ReactOS  0.4.15-dev-2535-gcf6c191
psfuncs.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros

#define PsGetCurrentProcess   IoGetCurrentProcess
 
#define _PSGETCURRENTTHREAD_
 

Functions

 $if (_WDMDDK_) NTKERNELAPI NTSTATUS NTAPI PsWrapApcWow64Thread(_Inout_ PVOID *ApcContext
 
 _IRQL_requires_max_ (DISPATCH_LEVEL) FORCEINLINE PETHREAD NTAPI PsGetCurrentThread(VOID)
 
 $endif (_WDMDDK_) $if(_NTDDK_) __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess(_Out_ PHANDLE ProcessHandle
 
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess (_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
 
 $endif (_NTDDK_) $if(_NTIFS_) _Must_inspect_result_ _IRQL_requires_max_(APC_LEVEL) NTKERNELAPI NTSTATUS NTAPI PsLookupProcessByProcessId(_In_ HANDLE ProcessId
 
_Must_inspect_result_ _IRQL_requires_max_ (APC_LEVEL) NTKERNELAPI NTSTATUS NTAPI PsLookupThreadByThreadId(_In_ HANDLE UniqueThreadId
 
 $endif (_NTIFS_) $if(_WDMDDK_) _IRQL_requires_max_(APC_LEVEL) _Post_satisfies_(return<=0) _Must_inspect_result_ NTKERNELAPI NTSTATUS NTAPI PsCreateSystemThread(_Out_ PHANDLE ThreadHandle
 
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE _In_opt_ _When_ (return==0, __drv_aliasesMem) PVOID StartContext)
 
 _IRQL_requires_max_ (PASSIVE_LEVEL) NTKERNELAPI NTSTATUS NTAPI PsTerminateSystemThread(_In_ NTSTATUS ExitStatus)
 
NTKERNELAPI HANDLE NTAPI PsGetCurrentProcessId (VOID)
 
NTKERNELAPI BOOLEAN NTAPI PsGetVersion (OUT PULONG MajorVersion OPTIONAL, OUT PULONG MinorVersion OPTIONAL, OUT PULONG BuildNumber OPTIONAL, OUT PUNICODE_STRING CSDVersion OPTIONAL)
 
NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess (_In_ PETHREAD Thread)
 
NTKERNELAPI NTSTATUS NTAPI PsRemoveCreateThreadNotifyRoutine (_In_ PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine)
 
NTKERNELAPI BOOLEAN NTAPI PsIsSystemThread (_In_ PETHREAD Thread)
 
NTKERNELAPI PVOID NTAPI PsGetCurrentThreadTeb (VOID)
 
NTKERNELAPI BOOLEAN NTAPI PsSetCurrentThreadPrefetching (IN BOOLEAN Prefetching)
 
NTKERNELAPI BOOLEAN NTAPI PsIsCurrentThreadPrefetching (VOID)
 
NTKERNELAPI NTSTATUS NTAPI PsSetCreateProcessNotifyRoutineEx (IN PCREATE_PROCESS_NOTIFY_ROUTINE_EX NotifyRoutine, IN BOOLEAN Remove)
 

Variables

_Inout_ PVOIDApcRoutine
 
_In_ ACCESS_MASK DesiredAccess
 
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES ObjectAttributes
 
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _In_opt_ PCLIENT_ID ClientId
 
_Outptr_ PEPROCESSProcess
 
_Must_inspect_result_ _Outptr_ PETHREADThread
 
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE ProcessHandle
 
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE StartRoutine
 
_In_ BOOLEAN Remove
 
_Out_ PBOOLEAN CopyOnOpen
 
_Out_ PBOOLEAN _Out_ PBOOLEAN EffectiveOnly
 
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
 
_Must_inspect_result_ _In_opt_ PACCESS_TOKEN Token
 
_Inout_ PSE_IMPERSONATION_STATE ImpersonationState
 
_In_ POOL_TYPE PoolType
 
_In_ POOL_TYPE _In_ ULONG_PTR Amount
 

Macro Definition Documentation

◆ _PSGETCURRENTTHREAD_

#define _PSGETCURRENTTHREAD_

Definition at line 20 of file psfuncs.h.

◆ PsGetCurrentProcess

#define PsGetCurrentProcess   IoGetCurrentProcess

Definition at line 17 of file psfuncs.h.

Function Documentation

◆ $endif() [1/3]

$endif ( _WDMDDK_  )

Definition at line 202 of file ke.h.

226 {
227  ULONGLONG Low;
228  LONGLONG High;
229 } NEON128, *PNEON128;
Definition: strmini.h:380
int64_t LONGLONG
Definition: typedefs.h:68
uint64_t ULONGLONG
Definition: typedefs.h:67
Definition: strmini.h:378
NEON128
Definition: ke.h:229
* PNEON128
Definition: ke.h:229

◆ $endif() [2/3]

$endif ( _NTDDK_  )

Definition at line 2494 of file iofuncs.h.

2502 {
2503  PriorityInfo->Size = sizeof(IO_PRIORITY_INFO);
2504  PriorityInfo->ThreadPriority = 0xffff;
2505  PriorityInfo->IoPriority = IoPriorityNormal;
2506  PriorityInfo->PagePriority = 0;
2507 }
struct _IO_PRIORITY_INFO IO_PRIORITY_INFO
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD _Inout_ PIO_PRIORITY_INFO PriorityInfo
Definition: fltkernel.h:2653

◆ $endif() [3/3]

$endif ( _NTIFS_  )
pure virtual

Definition at line 2827 of file rtlfuncs.h.

2841 {
2843  ret.QuadPart = SignedInteger;
2844  return ret;
2845 }
return ret
Definition: rtlfuncs.h:3092

◆ $if()

$if ( _WDMDDK_  )

Kernel definitions for AMD64

Kernel definitions for ARM

Definition at line 1 of file ke.h.

31 {
32  ULONG Dummy;
struct _KFLOATING_SAVE KFLOATING_SAVE
struct _KFLOATING_SAVE * PKFLOATING_SAVE
unsigned int ULONG
Definition: retypes.h:1

◆ _IRQL_requires_max_() [1/3]

_IRQL_requires_max_ ( DISPATCH_LEVEL  )

Definition at line 21 of file psfuncs.h.

26 {
27  return (PETHREAD)KeGetCurrentThread();
28 }
#define KeGetCurrentThread
Definition: hal.h:50

◆ _IRQL_requires_max_() [2/3]

_Must_inspect_result_ _IRQL_requires_max_ ( APC_LEVEL  )

Definition at line 197 of file cddata.c.

