#include <ntoskrnl.h>#include <debug.h>
Include dependency graph for query.c:
Go to the source code of this file.
Macros | |
| #define | NDEBUG |
Variables | |
| ULONG | PspTraceLevel = 0 |
Macro Definition Documentation
◆ NDEBUG
Function Documentation
◆ NtQueryInformationProcess()
| NTSTATUS NTAPI NtQueryInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Definition at line 211 of file query.c.
218{
223
224 PAGED_CODE();
225
226 /* Validate the information class */
228 PsProcessInfoClass,
230 ICIF_PROBE_READ,
231 ProcessInformation,
232 ProcessInformationLength,
233 ReturnLength,
234 NULL,
235 PreviousMode);
237 {
238#if DBG
239 DPRINT1("NtQueryInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
240 PspDumpProcessInfoClassName(ProcessInformationClass), Status);
241#endif
243 }
244
246 (ProcessInformationClass == ProcessImageInformation)) &&
248 {
249 /*
250 * Retrieving the process cookie is only allowed for the calling process
251 * itself! XP only allows NtCurrentProcess() as process handles even if
252 * a real handle actually represents the current process.
253 */
255 }
256
257 /* Check the information class */
258 switch (ProcessInformationClass)
259 {
260 /* Basic process information */
262 {
264
266 {
268 break;
269 }
270
271 /* Set the return length */
273
274 /* Reference the process */
277 PsProcessType,
278 PreviousMode,
280 NULL);
282
283 /* Protect writes with SEH */
284 _SEH2_TRY
285 {
286 /* Write all the information from the EPROCESS/KPROCESS */
291 UniqueProcessId;
292 ProcessBasicInfo->InheritedFromUniqueProcessId =
295
296 }
298 {
299 /* Get exception code */
301 }
302 _SEH2_END;
303
304 /* Dereference the process */
306 break;
307 }
308
309 /* Process quota limits */
311 {
312 QUOTA_LIMITS_EX QuotaLimits;
313 BOOLEAN Extended;
314
317 {
319 break;
320 }
321
322 /* Set the return length */
323 Length = ProcessInformationLength;
325
326 /* Reference the process */
329 PsProcessType,
330 PreviousMode,
332 NULL);
334
335 /* Indicate success */
337
339
340 /* Get max/min working set sizes */
341 QuotaLimits.MaximumWorkingSetSize =
343 QuotaLimits.MinimumWorkingSetSize =
345
346 /* Get default time limits */
348
349 /* Is quota block a default one? */
351 {
352 /* Get default pools and pagefile limits */
356 }
357 else
358 {
359 /* Get limits from non-default quota block */
360 QuotaLimits.PagedPoolLimit =
362 QuotaLimits.NonPagedPoolLimit =
364 QuotaLimits.PagefileLimit =
366 }
367
368 /* Get additional information, if needed */
369 if (Extended)
370 {
375
376 /* FIXME: Get the correct information */
377 //QuotaLimits.WorkingSetLimit = (SIZE_T)-1; // Not used on Win2k3, it is set to 0
379 }
380
381 /* Protect writes with SEH */
382 _SEH2_TRY
383 {
385 }
387 {
388 /* Get exception code */
390 }
391 _SEH2_END;
392
393 /* Dereference the process */
395 break;
396 }
397
399 {
401 PROCESS_VALUES ProcessValues;
402
404 {
406 break;
407 }
408
410
411 /* Reference the process */
414 PsProcessType,
415 PreviousMode,
417 NULL);
419
420 /* Query IO counters from the process */
422
423 _SEH2_TRY
424 {
426 }
428 {
429 /* Ignore exception */
430 }
431 _SEH2_END;
432
433 /* Set status to success in any case */
435
436 /* Dereference the process */
438 break;
439 }
440
441 /* Timing */
443 {
446
447 /* Set the return length */
449 {
451 break;
452 }
453
455
456 /* Reference the process */
459 PsProcessType,
460 PreviousMode,
462 NULL);
464
465 /* Protect writes with SEH */
466 _SEH2_TRY
467 {
468 /* Copy time information from EPROCESS/KPROCESS */
474 }
476 {
477 /* Get exception code */
479 }
480 _SEH2_END;
481
482 /* Dereference the process */
484 break;
485 }
486
487 /* Process Debug Port */
489
491 {
493 break;
494 }
495
