65{
70
72
73
78 ProcessInformation,
79 ProcessInformationLength,
84 {
85 DPRINT1(
"NtQueryInformationProcess(): Information verification class failed! (Status -> 0x%lx, ProcessInformationClass -> %lx)\n",
Status, ProcessInformationClass);
87 }
88
92 {
93
94
95
96
97
99 }
100
101
102 switch (ProcessInformationClass)
103 {
104
106 {
108
110 {
112 break;
113 }
114
115
117
118
126
127
129 {
130
135 UniqueProcessId;
139
140 }
142 {
143
145 }
147
148
150 break;
151 }
152
153
155 {
158
161 {
163 break;
164 }
165
166
167 Length = ProcessInformationLength;
169
170
178
179
181
183
184
189
190
192
193
195 {
196
200 }
201 else
202 {
203
210 }
211
212
213 if (Extended)
214 {
215 QuotaLimits.
Flags |= (
Process->Vm.Flags.MaximumWorkingSetHard ?
217 QuotaLimits.
Flags |= (
Process->Vm.Flags.MinimumWorkingSetHard ?
219
220
221
223 }
224
225
227 {
229 }
231 {
232
234 }
236
237
239 break;
240 }
241
243 {
246
247 if (ProcessInformationLength !=
sizeof(
IO_COUNTERS))
248 {
250 break;
251 }
252
254
255
263
264
266
268 {
270 }
272 {
273
274 }
276
277
279
280
282 break;
283 }
284
285
287 {
290
291
293 {
295 break;
296 }
297
299
300
308
309
311 {
312
318 }
320 {
321
323 }
325
326
328 break;
329 }
330
331
333
334 if (ProcessInformationLength !=
sizeof(
HANDLE))
335 {
337 break;
338 }
339
340
342
343
351
352
354 {
355
358 }
360 {
361
363 }
365
366
368 break;
369
371 {
373
374 if (ProcessInformationLength !=
sizeof(
ULONG))
375 {
377 break;
378 }
379
380
382
383
391
392
394
395
397 {
398
399 *(
PULONG)ProcessInformation = HandleCount;
400 }
402 {
403
405 }
407
408
410 break;
411 }
412
413
415 {
417
419 {
421 break;
422 }
423
424
426
427
435
436
438 {
439
441 }
443 {
444
446 }
448
449
451 break;
452 }
453
454
456 {
458
459
460 if ((ProcessInformationLength !=
sizeof(
VM_COUNTERS)) &&
462 {
464 break;
465 }
466
467
475
476
478 {
479
491
492
493
494
495 Length = ProcessInformationLength;
496 }
498 {
499
501 }
503
504
506 break;
507 }
508
509
511
512 if (ProcessInformationLength !=
sizeof(
ULONG))
513 {
515 break;
516 }
517
518
520
521
529
530
532 {
533
535 DefaultHardErrorProcessing;
536 }
538 {
539
541 }
543
544
546 break;
547
548
550
551 if (ProcessInformationLength !=
sizeof(
ULONG))
552 {
554 break;
555 }
556
557
559
560
568
569
571 {
572
575 }
577 {
578
580 }
582
583
585 break;
586
587
589 {
591
593 {
594
596 {
598
600 }
602 {
603
606 }
608
609
612 {
614 break;
615 }
616 }
617 else
618 {
619
621 {
623 break;
624 }
625
626
628 }
629
630
631 Length = ProcessInformationLength;
632
633
641
642
644 ProcessInformation,
646
647
649 break;
650 }
651
652
654 {
656
658 {
660 break;
661 }
662
663
665
666
674
675
677 {
678
681 }
683 {
684
686 }
688
689
691 break;
692 }
693
695 {
697
698
706
707
710 {
711
714
715
716 if (
Length <= ProcessInformationLength)
717 {
718
720 {
721
725
726
729 }
731 {
732
734 }
736 }
737 else
738 {
739
741 }
742
743
745 }
746
748 break;
749 }
750
751#if (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
753 {
756
757
765 {
766 break;
767 }
768
769
773 {
774 break;
775 }
779 {
780 break;
781 }
782
783
785 if (
Length <= ProcessInformationLength)
786 {
788 {
793 {
798 }
799 else
800 {
803 }
804 }
806 {
808 }
810 }
811 else
812 {
814 }
816
817 break;
818 }
819#endif
820
822
823 if (ProcessInformationLength !=
sizeof(
ULONG))
824 {
826 break;
827 }
828
829
831
832
840
841
843 {
844
845 *(
PULONG)ProcessInformation =
Process->NoDebugInherit ? 0 : 1;
846 }
848 {
849
851 }
853
854
856 break;
857
859
860 if (ProcessInformationLength !=
sizeof(
ULONG))
861 {
863 break;
864 }
865
866
868
869
877
878
880 {
881
883 }
885 {
886
888 }
890
891
893 break;
894
895
897 {
899
900 if (ProcessInformationLength !=
sizeof(
ULONG))
901 {
902
904 break;
905 }
906
907
911 {
915
916
920 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart;
921
922
924 NewCookie,
927
928
930 }
931
932
934
935
937 {
938
940 }
942 {
943
945 }
947 break;
948 }
949
951
953 {
954
956 break;
957 }
958
959
961
962
964
965
967 {
969 }
971 {
972
974 }
976 break;
977
979 {
981
982 if (ProcessInformationLength !=
sizeof(
HANDLE))
983 {
985 break;
986 }
987
988
990
991