254 {
255  THREAD_CONTEXT ThreadContext = {0};
256  PIRP_CONTEXT IrpContext = NULL;
257  BOOLEAN Wait;
258 
259 #ifdef CD_SANITY
260  PVOID PreviousTopLevel;
261 #endif
262 
264 
265 #if DBG
266 
267  KIRQL SaveIrql = KeGetCurrentIrql();
268 
269 #endif
270 
272 
274 
276 
277 #ifdef CD_SANITY
278  PreviousTopLevel = IoGetTopLevelIrp();
279 #endif
280 
281  //
282  // Loop until this request has been completed or posted.
283  //
284 
285  do {
286 
287  //
288  // Use a try-except to handle the exception cases.
289  //
290 
291  _SEH2_TRY {
292 
293  //
294  // If the IrpContext is NULL then this is the first pass through
295  // this loop.
296  //
297 
298  if (IrpContext == NULL) {
299 
300  //
301  // Decide if this request is waitable an allocate the IrpContext.
302  // If the file object in the stack location is NULL then this
303  // is a mount which is always waitable. Otherwise we look at
304  // the file object flags.
305  //
306 
308 
309  Wait = TRUE;
310 
311  } else {
312 
313  Wait = CanFsdWait( Irp );
314  }
315 
316  IrpContext = CdCreateIrpContext( Irp, Wait );
317 
318  //
319  // Update the thread context information.
320  //
321 
322  CdSetThreadContext( IrpContext, &ThreadContext );
323 
324 #ifdef CD_SANITY
325  NT_ASSERT( !CdTestTopLevel ||
326  SafeNodeType( IrpContext->TopLevel ) == CDFS_NTC_IRP_CONTEXT );
327 #endif
328 
329  //
330  // Otherwise cleanup the IrpContext for the retry.
331  //
332 
333  } else {
334 
335  //
336  // Set the MORE_PROCESSING flag to make sure the IrpContext
337  // isn't inadvertently deleted here. Then cleanup the
338  // IrpContext to perform the retry.
339  //
340 
341  SetFlag( IrpContext->Flags, IRP_CONTEXT_FLAG_MORE_PROCESSING );
342  CdCleanupIrpContext( IrpContext, FALSE );
343  }
344 
345  //
346  // Case on the major irp code.
347  //
348 
349  switch (IrpContext->MajorFunction) {
350 
351  case IRP_MJ_CREATE :
352 
353  Status = CdCommonCreate( IrpContext, Irp );
354  break;
355 
356  case IRP_MJ_CLOSE :
357 
358  Status = CdCommonClose( IrpContext, Irp );
359  break;
360 
361  case IRP_MJ_READ :
362 
363  //
364  // If this is an Mdl complete request, don't go through
365  // common read.
366  //
367 
368  if (FlagOn( IrpContext->MinorFunction, IRP_MN_COMPLETE )) {
369 
370  Status = CdCompleteMdl( IrpContext, Irp );
371 
372  } else {
373 
374  Status = CdCommonRead( IrpContext, Irp );
375  }
376 
377  break;
378 
379  case IRP_MJ_WRITE :
380 
381  Status = CdCommonWrite( IrpContext, Irp );
382  break;
383 
385 
386  Status = CdCommonQueryInfo( IrpContext, Irp );
387  break;
388 
390 
391  Status = CdCommonSetInfo( IrpContext, Irp );
392  break;
393 
395 
396  Status = CdCommonQueryVolInfo( IrpContext, Irp );
397  break;
398 
400 
401  Status = CdCommonDirControl( IrpContext, Irp );
402  break;
403 
405 
406  Status = CdCommonFsControl( IrpContext, Irp );
407  break;
408 
409  case IRP_MJ_DEVICE_CONTROL :
410 
411  Status = CdCommonDevControl( IrpContext, Irp );
412  break;
413 
414  case IRP_MJ_LOCK_CONTROL :
415 
416  Status = CdCommonLockControl( IrpContext, Irp );
417  break;
418 
419  case IRP_MJ_CLEANUP :
420 
421  Status = CdCommonCleanup( IrpContext, Irp );
422  break;
423 
424  case IRP_MJ_PNP :
425 
426  Status = CdCommonPnp( IrpContext, Irp );
427  break;
428 
429  case IRP_MJ_SHUTDOWN :
430 
431  Status = CdCommonShutdown( IrpContext, Irp );
432  break;
433 
434  default :
435 
437  CdCompleteRequest( IrpContext, Irp, Status );
438  }
439 
441 
442  Status = CdProcessException( IrpContext, Irp, _SEH2_GetExceptionCode() );
443  } _SEH2_END;
444 
445  } while (Status == STATUS_CANT_WAIT);
446 
447 #ifdef CD_SANITY
448  NT_ASSERT( !CdTestTopLevel ||
449  (PreviousTopLevel == IoGetTopLevelIrp()) );
450 #endif
451 
453 
454  NT_ASSERT( SaveIrql == KeGetCurrentIrql( ));
455 
456  return Status;
457 }
#define KeGetCurrentIrql()
Definition: env_spec_w32.h:706
VOID CdSetThreadContext(_Inout_ PIRP_CONTEXT IrpContext, _In_ PTHREAD_CONTEXT ThreadContext)
Definition: cddata.c:981
#define IRP_MJ_CREATE
Definition: rdpdr.c:44
#define FsRtlEnterFileSystem
#define FsRtlExitFileSystem
#define IRP_MJ_SHUTDOWN
#define TRUE
Definition: types.h:120
#define UNREFERENCED_PARAMETER(P)
Definition: ntbasedef.h:317
#define IRP_CONTEXT_FLAG_MORE_PROCESSING
Definition: cdstruc.h:1214
_In_ WDFDPC _In_ BOOLEAN Wait
Definition: wdfdpc.h:167
#define SafeNodeType(Ptr)
Definition: nodetype.h:54
#define IRP_MJ_PNP
Definition: cdrw_usr.h:52
LONG NTSTATUS
Definition: precomp.h:26
#define STATUS_INVALID_DEVICE_REQUEST
Definition: udferr_usr.h:138
_SEH2_TRY
Definition: create.c:4226
#define IRP_MN_COMPLETE
Definition: iotypes.h:4419
UCHAR KIRQL
Definition: env_spec_w32.h:591
_In_ PDEVICE_OBJECT DeviceObject
Definition: wdfdevice.h:2055
#define FALSE
Definition: types.h:117
_In_ PIRP Irp
Definition: csq.h:116
VOID CdCompleteRequest(_Inout_opt_ PIRP_CONTEXT IrpContext, _Inout_opt_ PIRP Irp, _In_ NTSTATUS Status)
Definition: cddata.c:914
#define _SEH2_GetExceptionInformation()
Definition: pseh2_64.h:164
unsigned char BOOLEAN
#define IRP_MJ_QUERY_VOLUME_INFORMATION
Definition: rdpdr.c:50
#define IRP_MJ_DIRECTORY_CONTROL
Definition: rdpdr.c:51
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
Definition: wdfdevice.h:547
Status
Definition: gdiplustypes.h:24
#define IRP_MJ_FILE_SYSTEM_CONTROL
PIRP NTAPI IoGetTopLevelIrp(VOID)
Definition: irp.c:1843
#define CanFsdWait(I)
Definition: cdprocs.h:2001
NTSTATUS CdCompleteMdl(_In_ PIRP_CONTEXT IrpContext, _Inout_ PIRP Irp)
Definition: cachesup.c:411
#define IRP_MJ_CLOSE
Definition: rdpdr.c:45
NTSTATUS CdCommonDevControl(_Inout_ PIRP_CONTEXT IrpContext, _Inout_ PIRP Irp)
Definition: devctrl.c:46
#define FlagOn(_F, _SF)
Definition: ext2fs.h:179
__drv_aliasesMem FORCEINLINE PIO_STACK_LOCATION IoGetCurrentIrpStackLocation(_In_ PIRP Irp)
Definition: iofuncs.h:2793
#define SetFlag(_F, _SF)
Definition: ext2fs.h:187
_SEH2_END
Definition: create.c:4400
LONG CdExceptionFilter(_Inout_ PIRP_CONTEXT IrpContext, _In_ PEXCEPTION_POINTERS ExceptionPointer)
Definition: cddata.c:525
#define ASSERT_OPTIONAL_IRP(I)
Definition: cddata.h:251
#define NULL
Definition: types.h:112
VOID CdCleanupIrpContext(_In_ PIRP_CONTEXT IrpContext, _In_ BOOLEAN Post)
Definition: strucsup.c:1733
NTSTATUS CdCommonLockControl(_Inout_ PIRP_CONTEXT IrpContext, _Inout_ PIRP Irp)
Definition: lockctrl.c:35
#define CDFS_NTC_IRP_CONTEXT
Definition: nodetype.h:34
#define IRP_MJ_LOCK_CONTROL
Definition: rdpdr.c:53
#define IRP_MJ_READ
Definition: rdpdr.c:46
#define IRP_MJ_CLEANUP
#define IRP_MJ_SET_INFORMATION
Definition: rdpdr.c:49
#define IRP_MJ_WRITE
Definition: rdpdr.c:47
#define IRP_MJ_QUERY_INFORMATION
Definition: rdpdr.c:48
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:40
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:165
_Ret_valid_ PIRP_CONTEXT CdCreateIrpContext(_In_ PIRP Irp, _In_ BOOLEAN Wait)
Definition: strucsup.c:1573
#define IRP_MJ_DEVICE_CONTROL
Definition: rdpdr.c:52
#define STATUS_CANT_WAIT
Definition: ntstatus.h:452
#define NT_ASSERT
Definition: rtlfuncs.h:3312

