 break;
465 }
466
467
475
476
478 {
479
491
492
493
494
495 Length = ProcessInformationLength;
496 }
498 {
499
501 }
503
504
506 break;
507 }
508
509
511
512 if (ProcessInformationLength !=
sizeof(
ULONG))
513 {
515 break;
516 }
517
518
520
521
529
530
532 {
533
535 DefaultHardErrorProcessing;
536 }
538 {
539
541 }
543
544
546 break;
547
548
550
551 if (ProcessInformationLength !=
sizeof(
ULONG))
552 {
554 break;
555 }
556
557
559
560
568
569
571 {
572
575 }
577 {
578
580 }
582
583
585 break;
586
587
589 {
591
593 {
594
596 {
598
600 }
602 {
603
606 }
608
609
612 {
614 break;
615 }
616 }
617 else
618 {
619
621 {
623 break;
624 }
625
626
628 }
629
630
631 Length = ProcessInformationLength;
632
633
641
642
644 ProcessInformation,
646
647
649 break;
650 }
651
652
654 {
656
658 {
660 break;
661 }
662
663
665
666
674
675
677 {
678
681 }
683 {
684
686 }
688
689
691 break;
692 }
693
695 {
697
698
706
707
710 {
711
714
715
716 if (
Length <= ProcessInformationLength)
717 {
718
720 {
721
725
726
729 }
731 {
732
734 }
736 }
737 else
738 {
739
741 }
742
743
745 }
746
748 break;
749 }
750
752
753 if (ProcessInformationLength !=
sizeof(
ULONG))
754 {
756 break;
757 }
758
759
761
762
770
771
773 {
774
775 *(
PULONG)ProcessInformation =
Process->NoDebugInherit ? 0 : 1;
776 }
778 {
779
781 }
783
784
786 break;
787
789
790 if (ProcessInformationLength !=
sizeof(
ULONG))
791 {
793 break;
794 }
795
796
798
799
807
808
810 {
811
813 }
815 {
816
818 }
820
821
823 break;
824
825
827 {
829
830 if (ProcessInformationLength !=
sizeof(
ULONG))
831 {
832
834 break;
835 }
836
837
841 {
845
846
850 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart;
851
852
854 NewCookie,
857
858
860 }
861
862
864
865
867 {
868
870 }
872 {
873
875 }
877 break;
878 }
879
881
883 {
884
886 break;
887 }
888
889
891
892
894 {
896 }
898 {
899
901 }
903
904
906 break;
907
909 {
911
912 if (ProcessInformationLength !=
sizeof(
HANDLE))
913 {
915 break;
916 }
917
918
920
921
929
930
932
933
935
936
938 {
939
940 *(
PHANDLE)ProcessInformation = DebugPort;
941 }
943 {
944
946 }
948 break;
949 }
950
952 DPRINT1(
"Handle tracing Not implemented: %lx\n", ProcessInformationClass);
954 break;
955
957
958 if (ProcessInformationLength !=
sizeof(
ULONG))
959 {
961 break;
962 }
963
964
966
967
969
970
972 {
973
975 }
977 {
978
980 }
982 break;
983
985
986 if (ProcessInformationLength !=
sizeof(
ULONG))
987 {
989 break;
990 }
991
992
994
995
1003
1004
1006 {
1007
1009 }
1011 {
1012
1014 }
1016
1017
1019 break;
1020
1022 {
1024
1025 if (ProcessInformationLength !=
sizeof(
ULONG_PTR))
1026 {
1028 break;
1029 }
1030
1031
1033
1034
1042
1043
1045 {
1046
1047#ifdef _WIN64
1049#else
1050 Wow64 = 0;
1051#endif
1052
1054 }
1055
1056
1058 {
1059
1061 }
1063 {
1064
1066 }
1068
1069
1071 break;
1072 }
1073
1075 {
1076 ULONG ExecuteOptions = 0;
1077
1078 if (ProcessInformationLength !=
sizeof(
ULONG))
1079 {
1081 break;
1082 }
1083
1084
1086
1088 {
1090 }
1091
1092
1095 {
1096
1098 {
1099
1100 *(
PULONG)ProcessInformation = ExecuteOptions;
1101 }
1103 {
1104
1106 }
1108 }
1109 break;
1110 }
1111
1113 DPRINT1(
"VDM/16-bit not implemented: %lx\n", ProcessInformationClass);
1115 break;
1116
1118 DPRINT1(
"WS Watch Not implemented: %lx\n", ProcessInformationClass);
1120 break;
1121
1123 DPRINT1(
"Pool limits Not implemented: %lx\n", ProcessInformationClass);
1125 break;
1126
1127
1128 default:
1129 DPRINT1(
"Unsupported info class: %lx\n", ProcessInformationClass);
1131 }
1132
1133
1135 {
1136
1138 }
1140 {
1141
1143 }
1145
1147}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
#define STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
UNICODE_STRING * PUNICODE_STRING
#define KeQuerySystemTime(t)
#define ExReleaseRundownProtection
#define ExGetPreviousMode
#define ExAcquireRundownProtection
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
#define PROCESS_QUERY_INFORMATION
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
@ ProcessBreakOnTermination
@ ProcessBasicInformation
@ ProcessWow64Information
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
@ ProcessLUIDDeviceMapsEnabled
@ ProcessSessionInformation
@ ProcessImageInformation
@ ProcessPooledUsageAndLimits
@ ProcessDefaultHardErrorMode
@ ProcessDebugObjectHandle
struct _VM_COUNTERS_ * PVM_COUNTERS
#define EXCEPTION_EXECUTE_HANDLER
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
#define PROCESS_LUID_DOSDEVICES_ONLY
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
struct _VM_COUNTERS_EX VM_COUNTERS_EX
struct _IO_COUNTERS * PIO_COUNTERS
#define InterlockedCompareExchange
#define RTL_FIELD_SIZE(type, field)
#define ExFreePoolWithTag(_P, _T)
static const char * ImageName
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
_In_ HANDLE ProcessHandle
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
#define NtCurrentProcess()
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
_In_ ULONG _In_ ULONG _In_ ULONG Length
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
POBJECT_TYPE PsProcessType
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
#define STATUS_INVALID_INFO_CLASS
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
static const INFORMATION_CLASS_INFO PsProcessInfoClass[]
#define _SEH2_YIELD(__stmt)
SIZE_T MaximumWorkingSetSize
RATE_QUOTA_LIMIT CpuRateLimit
SIZE_T MinimumWorkingSetSize
SIZE_T QuotaPeakPagedPoolUsage
SIZE_T PeakWorkingSetSize
SIZE_T QuotaPeakNonPagedPoolUsage
SIZE_T QuotaNonPagedPoolUsage
SIZE_T QuotaPagedPoolUsage
#define RtlCopyMemory(Destination, Source, Length)
#define STATUS_INFO_LENGTH_MISMATCH
struct _LARGE_INTEGER::@2307 u
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define ObDereferenceObject
#define PsGetCurrentProcess