999
1000
1002
1003
1005
1006
1008 {
1009
1010 *(
PHANDLE)ProcessInformation = DebugPort;
1011 }
1013 {
1014 if (DebugPort)
1016
1017
1018
1020 }
1022 break;
1023 }
1024
1026 DPRINT1(
"Handle tracing Not implemented: %lx\n", ProcessInformationClass);
1028 break;
1029
1031
1032 if (ProcessInformationLength !=
sizeof(
ULONG))
1033 {
1035 break;
1036 }
1037
1038
1040
1041
1043
1044
1046 {
1047
1049 }
1051 {
1052
1054 }
1056 break;
1057
1059
1060 if (ProcessInformationLength !=
sizeof(
ULONG))
1061 {
1063 break;
1064 }
1065
1066
1068
1069
1077
1078
1080 {
1081
1083 }
1085 {
1086
1088 }
1090
1091
1093 break;
1094
1096 {
1098
1099 if (ProcessInformationLength !=
sizeof(
ULONG_PTR))
1100 {
1102 break;
1103 }
1104
1105
1107
1108
1116
1117#ifdef _WIN64
1118
1120 {
1121
1123
1125 }
1126#endif
1127
1128
1130
1131
1133 {
1134
1136 }
1138 {
1139
1141 }
1143 break;
1144 }
1145
1147 {
1148 ULONG ExecuteOptions = 0;
1149
1150 if (ProcessInformationLength !=
sizeof(
ULONG))
1151 {
1153 break;
1154 }
1155
1156
1158
1160 {
1162 break;
1163 }
1164
1165
1168 {
1169
1171 {
1172
1173 *(
PULONG)ProcessInformation = ExecuteOptions;
1174 }
1176 {
1177
1179 }
1181 }
1182 break;
1183 }
1184
1186 DPRINT1(
"VDM/16-bit not implemented: %lx\n", ProcessInformationClass);
1188 break;
1189
1191 DPRINT1(
"WS Watch Not implemented: %lx\n", ProcessInformationClass);
1193 break;
1194
1196 DPRINT1(
"Pool limits Not implemented: %lx\n", ProcessInformationClass);
1198 break;
1199
1200
1201 default:
1202 DPRINT1(
"Unsupported info class: %lx\n", ProcessInformationClass);
1204 }
1205
1206
1208 {
1209
1211 {
1213 }
1215 {
1216
1217
1219 }
1221 }
1222
1224}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
@ ProcessBreakOnTermination
@ ProcessBasicInformation
@ ProcessWow64Information
#define STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
UNICODE_STRING * PUNICODE_STRING
#define KeQuerySystemTime(t)
struct _UNICODE_STRING UNICODE_STRING
#define ExReleaseRundownProtection
#define ExGetPreviousMode
#define ExAcquireRundownProtection
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
#define PROCESS_QUERY_INFORMATION
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
@ ProcessLUIDDeviceMapsEnabled
@ ProcessSessionInformation
@ ProcessImageInformation
@ ProcessPooledUsageAndLimits
@ ProcessImageFileNameWin32
@ ProcessDefaultHardErrorMode
@ ProcessDebugObjectHandle
struct _VM_COUNTERS * PVM_COUNTERS
struct _VM_COUNTERS_EX VM_COUNTERS_EX
#define EXCEPTION_EXECUTE_HANDLER
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
#define PROCESS_LUID_DOSDEVICES_ONLY
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
struct _IO_COUNTERS * PIO_COUNTERS
#define InterlockedCompareExchange
#define RTL_FIELD_SIZE(type, field)
#define ExFreePoolWithTag(_P, _T)
static const char * ImageName
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
_In_ HANDLE ProcessHandle
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
#define NtCurrentProcess()
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
_In_ ULONG _In_ ULONG _In_ ULONG Length
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
NTSTATUS NTAPI IoQueryFileDosDeviceName(IN PFILE_OBJECT FileObject, OUT POBJECT_NAME_INFORMATION *ObjectNameInformation)
POBJECT_TYPE PsProcessType
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
NTSTATUS NTAPI PsReferenceProcessFilePointer(IN PEPROCESS Process, OUT PFILE_OBJECT *FileObject)
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
#define STATUS_INVALID_INFO_CLASS
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
static const INFORMATION_CLASS_INFO PsProcessInfoClass[]
#define _SEH2_YIELD(__stmt)
SIZE_T MaximumWorkingSetSize
RATE_QUOTA_LIMIT CpuRateLimit
SIZE_T MinimumWorkingSetSize
SIZE_T PeakWorkingSetSize
SIZE_T QuotaPagedPoolUsage
SIZE_T QuotaPeakPagedPoolUsage
SIZE_T QuotaPeakNonPagedPoolUsage
SIZE_T QuotaNonPagedPoolUsage
#define RtlCopyMemory(Destination, Source, Length)
#define STATUS_INFO_LENGTH_MISMATCH
struct _LARGE_INTEGER::@2474 u
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define ObDereferenceObject
#define PsGetCurrentProcess