◆ _IRQL_requires_max_() [3/3]

_IRQL_requires_max_ ( PASSIVE_LEVEL  )

Definition at line 64 of file Messaging.c.

75 {
76  PFLT_SERVER_PORT_OBJECT PortObject;
78 
79  /* The caller must allow at least one connection */
80  if (MaxConnections == 0)
81  {
83  }
84 
85  /* The request must be for a kernel handle */
86  if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
87  {
89  }
90 
91  /*
92  * Get rundown protection on the target to stop the owner
93  * from unloading whilst this port object is open. It gets
94  * removed in the FltpServerPortClose callback
95  */
97  if (!NT_SUCCESS(Status))
98  {
99  return Status;
100  }
101 
102  /* Create the server port object for this filter */
106  KernelMode,
107  NULL,
108  sizeof(FLT_SERVER_PORT_OBJECT),
109  0,
110  0,
111  (PVOID *)&PortObject);
112  if (NT_SUCCESS(Status))
113  {
114  /* Zero out the struct */
115  RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));
116 
117  /* Increment the ref count on the target filter */
119 
120  /* Setup the filter port object */
121  PortObject->Filter = Filter;
122  PortObject->ConnectNotify = ConnectNotifyCallback;
124  PortObject->MessageNotify = MessageNotifyCallback;
125  PortObject->Cookie = ServerPortCookie;
126  PortObject->MaxConnections = MaxConnections;
127 
128  /* Insert the object */
129  Status = ObInsertObject(PortObject,
130  NULL,
132  0,
133  NULL,
135  if (NT_SUCCESS(Status))
136  {
137  /* Lock the connection list */
139 
140  /* Add the new port object to the connection list and increment the count */
143 
144  /* Unlock the connection list*/
146  }
147  }
148 
149  if (!NT_SUCCESS(Status))
150  {
151  /* Allow the filter to be cleaned up */
153  }
154 
155  return Status;
156 }
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:35
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
_Must_inspect_result_ _Outptr_ PFLT_PORT * ServerPort
Definition: fltkernel.h:1873
PFLT_CONNECT_NOTIFY ConnectNotify
Definition: fltmgrint.h:191
VOID FLTAPI FltObjectDereference(_Inout_ PVOID Object)
Definition: Object.c:53
LONG NTSTATUS
Definition: precomp.h:26
#define InsertTailList(ListHead, Entry)
#define OBJ_KERNEL_HANDLE
Definition: winternl.h:231
VOID FASTCALL ExReleaseFastMutex(IN PFAST_MUTEX FastMutex)
Definition: fmutex.c:31
ULONG FltpObjectPointerReference(_In_ PFLT_OBJECT Object)
Definition: Object.c:322
LIST_ENTRY mList
Definition: fltmgrint.h:56
_Must_inspect_result_ _In_opt_ PFLT_FILTER Filter
Definition: fltkernel.h:1802
#define FILE_READ_DATA
Definition: nt_native.h:628
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
Definition: oblife.c:952
Status
Definition: gdiplustypes.h:24
POBJECT_TYPE ServerPortObjectType
Definition: Messaging.c:24
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY DisconnectNotifyCallback
Definition: fltkernel.h:1873
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:454
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY ConnectNotifyCallback
Definition: fltkernel.h:1873
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
Definition: obhandle.c:2931
#define STANDARD_RIGHTS_ALL
Definition: nt_native.h:69
VOID FASTCALL ExAcquireFastMutex(IN PFAST_MUTEX FastMutex)
Definition: fmutex.c:23
NTSTATUS FLTAPI FltObjectReference(_Inout_ PVOID Object)
Definition: Object.c:41
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID ServerPortCookie
Definition: fltkernel.h:1873
#define NULL
Definition: types.h:112
FAST_MUTEX mLock
Definition: fltmgrint.h:55
PFLT_MESSAGE_NOTIFY MessageNotify
Definition: fltmgrint.h:193
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY _In_ LONG MaxConnections
Definition: fltkernel.h:1873
PFLT_DISCONNECT_NOTIFY DisconnectNotify
Definition: fltmgrint.h:192
_Must_inspect_result_ _Outptr_ PFLT_PORT _In_ POBJECT_ATTRIBUTES _In_opt_ PVOID _In_ PFLT_CONNECT_NOTIFY _In_ PFLT_DISCONNECT_NOTIFY _In_opt_ PFLT_MESSAGE_NOTIFY MessageNotifyCallback
Definition: fltkernel.h:1873
FLT_MUTEX_LIST_HEAD ConnectionList
Definition: fltmgrint.h:121

◆ _When_()

◆ NtQueryInformationProcess()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess ( _In_ HANDLE  ProcessHandle,
_In_ PROCESSINFOCLASS  ProcessInformationClass,
_Out_ PVOID  ProcessInformation,
_In_ ULONG  ProcessInformationLength,
_Out_opt_ PULONG  ReturnLength 
)

Definition at line 59 of file query.c.

