17 #define PsGetCurrentProcess IoGetCurrentProcess 19 #if !defined(_PSGETCURRENTTHREAD_) 20 #define _PSGETCURRENTTHREAD_ 76 #if (NTDDI_VERSION >= NTDDI_WIN2K) 240 #if (NTDDI_VERSION >= NTDDI_WINXP) 322 #if (NTDDI_VERSION >= NTDDI_WS03) 330 #if (NTDDI_VERSION >= NTDDI_WS03SP1) 338 #if (NTDDI_VERSION >= NTDDI_VISTA) 353 #if (NTDDI_VERSION >= NTDDI_VISTASP1) _In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE _In_opt_ _When_(return==0, __drv_aliasesMem) PVOID StartContext)
enum _SECURITY_IMPERSONATION_LEVEL * PSECURITY_IMPERSONATION_LEVEL
NTSTATUS NTAPI PsImpersonateClient(IN PETHREAD Thread, IN PACCESS_TOKEN Token, IN BOOLEAN CopyOnOpen, IN BOOLEAN EffectiveOnly, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
NTKERNELAPI NTSTATUS NTAPI PsChargeProcessPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the process' quota pool. The type of quota to be charged depends upon the PoolType parameter.
NTKERNELAPI HANDLE NTAPI PsGetCurrentProcessId(VOID)
_Inout_ PSE_IMPERSONATION_STATE ImpersonationState
_Outptr_ PEPROCESS * Process
#define PsGetCurrentThread()
LARGE_INTEGER NTAPI PsGetProcessExitTime(VOID)
VOID(NTAPI * PCREATE_THREAD_NOTIFY_ROUTINE)(_In_ HANDLE ProcessId, _In_ HANDLE ThreadId, _In_ BOOLEAN Create)
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE StartRoutine
NTKERNELAPI VOID NTAPI PsRevertToSelf(VOID)
NTSTATUS NTAPI PsLookupThreadByThreadId(IN HANDLE ThreadId, OUT PETHREAD *Thread)
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PBOOLEAN CopyOnOpen
NTSTATUS NTAPI PsRemoveLoadImageNotifyRoutine(IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine)
NTKERNELAPI BOOLEAN NTAPI PsIsSystemThread(_In_ PETHREAD Thread)
$endif(_WDMDDK_) $if(_NTDDK_) __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess(_Out_ PHANDLE ProcessHandle
NTKERNELAPI BOOLEAN NTAPI PsGetVersion(OUT PULONG MajorVersion OPTIONAL, OUT PULONG MinorVersion OPTIONAL, OUT PULONG BuildNumber OPTIONAL, OUT PUNICODE_STRING CSDVersion OPTIONAL)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
_Must_inspect_result_ _Outptr_ PETHREAD * Thread
NTKERNELAPI NTSTATUS NTAPI PsSetCreateProcessNotifyRoutineEx(IN PCREATE_PROCESS_NOTIFY_ROUTINE_EX NotifyRoutine, IN BOOLEAN Remove)
enum _PROCESSINFOCLASS PROCESSINFOCLASS
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
NTKERNELAPI PEPROCESS NTAPI PsGetThreadProcess(_In_ PETHREAD Thread)
KSTART_ROUTINE * PKSTART_ROUTINE
VOID(NTAPI * PLOAD_IMAGE_NOTIFY_ROUTINE)(_In_ PUNICODE_STRING FullImageName, _In_ HANDLE ProcessId, _In_ PIMAGE_INFO ImageInfo)
enum _SECURITY_IMPERSONATION_LEVEL SECURITY_IMPERSONATION_LEVEL
VOID NTAPI PsRestoreImpersonation(IN PETHREAD Thread, IN PSE_IMPERSONATION_STATE ImpersonationState)
VOID(NTAPI * PCREATE_PROCESS_NOTIFY_ROUTINE_EX)(_Inout_ PEPROCESS Process, _In_ HANDLE ProcessId, _Inout_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo)
_Must_inspect_result_ _In_opt_ PACCESS_TOKEN Token
BOOLEAN NTAPI PsDisableImpersonation(IN PETHREAD Thread, OUT PSE_IMPERSONATION_STATE ImpersonationState)
#define _Post_satisfies_(cond)