496 /* Set the return length */
498
499 /* Reference the process */
502 PsProcessType,
503 PreviousMode,
505 NULL);
507
508 /* Protect write with SEH */
509 _SEH2_TRY
510 {
511 /* Return whether or not we have a debug port */
514 }
516 {
517 /* Get exception code */
519 }
520 _SEH2_END;
521
522 /* Dereference the process */
524 break;
525
527 {
529
531 {
533 break;
534 }
535
536 /* Set the return length*/
538
539 /* Reference the process */
542 PsProcessType,
543 PreviousMode,
545 NULL);
547
548 /* Count the number of handles this process has */
550
551 /* Protect write in SEH */
552 _SEH2_TRY
553 {
554 /* Return the count of handles */
556 }
558 {
559 /* Get the exception code */
561 }
562 _SEH2_END;
563
564 /* Dereference the process */
566 break;
567 }
568
569 /* Session ID for the process */
571 {
573
575 {
577 break;
578 }
579
580 /* Set the return length*/
582
583 /* Reference the process */
586 PsProcessType,
587 PreviousMode,
589 NULL);
591
592 /* Enter SEH for write safety */
593 _SEH2_TRY
594 {
595 /* Write back the Session ID */
597 }
599 {
600 /* Get the exception code */
602 }
603 _SEH2_END;
604
605 /* Dereference the process */
607 break;
608 }
609
610 /* Virtual Memory Statistics */
612 {
614
615 /* Validate the input length */
618 {
620 break;
621 }
622
623 /* Reference the process */
626 PsProcessType,
627 PreviousMode,
629 NULL);
631
632 /* Enter SEH for write safety */
633 _SEH2_TRY
634 {
635 /* Return data from EPROCESS */
647 //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
648 //
649
650 /* Set the return length */
651 Length = ProcessInformationLength;
652 }
654 {
655 /* Get the exception code */
657 }
658 _SEH2_END;
659
660 /* Dereference the process */
662 break;
663 }
664
665 /* Hard Error Processing Mode */
667
669 {
671 break;
672 }
673
674 /* Set the return length*/
676
677 /* Reference the process */
680 PsProcessType,
681 PreviousMode,
683 NULL);
685
686 /* Enter SEH for writing back data */
687 _SEH2_TRY
688 {
689 /* Write the current processing mode */
691 DefaultHardErrorProcessing;
692 }
694 {
695 /* Get the exception code */
697 }
698 _SEH2_END;
699
700 /* Dereference the process */
702 break;
703
704 /* Priority Boosting status */
706
708 {
710 break;
711 }
712
713 /* Set the return length */
715
716 /* Reference the process */
719 PsProcessType,
720 PreviousMode,
722 NULL);
724
725 /* Enter SEH for writing back data */
726 _SEH2_TRY
727 {
728 /* Return boost status */
731 }
733 {
734 /* Get the exception code */
736 }
737 _SEH2_END;
738
739 /* Dereference the process */
741 break;
742
743 /* DOS Device Map */
745 {
747
749 {
750 /* Protect read in SEH */
751 _SEH2_TRY
752 {
753 PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
754
756 }
758 {
759 /* Get the exception code */
762 }
763 _SEH2_END;
764
765 /* Only one flag is supported and it needs LUID mappings */
767 !ObIsLUIDDeviceMapsEnabled())
768 {
770 break;
771 }
772 }
773 else
774 {
775 /* This has to be the size of the Query union field for x64 compatibility! */
777 {
779 break;
780 }
781
782 /* No flags for standard call */
783 Flags = 0;
784 }
785
786 /* Set the return length */
787 Length = ProcessInformationLength;
788
789 /* Reference the process */
792 PsProcessType,
793 PreviousMode,
795 NULL);
797
798 /* Query the device map information */
800 ProcessInformation,
801 Flags);
802
803 /* Dereference the process */
805 break;
806 }
807
808 /* Priority class */
810 {
812
814 {
816 break;
817 }
818
819 /* Set the return length*/
821
822 /* Reference the process */
825 PsProcessType,
826 PreviousMode,
828 NULL);
830
831 /* Enter SEH for writing back data */
832 _SEH2_TRY
833 {
834 /* Return current priority class */
837 }
839 {