65 {
69  ULONG Length = 0;
70  HANDLE DebugPort = 0;
71  PPROCESS_BASIC_INFORMATION ProcessBasicInfo =
72  (PPROCESS_BASIC_INFORMATION)ProcessInformation;
73  PKERNEL_USER_TIMES ProcessTime = (PKERNEL_USER_TIMES)ProcessInformation;
74  ULONG UserTime, KernelTime;
75  PPROCESS_PRIORITY_CLASS PsPriorityClass = (PPROCESS_PRIORITY_CLASS)ProcessInformation;
76  ULONG HandleCount;
78  (PPROCESS_SESSION_INFORMATION)ProcessInformation;
79  PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation;
80  PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation;
81  PQUOTA_LIMITS QuotaLimits = (PQUOTA_LIMITS)ProcessInformation;
83  ULONG Cookie, ExecuteOptions = 0;
84  ULONG_PTR Wow64 = 0;
85  PROCESS_VALUES ProcessValues;
86  ULONG Flags;
87  PAGED_CODE();
88 
89  /* Check for user-mode caller */
90  if (PreviousMode != KernelMode)
91  {
92  /* Prepare to probe parameters */
93  _SEH2_TRY
94  {
95  /* Probe the buffer */
96  ProbeForRead(ProcessInformation,
97  ProcessInformationLength,
98  sizeof(ULONG));
99 
100  /* Probe the return length if required */
102  }
104  {
105  /* Return the exception code */
107  }
108  _SEH2_END;
109  }
110 
111  if (((ProcessInformationClass == ProcessCookie) ||
112  (ProcessInformationClass == ProcessImageInformation)) &&
114  {
115  /*
116  * Retrieving the process cookie is only allowed for the calling process
117  * itself! XP only allows NtCurrentProcess() as process handles even if
118  * a real handle actually represents the current process.
119  */
121  }
122 
123  /* Check the information class */
124  switch (ProcessInformationClass)
125  {
126  /* Basic process information */
128 
129  if (ProcessInformationLength != sizeof(PROCESS_BASIC_INFORMATION))
130  {
132  break;
133  }
134 
135  /* Set return length */
137 
138  /* Reference the process */
142  PreviousMode,
143  (PVOID*)&Process,
144  NULL);
145  if (!NT_SUCCESS(Status)) break;
146 
147  /* Protect writes with SEH */
148  _SEH2_TRY
149  {
150  /* Write all the information from the EPROCESS/KPROCESS */
151  ProcessBasicInfo->ExitStatus = Process->ExitStatus;
152  ProcessBasicInfo->PebBaseAddress = Process->Peb;
153  ProcessBasicInfo->AffinityMask = Process->Pcb.Affinity;
154  ProcessBasicInfo->UniqueProcessId = (ULONG_PTR)Process->
155  UniqueProcessId;
156  ProcessBasicInfo->InheritedFromUniqueProcessId =
157  (ULONG_PTR)Process->InheritedFromUniqueProcessId;
158  ProcessBasicInfo->BasePriority = Process->Pcb.BasePriority;
159 
160  }
162  {
163  /* Get exception code */
165  }
166  _SEH2_END;
167 
168  /* Dereference the process */
170  break;
171 
172  /* Process quota limits */
173  case ProcessQuotaLimits:
174 
175  if (ProcessInformationLength != sizeof(QUOTA_LIMITS))
176  {
178  break;
179  }
180 
181  Length = sizeof(QUOTA_LIMITS);
182 
183  /* Reference the process */
187  PreviousMode,
188  (PVOID*)&Process,
189  NULL);
190  if (!NT_SUCCESS(Status)) break;
191 
192  /* Indicate success */
194 
195  _SEH2_TRY
196  {
197  /* Set max/min working set sizes */
198  QuotaLimits->MaximumWorkingSetSize =
199  Process->Vm.MaximumWorkingSetSize << PAGE_SHIFT;
200  QuotaLimits->MinimumWorkingSetSize =
201  Process->Vm.MinimumWorkingSetSize << PAGE_SHIFT;
202 
203  /* Set default time limits */
204  QuotaLimits->TimeLimit.LowPart = MAXULONG;
205  QuotaLimits->TimeLimit.HighPart = MAXULONG;
206 
207  /* Is quota block a default one? */
208  if (Process->QuotaBlock == &PspDefaultQuotaBlock)
209  {
210  /* Set default pools and pagefile limits */
211  QuotaLimits->PagedPoolLimit = (SIZE_T)-1;
212  QuotaLimits->NonPagedPoolLimit = (SIZE_T)-1;
213  QuotaLimits->PagefileLimit = (SIZE_T)-1;
214  }
215  else
216  {
217  /* Get limits from non-default quota block */
218  QuotaLimits->PagedPoolLimit =
219  Process->QuotaBlock->QuotaEntry[PagedPool].Limit;
220  QuotaLimits->NonPagedPoolLimit =
221  Process->QuotaBlock->QuotaEntry[NonPagedPool].Limit;
222  QuotaLimits->PagefileLimit =
223  Process->QuotaBlock->QuotaEntry[2].Limit;
224  }
225  }
227  {
228  /* Get exception code */
230  }
231  _SEH2_END;
232 
233  /* Dereference the process */
235  break;
236 
237  case ProcessIoCounters:
238 
239  if (ProcessInformationLength != sizeof(IO_COUNTERS))
240  {
242  break;
243  }
244 
245  Length = sizeof(IO_COUNTERS);
246 
247  /* Reference the process */
251  PreviousMode,
252  (PVOID*)&Process,
253  NULL);
254  if (!NT_SUCCESS(Status)) break;
255 
256  /* Query IO counters from the process */
257  KeQueryValuesProcess(&Process->Pcb, &ProcessValues);
258 
259  _SEH2_TRY
260  {
261  RtlCopyMemory(IoCounters, &ProcessValues.IoInfo, sizeof(IO_COUNTERS));
262  }
264  {
265  /* Ignore exception */
266  }
267  _SEH2_END;
268 
269  /* Set status to success in any case */
271 
272  /* Dereference the process */
274  break;
275 
276  /* Timing */
277  case ProcessTimes:
278 
279  /* Set the return length */
280  if (ProcessInformationLength != sizeof(KERNEL_USER_TIMES))
281  {
283  break;
284  }
285 
286  Length = sizeof(KERNEL_USER_TIMES);
287 
288  /* Reference the process */
292  PreviousMode,
293  (PVOID*)&Process,
294  NULL);
295  if (!NT_SUCCESS(Status)) break;
296 
297  /* Protect writes with SEH */
298  _SEH2_TRY
299  {
300  /* Copy time information from EPROCESS/KPROCESS */
301  KernelTime = KeQueryRuntimeProcess(&Process->Pcb, &UserTime);
302  ProcessTime->CreateTime = Process->CreateTime;
304  ProcessTime->KernelTime.QuadPart = (LONGLONG)KernelTime * KeMaximumIncrement;
305  ProcessTime->ExitTime = Process->ExitTime;
306  }
308  {
309  /* Get exception code */
311  }
312  _SEH2_END;
313 
314  /* Dereference the process */
316  break;
317 
318  /* Process Debug Port */
319  case ProcessDebugPort:
320 
321  if (ProcessInformationLength != sizeof(HANDLE))
322  {
324  break;
325  }
326 
327  /* Set return length */
328  Length = sizeof(HANDLE);
329 
330  /* Reference the process */
334  PreviousMode,
335  (PVOID*)&Process,
336  NULL);
337  if (!NT_SUCCESS(Status)) break;
338 
339  /* Protect write with SEH */
340  _SEH2_TRY
341  {
342  /* Return whether or not we have a debug port */
343  *(PHANDLE)ProcessInformation = (Process->DebugPort ?
344  (HANDLE)-1 : NULL);
345  }
347  {
348  /* Get exception code */
350  }
351  _SEH2_END;
352 
353  /* Dereference the process */
355  break;
356 
357  case ProcessHandleCount:
358 
359  if (ProcessInformationLength != sizeof(ULONG))
360  {
362  break;
363  }
364 
365  /* Set the return length*/
366  Length = sizeof(ULONG);
367 
368  /* Reference the process */
372  PreviousMode,
373  (PVOID*)&Process,
374  NULL);
375  if (!NT_SUCCESS(Status)) break;
376 
377  /* Count the number of handles this process has */
378  HandleCount = ObGetProcessHandleCount(Process);
379 
380  /* Protect write in SEH */
381  _SEH2_TRY
382  {
383  /* Return the count of handles */
384  *(PULONG)ProcessInformation = HandleCount;
385  }
387  {
388  /* Get the exception code */
390  }
391  _SEH2_END;
392 
393  /* Dereference the process */
395  break;
396 
397  /* Session ID for the process */
399 
400  if (ProcessInformationLength != sizeof(PROCESS_SESSION_INFORMATION))
401  {
403  break;
404  }
405 
406  /* Set the return length*/
408 
409  /* Reference the process */
413  PreviousMode,
414  (PVOID*)&Process,
415  NULL);
416  if (!NT_SUCCESS(Status)) break;
417 
418  /* Enter SEH for write safety */
419  _SEH2_TRY
420  {
421  /* Write back the Session ID */
423  }
425  {
426  /* Get the exception code */
428  }
429  _SEH2_END;
430 
431  /* Dereference the process */
433  break;
434 
435  /* Virtual Memory Statistics */
436  case ProcessVmCounters:
437 
438  /* Validate the input length */
439  if ((ProcessInformationLength != sizeof(VM_COUNTERS)) &&
440  (ProcessInformationLength != sizeof(VM_COUNTERS_EX)))
441  {
443  break;
444  }
445 
446  /* Reference the process */
450  PreviousMode,
451  (PVOID*)&Process,
452  NULL);
453  if (!NT_SUCCESS(Status)) break;
454 
455  /* Enter SEH for write safety */
456  _SEH2_TRY
457  {
458  /* Return data from EPROCESS */
459  VmCounters->PeakVirtualSize = Process->PeakVirtualSize;
460  VmCounters->VirtualSize = Process->VirtualSize;
461  VmCounters->PageFaultCount = Process->Vm.PageFaultCount;
462  VmCounters->PeakWorkingSetSize = Process->Vm.PeakWorkingSetSize;
463  VmCounters->WorkingSetSize = Process->Vm.WorkingSetSize;
464  VmCounters->QuotaPeakPagedPoolUsage = Process->QuotaPeak[PsPagedPool];
465  VmCounters->QuotaPagedPoolUsage = Process->QuotaUsage[PsPagedPool];