NTKERNELAPI BOOLEAN NTAPI PsIsCurrentThreadPrefetching(VOID)
HANDLE NTAPI PsGetThreadProcessId(IN PETHREAD Thread)
NTSTATUS NTAPI PsSetLoadImageNotifyRoutine(IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine)
_Out_ PBOOLEAN _Out_ PBOOLEAN _Out_ PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel
VOID(NTAPI * PCREATE_PROCESS_NOTIFY_ROUTINE)(_In_ HANDLE ParentId, _In_ HANDLE ProcessId, _In_ BOOLEAN Create)
NTSTATUS NTAPI PsSetCreateThreadNotifyRoutine(IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId)
NTKERNELAPI BOOLEAN NTAPI PsSetCurrentThreadPrefetching(IN BOOLEAN Prefetching)
_In_ POOL_TYPE _In_ ULONG_PTR Amount
NTSTATUS NTAPI PsLookupProcessByProcessId(IN HANDLE ProcessId, OUT PEPROCESS *Process)
NTKERNELAPI PVOID NTAPI PsGetCurrentThreadTeb(VOID)
NTSTATUS NTAPI PsAssignImpersonationToken(IN PETHREAD Thread, IN HANDLE TokenHandle)
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
#define _Must_inspect_result_
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE ProcessHandle
NTKERNELAPI NTSTATUS NTAPI PsRemoveCreateThreadNotifyRoutine(_In_ PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine)
PACCESS_TOKEN NTAPI PsReferenceImpersonationToken(IN PETHREAD Thread, OUT PBOOLEAN CopyOnOpen, OUT PBOOLEAN EffectiveOnly, OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
LONGLONG NTAPI PsGetProcessCreateTimeQuadPart(PEPROCESS Process)
_Out_ PBOOLEAN _Out_ PBOOLEAN EffectiveOnly
NTSTATUS NTAPI PsTerminateSystemThread(IN NTSTATUS ExitStatus)
NTSTATUS NTAPI PsCreateSystemThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, IN PCLIENT_ID ClientId, IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
NTSTATUS NTAPI PsWrapApcWow64Thread(IN OUT PVOID *ApcContext, IN OUT PVOID *ApcRoutine)
VOID NTAPI PsDereferencePrimaryToken(IN PACCESS_TOKEN PrimaryToken)
NTKERNELAPI HANDLE NTAPI PsGetThreadId(_In_ PETHREAD Thread)
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ _Strict_type_match_ POOL_TYPE PoolType
NTKERNELAPI VOID NTAPI PsReturnPoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Returns the pool quota that the process was taking up.
HANDLE NTAPI PsGetProcessId(PEPROCESS Process)
#define KeGetCurrentThread
BOOLEAN NTAPI PsIsThreadTerminating(IN PETHREAD Thread)
$if(_WDMDDK_) NTKERNELAPI NTSTATUS NTAPI PsWrapApcWow64Thread(_Inout_ PVOID *ApcContext
_IRQL_requires_max_(PASSIVE_LEVEL) NTSYSAPI NTSTATUS NTAPI ZwOpenProcessTokenEx(_In_ HANDLE ProcessHandle
Queries information details about a security descriptor.
NTSTATUS NTAPI PsSetCreateProcessNotifyRoutine(IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine, IN BOOLEAN Remove)
_Inout_ PVOID * ApcRoutine
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _In_opt_ PCLIENT_ID ClientId
NTKERNELAPI VOID NTAPI PsChargePoolQuota(_In_ PEPROCESS Process, _In_ POOL_TYPE PoolType, _In_ SIZE_T Amount)
Charges the pool quota of a given process. The kind of pool quota to charge is determined by the Pool...
PULONG MinorVersion OPTIONAL
VOID NTAPI PsDereferenceImpersonationToken(IN PACCESS_TOKEN ImpersonationToken)
1.8.15