840 /* Get the exception code */
842 }
843 _SEH2_END;
844
845 /* Dereference the process */
847 break;
848 }
849
851 {
853
854 /* Reference the process */
857 PsProcessType,
858 PreviousMode,
860 NULL);
862
863 /* Get the image path */
866 {
867 /* Set the return length */
870
871 /* Make sure it's large enough */
873 {
874 /* Enter SEH to protect write */
875 _SEH2_TRY
876 {
877 /* Copy it */
878 RtlCopyMemory(ProcessInformation,
879 ImageName,
880 Length);
881
882 /* Update pointer */
883 ((PUNICODE_STRING)ProcessInformation)->Buffer =
885 }
887 {
888 /* Get the exception code */
890 }
891 _SEH2_END;
892 }
893 else
894 {
895 /* Buffer too small */
897 }
898
899 /* Free the image path */
901 }
902 /* Dereference the process */
904 break;
905 }
906
907#if (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
909 {
912
913 /* Reference the process */
915 // FIXME: Use PROCESS_QUERY_LIMITED_INFORMATION when implemented
917 PsProcessType,
918 PreviousMode,
920 NULL);
922 {
923 break;
924 }
925
926 /* Get the image path */
930 {
931 break;
932 }
936 {
937 break;
938 }
939
940 /* Determine return length and output */
943 {
944 _SEH2_TRY
945 {
950 {
953 ObjectNameInformation->Name.Buffer,
954 ObjectNameInformation->Name.MaximumLength);
955 }
956 else
957 {
960 }
961 }
963 {
965 }
966 _SEH2_END;
967 }
968 else
969 {
971 }
973
974 break;
975 }
976#endif /* (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA) */
977
979
981 {
983 break;
984 }
985
986 /* Set the return length*/
988
989 /* Reference the process */
992 PsProcessType,
993 PreviousMode,
995 NULL);
997
998 /* Enter SEH for writing back data */
999 _SEH2_TRY
1000 {
1001 /* Return the debug flag state */
1003 }
1005 {
1006 /* Get the exception code */
1008 }
1009 _SEH2_END;
1010
1011 /* Dereference the process */
1013 break;
1014
1016
1018 {
1020 break;
1021 }
1022
1023 /* Set the return length */
1025
1026 /* Reference the process */
1029 PsProcessType,
1030 PreviousMode,
1032 NULL);
1034
1035 /* Enter SEH for writing back data */
1036 _SEH2_TRY
1037 {
1038 /* Return the BreakOnTermination state */
1040 }
1042 {
1043 /* Get the exception code */
1045 }
1046 _SEH2_END;
1047
1048 /* Dereference the process */
1050 break;
1051
1052 /* Per-process security cookie */
1054 {
1056
1058 {
1059 /* Length size wrong, bail out */
1061 break;
1062 }
1063
1064 /* Get the current process and cookie */
1068 {
1069 LARGE_INTEGER SystemTime;
1070 ULONG NewCookie;
1071 PKPRCB Prcb;
1072
1073 /* Generate a new cookie */
1074 KeQuerySystemTime(&SystemTime);
1075 Prcb = KeGetCurrentPrcb();
1078
1079 /* Set the new cookie or return the current one */
1081 NewCookie,
1082 Cookie);
1084
1085 /* Set the return length */
1087 }
1088
1089 /* Indicate success */
1091
1092 /* Enter SEH to protect write */
1093 _SEH2_TRY
1094 {
1095 /* Write back the cookie */
1097 }
1099 {
1100 /* Get the exception code */
1102 }
1103 _SEH2_END;
1104 break;
1105 }
1106
1108
1110 {
1111 /* Break out */
1113 break;
1114 }
1115
1116 /* Set the length required and validate it */
1118
1119 /* Indicate success */
1121
1122 /* Enter SEH to protect write */
1123 _SEH2_TRY
1124 {
1126 }
1128 {
1129 /* Get the exception code */
1131 }
1132 _SEH2_END;
1133 break;
1134
1136 {
1138
1140 {
1142 break;
1143 }
1144
1145 /* Set the return length */
1147
1148 /* Reference the process */
1151 PsProcessType,
1152 PreviousMode,
1154 NULL);
1156
1157 /* Get the debug port. Continue even if this fails. */
1159
1160 /* Let go of the process */
1162
1163 /* Protect write in SEH */
1164 _SEH2_TRY
1165 {
1166 /* Return debug port's handle */
1167 *(PHANDLE)ProcessInformation = DebugPort;
1168 }
1170 {
1171 if (DebugPort)
1173
1174 /* Get the exception code.