466  VmCounters->QuotaPeakNonPagedPoolUsage = Process->QuotaPeak[PsNonPagedPool];
467  VmCounters->QuotaNonPagedPoolUsage = Process->QuotaUsage[PsNonPagedPool];
468  VmCounters->PagefileUsage = Process->QuotaUsage[PsPageFile] << PAGE_SHIFT;
469  VmCounters->PeakPagefileUsage = Process->QuotaPeak[PsPageFile] << PAGE_SHIFT;
470  //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
471  //
472 
473  /* Set the return length */
474  Length = ProcessInformationLength;
475  }
477  {
478  /* Get the exception code */
480  }
481  _SEH2_END;
482 
483  /* Dereference the process */
485  break;
486 
487  /* Hard Error Processing Mode */
489 
490  if (ProcessInformationLength != sizeof(ULONG))
491  {
493  break;
494  }
495 
496  /* Set the return length*/
497  Length = sizeof(ULONG);
498 
499  /* Reference the process */
503  PreviousMode,
504  (PVOID*)&Process,
505  NULL);
506  if (!NT_SUCCESS(Status)) break;
507 
508  /* Enter SEH for writing back data */
509  _SEH2_TRY
510  {
511  /* Write the current processing mode */
512  *(PULONG)ProcessInformation = Process->
513  DefaultHardErrorProcessing;
514  }
516  {
517  /* Get the exception code */
519  }
520  _SEH2_END;
521 
522  /* Dereference the process */
524  break;
525 
526  /* Priority Boosting status */
528 
529  if (ProcessInformationLength != sizeof(ULONG))
530  {
532  break;
533  }
534 
535  /* Set the return length */
536  Length = sizeof(ULONG);
537 
538  /* Reference the process */
542  PreviousMode,
543  (PVOID*)&Process,
544  NULL);
545  if (!NT_SUCCESS(Status)) break;
546 
547  /* Enter SEH for writing back data */
548  _SEH2_TRY
549  {
550  /* Return boost status */
551  *(PULONG)ProcessInformation = Process->Pcb.DisableBoost ?
552  TRUE : FALSE;
553  }
555  {
556  /* Get the exception code */
558  }
559  _SEH2_END;
560 
561  /* Dereference the process */
563  break;
564 
565  /* DOS Device Map */
566  case ProcessDeviceMap:
567 
568  if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX))
569  {
570  /* Protect read in SEH */
571  _SEH2_TRY
572  {
573  PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
574 
575  Flags = DeviceMapEx->Flags;
576  }
578  {
579  /* Get the exception code */
581  _SEH2_YIELD(break);
582  }
583  _SEH2_END;
584 
585  /* Only one flag is supported and it needs LUID mappings */
586  if ((Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 ||
588  {
590  break;
591  }
592  }
593  else
594  {
595  /* This has to be the size of the Query union field for x64 compatibility! */
596  if (ProcessInformationLength != RTL_FIELD_SIZE(PROCESS_DEVICEMAP_INFORMATION, Query))
597  {
599  break;
600  }
601 
602  /* No flags for standard call */
603  Flags = 0;
604  }
605 
606  /* Set the return length */
607  Length = ProcessInformationLength;
608 
609  /* Reference the process */
613  PreviousMode,
614  (PVOID*)&Process,
615  NULL);
616  if (!NT_SUCCESS(Status)) break;
617 
618  /* Query the device map information */
620  ProcessInformation,
621  Flags);
622 
623  /* Dereference the process */
625  break;
626 
627  /* Priority class */
629 
630  if (ProcessInformationLength != sizeof(PROCESS_PRIORITY_CLASS))
631  {
633  break;
634  }
635 
636  /* Set the return length*/
637  Length = sizeof(PROCESS_PRIORITY_CLASS);
638 
639  /* Reference the process */
643  PreviousMode,
644  (PVOID*)&Process,
645  NULL);
646  if (!NT_SUCCESS(Status)) break;
647 
648  /* Enter SEH for writing back data */
649  _SEH2_TRY
650  {
651  /* Return current priority class */
652  PsPriorityClass->PriorityClass = Process->PriorityClass;
653  PsPriorityClass->Foreground = FALSE;
654  }
656  {
657  /* Get the exception code */
659  }
660  _SEH2_END;
661 
662  /* Dereference the process */
664  break;
665 
667 
668  /* Reference the process */
672  PreviousMode,
673  (PVOID*)&Process,
674  NULL);
675  if (!NT_SUCCESS(Status)) break;
676 
677  /* Get the image path */
679  if (NT_SUCCESS(Status))
680  {
681  /* Set return length */
682  Length = ImageName->MaximumLength +
683  sizeof(OBJECT_NAME_INFORMATION);
684 
685  /* Make sure it's large enough */
686  if (Length <= ProcessInformationLength)
687  {
688  /* Enter SEH to protect write */
689  _SEH2_TRY
690  {
691  /* Copy it */
692  RtlCopyMemory(ProcessInformation,
693  ImageName,
694  Length);
695 
696  /* Update pointer */
697  ((PUNICODE_STRING)ProcessInformation)->Buffer =
698  (PWSTR)((PUNICODE_STRING)ProcessInformation + 1);
699  }
701  {
702  /* Get the exception code */
704  }
705  _SEH2_END;
706  }
707  else
708  {
709  /* Buffer too small */
711  }
712 
713  /* Free the image path */
715  }
716  /* Dereference the process */
718  break;
719 
720  case ProcessDebugFlags:
721 
722  if (ProcessInformationLength != sizeof(ULONG))
723  {
725  break;
726  }
727 
728  /* Set the return length*/
729  Length = sizeof(ULONG);
730 
731  /* Reference the process */
735  PreviousMode,
736  (PVOID*)&Process,
737  NULL);
738  if (!NT_SUCCESS(Status)) break;
739 
740  /* Enter SEH for writing back data */
741  _SEH2_TRY
742  {
743  /* Return the debug flag state */
744  *(PULONG)ProcessInformation = Process->NoDebugInherit ? 0 : 1;
745  }
747  {
748  /* Get the exception code */
750  }
751  _SEH2_END;
752 
753  /* Dereference the process */
755  break;
756 
758 
759  if (ProcessInformationLength != sizeof(ULONG))
760  {
762  break;
763  }
764 
765  /* Set the return length */
766  Length = sizeof(ULONG);
767 
768  /* Reference the process */
772  PreviousMode,
773  (PVOID*)&Process,
774  NULL);
775  if (!NT_SUCCESS(Status)) break;
776 
777  /* Enter SEH for writing back data */
778  _SEH2_TRY
779  {
780  /* Return the BreakOnTermination state */
781  *(PULONG)ProcessInformation = Process->BreakOnTermination;
782  }
784  {
785  /* Get the exception code */
787  }
788  _SEH2_END;
789 
790  /* Dereference the process */
792  break;
793 
794  /* Per-process security cookie */
795  case ProcessCookie:
796 
797  /* Get the current process and cookie */
799  Cookie = Process->Cookie;
800  if (!Cookie)
801  {
802  LARGE_INTEGER SystemTime;
803  ULONG NewCookie;
804  PKPRCB Prcb;
805 
806  /* Generate a new cookie */
807  KeQuerySystemTime(&SystemTime);
808  Prcb = KeGetCurrentPrcb();
809  NewCookie = Prcb->KeSystemCalls ^ Prcb->InterruptTime ^
810  SystemTime.u.LowPart ^ SystemTime.u.HighPart;
811 
812  /* Set the new cookie or return the current one */
814  NewCookie,
815  Cookie);
816  if (!Cookie) Cookie = NewCookie;
817 
818  /* Set return length */
819  Length = sizeof(ULONG);
820  }
821 
822  /* Indicate success */
824 
825  /* Enter SEH to protect write */
826  _SEH2_TRY
827  {
828  /* Write back the cookie */
829  *(PULONG)ProcessInformation = Cookie;
830  }
832  {
833  /* Get the exception code */
835  }
836  _SEH2_END;
837  break;
838 
840 
841  if (ProcessInformationLength != sizeof(SECTION_IMAGE_INFORMATION))
842  {
843  /* Break out */
845  break;
846  }
847 
848  /* Set the length required and validate it */
850 
851  /* Enter SEH to protect write */
852  _SEH2_TRY
853  {
855  }
857  {
858  /* Get the exception code */
860  }
861  _SEH2_END;
862 
863  /* Indicate success */
865  break;
866 
868 
869  if (ProcessInformationLength != sizeof(HANDLE))
870  {
872  break;
873  }
874 
875  /* Set the return length */
876  Length = sizeof(HANDLE);
877 
878  /* Reference the process */
882  PreviousMode,
883  (PVOID*)&Process,
884  NULL);
885  if (!NT_SUCCESS(Status)) break;
886 
887  /* Get the debug port */
889 
890  /* Let go of the process */
892 
893  /* Protect write in SEH */
894  _SEH2_TRY
895  {
896  /* Return debug port's handle */
897  *(PHANDLE)ProcessInformation = DebugPort;
898  }
900  {
901  /* Get the exception code */
903  }
904  _SEH2_END;
905  break;
906 
908  DPRINT1("Handle tracing Not implemented: %lx\n", ProcessInformationClass);
910  break;
911 
913 
914  if (ProcessInformationLength != sizeof(ULONG))
915  {
917  break;
918  }
919 
920  /* Set the return length */
921  Length = sizeof(ULONG);
922 
923  /* Indicate success */
925 
926  /* Protect write in SEH */
927  _SEH2_TRY
928  {
929  /* Query Ob */
930  *(PULONG)ProcessInformation = ObIsLUIDDeviceMapsEnabled();
931  }
933  {
934  /* Get the exception code */
936  }
937  _SEH2_END;
938  break;
939 
941 
942  if (ProcessInformationLength != sizeof(ULONG))
943  {
945  break;
946  }
947 
948  /* Set the return length */
949  Length = sizeof(ULONG);
950 
951  /* Reference the process */
955  PreviousMode,