1175 * Note: This overwrites any previous failure status. */
1177 }
1178 _SEH2_END;
1179 break;
1180 }
1181
1185 break;
1186
1188
1190 {
1192 break;
1193 }
1194
1195 /* Set the return length */
1197
1198 /* Indicate success */
1200
1201 /* Protect write in SEH */
1202 _SEH2_TRY
1203 {
1204 /* Query Ob */
1206 }
1208 {
1209 /* Get the exception code */
1211 }
1212 _SEH2_END;
1213 break;
1214
1216
1218 {
1220 break;
1221 }
1222
1223 /* Set the return length */
1225
1226 /* Reference the process */
1229 PsProcessType,
1230 PreviousMode,
1232 NULL);
1234
1235 /* Protect write in SEH */
1236 _SEH2_TRY
1237 {
1238 /* Return if the flag is set */
1240 }
1242 {
1243 /* Get the exception code */
1245 }
1246 _SEH2_END;
1247
1248 /* Dereference the process */
1250 break;
1251
1253 {
1254 ULONG_PTR Wow64 = 0;
1255
1257 {
1259 break;
1260 }
1261
1262 /* Set the return length */
1264
1265 /* Reference the process */
1268 PsProcessType,
1269 PreviousMode,
1271 NULL);
1273
1274#if defined(_WIN64) && defined(BUILD_WOW64_ENABLED)
1275 /* Make sure the process isn't dying */
1277 {
1278 /* FIXME: A two-part hack: delay setting Process->Wow64Process,
1279 so 64-bit NTDLL can use IO to init stuff. */
1281 {
1283 Process->Wow64Process = ExAllocatePoolWithTag(NonPagedPool, sizeof(WOW64_PROCESS), TAG_PS_WOW64);
1285 {
1287
1290 }
1291 else
1292 {
1293 Process->Wow64Process->Wow64 = (PVOID)((ULONG_PTR)(Process->Peb) + ROUND_TO_PAGES(sizeof(PEB)));
1294 }
1295 }
1296
1297 /* Get the WOW64 process structure */
1299 {
1300 Wow64 = 0;
1301 }
1302 /* FIXME */
1304 {
1305 Wow64 = TRUE;
1306 }
1307 else
1308 {
1310 }
1311
1312 /* Release the lock */
1314 }
1315#endif
1316
1317 /* Dereference the process */
1319
1320 /* Protect write with SEH */
1321 _SEH2_TRY
1322 {
1323 /* Return the Wow64 process information */
1324 *(PULONG_PTR)ProcessInformation = Wow64;
1325 }
1327 {
1328 /* Get exception code */
1330 }
1331 _SEH2_END;
1332 break;
1333 }
1334
1336 {
1337 ULONG ExecuteOptions = 0;
1338
1340 {
1342 break;
1343 }
1344
1345 /* Set the return length */
1347
1349 {
1351 break;
1352 }
1353
1354 /* Get the options */
1357 {
1358 /* Protect write with SEH */
1359 _SEH2_TRY
1360 {
1361 /* Return them */
1362 *(PULONG)ProcessInformation = ExecuteOptions;
1363 }
1365 {
1366 /* Get exception code */
1368 }
1369 _SEH2_END;
1370 }
1371 break;
1372 }
1373
1377 break;
1378
1382 break;
1383
1387 break;
1388
1389 /* Not supported by Server 2003 */
1390 default:
1391#if DBG
1393#endif
1395 }
1396
1397 /* Check if caller wants the return length and if there is one */
1399 {
1400 /* Protect write with SEH */
1401 _SEH2_TRY
1402 {
1404 }
1406 {
1407 /* Get exception code.
1408 * Note: This overwrites any previous failure status. */
1410 }
1411 _SEH2_END;
1412 }
1413
1415}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
Definition: KdSystemDebugControl.c:34
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
Definition: KdSystemDebugControl.c:35
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
Definition: dbgkobj.c:1526
struct _UNICODE_STRING UNICODE_STRING
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
struct _IO_COUNTERS IO_COUNTERS
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
struct _IO_COUNTERS * PIO_COUNTERS
Definition: nsiface.idl:2307
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
Definition: procobj.c:860
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
Definition: procobj.c:525
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
Definition: section.c:1623
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
Definition: pagfault.c:2669
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
Definition: probe.h:219
NTSTATUS NTAPI IoQueryFileDosDeviceName(IN PFILE_OBJECT FileObject, OUT POBJECT_NAME_INFORMATION *ObjectNameInformation)
Definition: file.c:3662
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
Definition: process.c:1163
NTSTATUS NTAPI PsReferenceProcessFilePointer(_In_ PEPROCESS Process, _Outptr_ PFILE_OBJECT *FileObject)
Definition: query.c:24
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
Definition: audit.c:199
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
Definition: obhandle.c:56
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
Definition: devicemap.c:539
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3406
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:493
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
NTSTATUS NTAPI PsChargeProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Charges the non paged pool quota of a given process.