956  (PVOID*)&Process,
957  NULL);
958  if (!NT_SUCCESS(Status)) break;
959 
960  /* Protect write in SEH */
961  _SEH2_TRY
962  {
963  /* Return if the flag is set */
964  *(PULONG)ProcessInformation = (ULONG)Process->VdmAllowed;
965  }
967  {
968  /* Get the exception code */
970  }
971  _SEH2_END;
972 
973  /* Dereference the process */
975  break;
976 
978 
979  if (ProcessInformationLength != sizeof(ULONG_PTR))
980  {
982  break;
983  }
984 
985  /* Set return length */
986  Length = sizeof(ULONG_PTR);
987 
988  /* Reference the process */
992  PreviousMode,
993  (PVOID*)&Process,
994  NULL);
995  if (!NT_SUCCESS(Status)) break;
996 
997  /* Make sure the process isn't dying */
998  if (ExAcquireRundownProtection(&Process->RundownProtect))
999  {
1000  /* Get the WOW64 process structure */
1001 #ifdef _WIN64
1002  Wow64 = (ULONG_PTR)Process->Wow64Process;
1003 #else
1004  Wow64 = 0;
1005 #endif
1006  /* Release the lock */
1007  ExReleaseRundownProtection(&Process->RundownProtect);
1008  }
1009 
1010  /* Protect write with SEH */
1011  _SEH2_TRY
1012  {
1013  /* Return whether or not we have a debug port */
1014  *(PULONG_PTR)ProcessInformation = Wow64;
1015  }
1017  {
1018  /* Get exception code */
1020  }
1021  _SEH2_END;
1022 
1023  /* Dereference the process */
1025  break;
1026 
1027  case ProcessExecuteFlags:
1028 
1029  if (ProcessInformationLength != sizeof(ULONG))
1030  {
1032  break;
1033  }
1034 
1035  /* Set return length */
1036  Length = sizeof(ULONG);
1037 
1039  {
1040  return STATUS_INVALID_PARAMETER;
1041  }
1042 
1043  /* Get the options */
1044  Status = MmGetExecuteOptions(&ExecuteOptions);
1045  if (NT_SUCCESS(Status))
1046  {
1047  /* Protect write with SEH */
1048  _SEH2_TRY
1049  {
1050  /* Return them */
1051  *(PULONG)ProcessInformation = ExecuteOptions;
1052  }
1054  {
1055  /* Get exception code */
1057  }
1058  _SEH2_END;
1059  }
1060  break;
1061 
1062  case ProcessLdtInformation:
1063  DPRINT1("VDM/16-bit not implemented: %lx\n", ProcessInformationClass);
1065  break;
1066 
1068  DPRINT1("WS Watch Not implemented: %lx\n", ProcessInformationClass);
1070  break;
1071 
1073  DPRINT1("Pool limits Not implemented: %lx\n", ProcessInformationClass);
1075  break;
1076 
1077  /* Not supported by Server 2003 */
1078  default:
1079  DPRINT1("Unsupported info class: %lx\n", ProcessInformationClass);
1081  }
1082 
1083  /* Protect write with SEH */
1084  _SEH2_TRY
1085  {
1086  /* Check if caller wanted return length */
1087  if ((ReturnLength) && (Length)) *ReturnLength = Length;
1088  }
1090  {
1091  /* Get exception code */
1093  }
1094  _SEH2_END;
1095 
1096  return Status;
1097 }
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
LARGE_INTEGER TimeLimit
Definition: lsa.idl:292
#define KeQuerySystemTime(t)
Definition: env_spec_w32.h:570
ULONG KeMaximumIncrement
Definition: clock.c:20
#define RTL_FIELD_SIZE(type, field)
Definition: kdb_expr.c:84
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
Definition: dumpinfo.c:39
SIZE_T PeakVirtualSize
Definition: winternl.h:1605
INT64 NonPagedPoolLimit
Definition: lsa.idl:288
#define PAGE_SHIFT
Definition: env_spec_w32.h:45
struct _VM_COUNTERS_ * PVM_COUNTERS
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
INT64 PagefileLimit
Definition: lsa.idl:291
#define STATUS_INFO_LENGTH_MISMATCH
Definition: udferr_usr.h:133
ULONG InterruptTime
Definition: ketypes.h:740
SIZE_T PeakPagefileUsage
Definition: winternl.h:1615
#define PROCESS_QUERY_INFORMATION
Definition: pstypes.h:166
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
Definition: devicemap.c:539
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
#define TRUE
Definition: types.h:120
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
uint16_t * PWSTR
Definition: typedefs.h:56
SIZE_T QuotaPagedPoolUsage
Definition: winternl.h:1611
NTSTATUS NTAPI SeLocateProcessImageName(IN PEPROCESS Process, OUT PUNICODE_STRING *ProcessImageName)
Definition: audit.c:122
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
LONG NTSTATUS
Definition: precomp.h:26
LARGE_INTEGER UserTime
Definition: winternl.h:1063
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
Definition: ketypes.h:1079
#define ExAcquireRundownProtection
Definition: ex.h:133
SIZE_T PagefileUsage
Definition: winternl.h:1614
SIZE_T QuotaPeakPagedPoolUsage
Definition: winternl.h:1610
#define InterlockedCompareExchange
Definition: interlocked.h:104
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
Definition: sysinfo.c:3066
SIZE_T VirtualSize
Definition: winternl.h:1606
IO_COUNTERS IoInfo
Definition: ke.h:48
_SEH2_TRY
Definition: create.c:4226
SIZE_T QuotaPeakNonPagedPoolUsage
Definition: winternl.h:1612
uint32_t ULONG_PTR
Definition: typedefs.h:65
LARGE_INTEGER ExitTime
Definition: winternl.h:1061
ULONG PageFaultCount
Definition: winternl.h:1607
struct _QUOTA_LIMITS QUOTA_LIMITS
return STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:494
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
Definition: section.c:1808
#define FALSE
Definition: types.h:117
long LONG
Definition: pedump.c:60
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
Definition: quota.c:17
INT64 PagedPoolLimit
Definition: lsa.idl:287
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
Definition: obhandle.c:58
struct _QUOTA_LIMITS * PQUOTA_LIMITS
#define PsGetCurrentProcess
Definition: psfuncs.h:17
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
Definition: pagfault.c:2531
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
SIZE_T QuotaNonPagedPoolUsage
Definition: winternl.h:1613
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
Definition: dbgkobj.c:1526
ULONG_PTR InheritedFromUniqueProcessId
Definition: pstypes.h:340
#define NtCurrentProcess()
Definition: nt_native.h:1657
_Out_ PULONG UserTime
Definition: kefuncs.h:771
Status
Definition: gdiplustypes.h:24
int64_t LONGLONG
Definition: typedefs.h:68
_In_ KPROCESSOR_MODE PreviousMode
Definition: sefuncs.h:103
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
Definition: procobj.c:522
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
LARGE_INTEGER CreateTime
Definition: winternl.h:1060
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
Definition: cmfuncs.h:13
#define ObDereferenceObject
Definition: obfuncs.h:203
PVOID HANDLE
Definition: typedefs.h:73
ULONG KeSystemCalls
Definition: ketypes.h:651
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
Definition: query.c:292
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
static const char * ImageName
Definition: image.c:34
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
#define STATUS_INVALID_INFO_CLASS
Definition: ntstatus.h:240
#define PROCESS_LUID_DOSDEVICES_ONLY
Definition: pstypes.h:228
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:454
ULONG LowPart
Definition: typedefs.h:106
INT64 MinimumWorkingSetSize
Definition: lsa.idl:289
#define MAXULONG
Definition: typedefs.h:251
ULONG_PTR SIZE_T
Definition: typedefs.h:80
SIZE_T WorkingSetSize
Definition: winternl.h:1609
_SEH2_END
Definition: create.c:4400
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
Definition: procobj.c:857
unsigned int * PULONG
Definition: retypes.h:1
#define NULL
Definition: types.h:112
INT64 MaximumWorkingSetSize
Definition: lsa.idl:290
UNICODE_STRING * PUNICODE_STRING
Definition: env_spec_w32.h:373
struct _IO_COUNTERS IO_COUNTERS
#define DPRINT1
Definition: precomp.h:8
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:219
unsigned int ULONG
Definition: retypes.h:1
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
Definition: process.c:1163
#define ULONG_PTR
Definition: config.h:101
uint32_t * PULONG_PTR
Definition: typedefs.h:65
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:40
#define TAG_SEPA
Definition: tag.h:191
#define STATUS_SUCCESS
Definition: shellext.h:65
SIZE_T PeakWorkingSetSize
Definition: winternl.h:1608
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1099
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:165
#define _SEH2_YIELD(__stmt)
Definition: pseh2_64.h:168
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _LARGE_INTEGER::@2269 u
_In_ HANDLE ProcessHandle
Definition: mmfuncs.h:403
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
Definition: devicemap.c:662
LARGE_INTEGER KernelTime
Definition: winternl.h:1062
POBJECT_TYPE PsProcessType
Definition: process.c:20
LONGLONG QuadPart
Definition: typedefs.h:114
#define PAGED_CODE()
struct _IO_COUNTERS * PIO_COUNTERS

Referenced by _main(), BaseInitializeStaticServerData(), check_live_target(), CheckRemoteDebuggerPresent(), CON_API_NOCONSOLE(), EmptyWorkingSet(), EnumProcessModules(), FindModule(), get_shiminfo(), GetDriveTypeW(), GetErrorMode(), GetExitCodeProcess(), GetLogicalDrives(), GetPriorityClass(), GetProcessAffinityMask(), GetProcessHandleCount(), GetProcessId(), GetProcessImageFileNameA(), GetProcessImageFileNameW(), GetProcessIoCounters(), GetProcessMemoryInfo(), GetProcessPriorityBoost(), GetProcessTimes(), GetProcessVersion(), GetProcessWorkingSetSizeEx(), GetSourcePaths(), GetWsChanges(), GlobalMemoryStatusEx(), InitFunctionPtrs(), Is64BitSystem(), IsCriticalProcess(), IsWow64Process(), PerfDataGetCommandLine(), PrintProcess(), ProcessIdToSessionId(), PsaEnumerateProcessModules(), QueryFlag(), QueryFullProcessImageNameW(), QuerySetProcessValidator(), RtlpQueryRemoteProcessModules(), SmpApiLoop(), SmpCreateVolumeDescriptors(), SmpGetProcessMuSessionId(), Test_ProcessPriorityClassAlignment(), Test_ProcessTimes(), Test_ProcessWx86Information(), UnhandledExceptionFilter(), UserpGetClientFileName(), and Wow64QueryFlag().