Definition: quota.c:811
VOID NTAPI PsReturnProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the non paged quota pool that the process was taking up.
Definition: quota.c:938
Definition: pstypes.h:1368
Definition: pstypes.h:82
Definition: winternl.h:2373
Definition: ketypes.h:660
Definition: nt_native.h:1272
Definition: btrfs_drv.h:1907
Definition: winternl.h:404
ULONG_PTR InheritedFromUniqueProcessId
Definition: pstypes.h:362
Definition: pstypes.h:392
Definition: pstypes.h:380
Definition: pstypes.h:1045
Definition: pstypes.h:405
Definition: ke.h:45
Definition: pstypes.h:67
Definition: lsa.idl:286
Definition: mmtypes.h:340
Definition: mmdrv.h:130
Definition: env_spec_w32.h:368
Definition: winternl.h:3130
SIZE_T QuotaPeakNonPagedPoolUsage
Definition: winternl.h:3138
Definition: ke.h:15
Definition: typedefs.h:103
struct _LARGE_INTEGER::@2524 u
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
struct _VM_COUNTERS * PVM_COUNTERS
struct _VM_COUNTERS_EX VM_COUNTERS_EX
#define ROUND_TO_PAGES(Size)
Referenced by _main(), BaseInitializeStaticServerData(), check_live_target(), CheckRemoteDebuggerPresent(), CON_API_NOCONSOLE(), EmptyWorkingSet(), EnumProcessModules(), FindModule(), get_shiminfo(), getCommandLineFromProcess(), GetDriveTypeW(), GetErrorMode(), GetExitCodeProcess(), GetLogicalDrives(), GetPriorityClass(), GetProcessAffinityMask(), GetProcessExecutablePath(), GetProcessHandleCount(), GetProcessId(), GetProcessImageFileNameA(), GetProcessImageFileNameW(), GetProcessIoCounters(), GetProcessMemoryInfo(), GetProcessPriorityBoost(), GetProcessTimes(), GetProcessVersion(), GetProcessWorkingSetSizeEx(), GetSourcePaths(), GetWsChanges(), GlobalMemoryStatusEx(), init_module_iterator(), init_module_iterator_wow64(), Is64BitSystem(), IsCriticalProcess(), IsWow64Process(), PerfDataGetCommandLine(), PrintProcess(), ProcessIdToSessionId(), PsaEnumerateProcessModules(), QueryFlag(), QueryFullProcessImageNameW(), QueryProcessCycleTime(), QuerySetProcessValidator(), RtlpQueryRemoteProcessModules(), RtlWow64GetProcessMachines(), SmpApiLoop(), SmpCreateVolumeDescriptors(), SmpGetProcessMuSessionId(), test_affinity(), test_amd64_shared_info(), test_dead_process(), test_debuggee_dbgport(), test_exec_memory_writes(), test_GlobalMemoryStatus(), test_mapprotection(), test_nt_wow64(), test_NtGetCurrentProcessorNumber(), test_peb_teb(), test_process_id(), test_process_machine(), Test_ProcessBasicInformation(), Test_ProcessPriorityClassAlignment(), Test_ProcessQuotaLimits(), Test_ProcessQuotaLimitsEx(), Test_ProcessTimes(), Test_ProcessWx86Information(), test_query_process(), test_query_process_basic(), test_query_process_debug_flags(), test_query_process_debug_object_handle(), test_query_process_debug_port(), test_query_process_handlecount(), test_query_process_image_file_name(), test_query_process_image_info(), test_query_process_io(), test_query_process_priority(), test_query_process_quota_limits(), test_query_process_times(), test_query_process_vm(), test_query_process_wow64(), test_redirection(), test_section_access(), test_wow64_shared_info(), UnhandledExceptionFilter(), UserpGetClientFileName(), wmain(), and Wow64QueryFlag().
◆ NtQueryInformationThread()
| NTSTATUS NTAPI NtQueryInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength, | ||
| _Out_opt_ PULONG | ReturnLength | ||
| ) |
Definition at line 3017 of file query.c.
3024{
3028 ULONG Access;
3030
3031 PAGED_CODE();
3032
3033 /* Validate the information class */
3035 PsThreadInfoClass,
3037 ICIF_PROBE_READ,
3038 ThreadInformation,
3039 ThreadInformationLength,
3040 ReturnLength,
3041 NULL,
3042 PreviousMode);
3044 {
3045#if DBG
3046 DPRINT1("NtQueryInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
3048#endif
3050 }
3051
3052 /* Check what class this is */
3053 Access = THREAD_QUERY_INFORMATION;
3054
3055 /* Check what kind of information class this is */
3057 {
3058 /* Basic thread information */
3060 {
3061 PTHREAD_BASIC_INFORMATION ThreadBasicInfo =
3062 (PTHREAD_BASIC_INFORMATION)ThreadInformation;
3063
3064 /* Set the return length */
3066
3068 {
3070 break;
3071 }
3072
3073 /* Reference the thread */
3075 Access,
3076 PsThreadType,
3077 PreviousMode,
3079 NULL);
3081 break;
3082
3083 /* Protect writes with SEH */
3084 _SEH2_TRY
3085 {
3086 /* Write all the information from the ETHREAD/KTHREAD */
3093 }
3095 {
3096 /* Get exception code */
3098 }
3099 _SEH2_END;
3100
3101 /* Dereference the thread */
3103 break;
3104 }
3105
3106 /* Thread time information */
3108 {
3110
3111 /* Set the return length */
3113
3115 {
3117 break;
3118 }
3119
3120 /* Reference the thread */
3122 Access,
3123 PsThreadType,
3124 PreviousMode,
3126 NULL);
3128 break;
3129
3130 /* Protect writes with SEH */
3131 _SEH2_TRY
3132 {
3133 /* Copy time information from ETHREAD/KTHREAD */
3137
3138 /* Exit time is in a union and only valid on actual exit! */
3140 {
3142 }
3143 else
3144 {
3146 }
3147 }
3149 {
3150 /* Get exception code */
3152 }
3153 _SEH2_END;
3154
3155 /* Dereference the thread */
3157 break;
3158 }
3159
3161 {
3162 /* Set the return length*/
3164
3166 {
3168 break;
3169 }
3170
3171 /* Reference the thread */
3173 Access,
3174 PsThreadType,
3175 PreviousMode,
3177 NULL);
3179 break;
3180
3181 /* Protect write with SEH */
3182 _SEH2_TRY
3183 {
3184 /* Return the Win32 Start Address */
3186 }
3188 {
3189 /* Get exception code */
3191 }
3192 _SEH2_END;
3193
3194 /* Dereference the thread */
3196 break;
3197 }
3198
3200 {
3201 /* Set the return length*/
3203
3205 {
3207 break;
3208 }
3209
3210 /* Reference the thread */
3212 Access,
3213 PsThreadType,
3214 PreviousMode,
3216 NULL);
3218 break;
3219
3220 /* Protect write with SEH */
3221 _SEH2_TRY
3222 {
3223 /* FIXME */
3224 (*(PLARGE_INTEGER)ThreadInformation).QuadPart = 0;
3225 }
3227 {
3228 /* Get exception code */
3230 }
3231 _SEH2_END;
3232
3233 /* Dereference the thread */
3235 break;
3236 }
3237
3239 {
3240 /* Set the return length*/
3242
3244 {
3246 break;
3247 }
3248
3249 /* Reference the thread */
3251 Access,
3252 PsThreadType,
3253 PreviousMode,
3255 NULL);
3257 break;