◆ PsGetCurrentProcessId()

◆ PsGetCurrentThreadTeb()

NTKERNELAPI PVOID NTAPI PsGetCurrentThreadTeb ( VOID  )

Definition at line 785 of file thread.c.

786 {
787  return PsGetCurrentThread()->Tcb.Teb;
788 }
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81

Referenced by FileOpenAddress().

◆ PsGetThreadProcess()

NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess ( _In_ PETHREAD  Thread)

◆ PsGetVersion()

NTKERNELAPI BOOLEAN NTAPI PsGetVersion ( OUT PULONG MajorVersion  OPTIONAL,
OUT PULONG MinorVersion  OPTIONAL,
OUT PULONG BuildNumber  OPTIONAL,
OUT PUNICODE_STRING CSDVersion  OPTIONAL 
)

Definition at line 658 of file psmgr.c.

662 {
665  if (BuildNumber ) *BuildNumber = NtBuildNumber & 0x3FFF;
666 
667  if (CSDVersion)
668  {
669  CSDVersion->Length = CmCSDVersionString.Length;
670  CSDVersion->MaximumLength = CmCSDVersionString.MaximumLength;
671  CSDVersion->Buffer = CmCSDVersionString.Buffer;
672  }
673 
674  /* Return TRUE if this is a Checked Build */
675  return (NtBuildNumber >> 28) == 0xC;
676 }
ULONG MinorVersion
Definition: ros_glue.cpp:5
ULONG MajorVersion
Definition: ros_glue.cpp:4
USHORT MaximumLength
Definition: env_spec_w32.h:370
ULONG NtMajorVersion
Definition: init.c:43
ULONG NtMinorVersion
Definition: init.c:44
ULONG NtBuildNumber
Definition: init.c:48
UNICODE_STRING CmCSDVersionString
Definition: init.c:60
ULONG BuildNumber
Definition: ros_glue.cpp:6

◆ PsIsCurrentThreadPrefetching()

NTKERNELAPI BOOLEAN NTAPI PsIsCurrentThreadPrefetching ( VOID  )

◆ PsIsSystemThread()

NTKERNELAPI BOOLEAN NTAPI PsIsSystemThread ( _In_ PETHREAD  Thread)

◆ PsRemoveCreateThreadNotifyRoutine()

NTKERNELAPI NTSTATUS NTAPI PsRemoveCreateThreadNotifyRoutine ( _In_ PCREATE_THREAD_NOTIFY_ROUTINE  NotifyRoutine)

◆ PsSetCreateProcessNotifyRoutineEx()

NTKERNELAPI NTSTATUS NTAPI PsSetCreateProcessNotifyRoutineEx ( IN PCREATE_PROCESS_NOTIFY_ROUTINE_EX  NotifyRoutine,
IN BOOLEAN  Remove 
)

◆ PsSetCurrentThreadPrefetching()

NTKERNELAPI BOOLEAN NTAPI PsSetCurrentThreadPrefetching ( IN BOOLEAN  Prefetching)

Variable Documentation

◆ Amount

Definition at line 211 of file psfuncs.h.

◆ ApcRoutine

_Inout_ PVOID* ApcRoutine

Definition at line 11 of file psfuncs.h.

◆ ClientId

◆ CopyOnOpen

◆ DesiredAccess

Definition at line 40 of file psfuncs.h.

◆ EffectiveOnly

Definition at line 154 of file psfuncs.h.

◆ ImpersonationLevel

◆ ImpersonationState

_In_ PSE_IMPERSONATION_STATE ImpersonationState

Definition at line 189 of file psfuncs.h.

Referenced by NtOpenThreadTokenEx(), PsDisableImpersonation(), and PsRestoreImpersonation().

◆ ObjectAttributes

Definition at line 40 of file psfuncs.h.

◆ PoolType

◆ Process

_Outptr_ PEPROCESS* Process

Definition at line 64 of file psfuncs.h.

◆ ProcessHandle

Definition at line 87 of file psfuncs.h.

◆ Remove

◆ StartRoutine

◆ Thread

Definition at line 73 of file psfuncs.h.

◆ Token

Definition at line 178 of file psfuncs.h.