3258
3259 /* Protect write with SEH */
3260 _SEH2_TRY
3261 {
3262 /* Return whether or not we are the last thread */
3265 &Thread->ThreadsProcess->
3266 ThreadListHead) ?
3268 }
3270 {
3271 /* Get exception code */
3273 }
3274 _SEH2_END;
3275
3276 /* Dereference the thread */
3278 break;
3279 }
3280
3282 {
3284
3285 /* Set the return length*/
3287
3289 {
3291 break;
3292 }
3293
3294 /* Reference the thread */
3296 Access,
3297 PsThreadType,
3298 PreviousMode,
3300 NULL);
3302 break;
3303
3304 /* Raise the IRQL to protect the IRP list */
3306
3307 /* Protect write with SEH */
3308 _SEH2_TRY
3309 {
3310 /* Check if the IRP list is empty or not */
3312 }
3314 {
3315 /* Get exception code */
3317 }
3318 _SEH2_END;
3319
3320 /* Lower IRQL back */
3322
3323 /* Dereference the thread */
3325 break;
3326 }
3327
3328 /* LDT and GDT information */
3330 {
3331#if defined(_X86_)
3332 /* Reference the thread */
3334 Access,
3335 PsThreadType,
3336 PreviousMode,
3338 NULL);
3340 break;
3341
3342 /* Call the worker routine */
3344 ThreadInformation,
3345 ThreadInformationLength,
3346 ReturnLength);
3347
3348 /* Dereference the thread */
3350#else
3351 /* Only implemented on x86 */
3353#endif
3354 break;
3355 }
3356
3358 {
3359 /* Set the return length*/
3361
3363 {
3365 break;
3366 }
3367
3368 /* Reference the thread */
3370 Access,
3371 PsThreadType,
3372 PreviousMode,
3374 NULL);
3376 break;
3377
3378 _SEH2_TRY
3379 {
3381 }
3383 {
3385 }
3386 _SEH2_END;
3387
3388 /* Dereference the thread */
3390 break;
3391 }
3392
3393#if (NTDDI_VERSION >= NTDDI_VISTA)
3395 {
3396 /* Set the return length */
3398
3400 {
3402 break;
3403 }
3404
3405 /* Reference the thread */
3407 Access,
3408 PsThreadType,
3409 PreviousMode,
3411 NULL);
3413 break;
3414
3415 /* Protect write with SEH */
3416 _SEH2_TRY
3417 {
3419 }
3421 {
3422 /* Get exception code */
3424 }
3425 _SEH2_END;
3426
3427 /* Dereference the thread */
3429 break;
3430 }
3431#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
3432
3434 {
3435 /* Set the return length */
3437
3439 {
3441 break;
3442 }
3443
3444 /* Reference the thread */
3446 Access,
3447 PsThreadType,
3448 PreviousMode,
3450 NULL);
3452 break;
3453
3454 _SEH2_TRY
3455 {
3457 }
3459 {
3461 }
3462 _SEH2_END;
3463
3464 /* Dereference the thread */
3466 break;
3467 }
3468
3470 {
3471 ULONG ThreadTerminated;
3472
3473 /* Set the return length*/
3475
3477 {
3479 break;
3480 }
3481
3482 /* Reference the thread */
3484 Access,
3485 PsThreadType,
3486 PreviousMode,
3488 NULL);
3490 break;
3491
3493
3494 _SEH2_TRY
3495 {
3496 *(PULONG)ThreadInformation = ThreadTerminated ? 1 : 0;
3497 }
3499 {
3501 }
3502 _SEH2_END;
3503
3504 /* Dereference the thread */
3506 break;
3507 }
3508
3509#if (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__)
3511 {
3512 PUNICODE_STRING ThreadName;
3513
3514 /* Reference the thread */
3516 // FIXME: Use THREAD_QUERY_LIMITED_INFORMATION when implemented
3517 THREAD_QUERY_INFORMATION,
3518 PsThreadType,
3519 PreviousMode,
3521 NULL);
3523 break;
3524
3526
3528
3529 /* Set the return length (REMARK: We only
3530 * consider Length instead of MaximumLength) */
3534 {
3538 /* As on Windows, and *not* STATUS_INFO_LENGTH_MISMATCH */
3539 break;
3540 }
3541
3542 /* Protect writes with SEH */
3543 _SEH2_TRY
3544 {
3545 PTHREAD_NAME_INFORMATION NameInfo =
3546 (PTHREAD_NAME_INFORMATION)ThreadInformation;
3548 {
3553 ThreadName->Buffer,
3554 ThreadName->Length);
3555 }
3556 else
3557 {
3559 }
3560 }
3562 {
3563 /* Get exception code */
3565 }
3566 _SEH2_END;
3567
3569
3570 /* Dereference the thread */
3572 break;
3573 }
3574#endif /* (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__) */
3575
3576 /* Anything else */
3577 default:
3578 /* Not yet implemented */
3579#if DBG
3581#endif
3583 }
3584
3585 /* Protect write with SEH */
3586 _SEH2_TRY
3587 {
3588 /* Check if caller wanted return length */
3590 }
3592 {
3593 /* Get exception code */
3595 }
3596 _SEH2_END;
3597
3599}
struct _THREAD_BASIC_INFORMATION THREAD_BASIC_INFORMATION
struct _THREAD_BASIC_INFORMATION * PTHREAD_BASIC_INFORMATION
struct _THREAD_NAME_INFORMATION * PTHREAD_NAME_INFORMATION
_In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength
Definition: psfuncs.h:844
LONG NTAPI KeQueryBasePriorityThread(IN PKTHREAD Thread)
Definition: thrdobj.c:52
BOOLEAN NTAPI PsIsThreadTerminating(IN PETHREAD Thread)
Definition: thread.c:868
FORCEINLINE VOID PspUnlockThreadSecurityShared(IN PETHREAD Thread)
Definition: ps_x.h:166
FORCEINLINE VOID PspLockThreadSecurityShared(IN PETHREAD Thread)
Definition: ps_x.h:155
NTSTATUS NTAPI PspQueryDescriptorThread(IN PETHREAD Thread, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
Definition: psldt.c:43
Definition: pstypes.h:1197
Definition: compat.h:926
Definition: pstypes.h:1095
union _LARGE_INTEGER LARGE_INTEGER
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
Definition: kefuncs.h:778
Referenced by CreateRemoteThread(), CsrCreateProcess(), CsrCreateRemoteThread(), CsrCreateThread(), CsrInsertThread(), CsrSbCreateSession(), DbgUiConvertStateChangeStructure(), DoThreadNameTest(), ExitThread(), fetch_thread_info(), GetExitCodeThread(), GetProcessIdOfThread(), GetThreadDescription(), GetThreadGroupAffinity(), GetThreadId(), GetThreadIdealProcessorEx(), GetThreadIOPendingFlag(), GetThreadPriority(), GetThreadPriorityBoost(), GetThreadSelectorEntry(), GetThreadTimes(), i386_stack_walk(), init_funcs(), InitFunctionPtrs(), ntGetThreadName(), PrintThreads(), QuerySetThreadValidator(), RtlCheckForOrphanedCriticalSections(), RtlFreeUserThreadStack(), RtlpIsIoPending(), SetThreadAffinityMask(), TerminateThread(), test_dbg_hidden_thread_creation(), test_HideFromDebugger(), test_peb_teb(), test_process_machine(), Test_ThreadBasicInformationClass(), test_ThreadEnableAlignmentFaultFixup(), Test_ThreadHideFromDebuggerClass(), and test_tls_links().
◆ NtSetInformationProcess()
| NTSTATUS NTAPI NtSetInformationProcess | ( | _In_ HANDLE | ProcessHandle, |
| _In_ PROCESSINFOCLASS | ProcessInformationClass, | ||
| _In_reads_bytes_(ProcessInformationLength) PVOID | ProcessInformation, | ||
| _In_ ULONG | ProcessInformationLength | ||
| ) |
Definition at line 1422 of file query.c.
1427{
1430 ACCESS_MASK Access;
1436 PROCESS_PRIORITY_CLASS PriorityClass = {0};
1437 PROCESS_FOREGROUND_BACKGROUND Foreground = {0};
1438 PVOID ExceptionPort;
1439 ULONG Break;
1441 KPRIORITY BasePriority = 0;
1442 UCHAR MemoryPriority = 0;
1443 BOOLEAN DisableBoost = 0;
1444 ULONG DefaultHardErrorMode = 0;
1445 ULONG DebugFlags = 0, EnableFixup = 0, Boost = 0;
1446 ULONG NoExecute = 0, VdmPower = 0;
1450 PAGED_CODE();
1451
1452 /* Validate the information class */
1454 PsProcessInfoClass,
1456 ProcessInformation,
1457 ProcessInformationLength,
1458 PreviousMode);
1460 {
1461#if DBG
1462 DPRINT1("NtSetInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
1463 PspDumpProcessInfoClassName(ProcessInformationClass), Status);
1464#endif
1466 }
1467
1468 /* Check what class this is */
1469 Access = PROCESS_SET_INFORMATION;
1471 {
1472 /* Setting the Session ID needs a special mask */
1473 Access |= PROCESS_SET_SESSIONID;
1474 }
1476 {
1477 /* Setting the exception port needs a special mask */
1478 Access |= PROCESS_SUSPEND_RESUME;
1479 }
1480
1481 /* Reference the process */
1483 Access,
1484 PsProcessType,
1485 PreviousMode,
1487 NULL);
1489
1490 /* Check what kind of information class this is */
1491 switch (ProcessInformationClass)
1492 {
1494
1495 /* Check buffer length */
1497 {
1499 break;
1500 }
1501
1502 /* Use SEH for capture */
1503 _SEH2_TRY
1504 {
1505 /* Capture the boolean */
1506 VdmPower = *(PULONG)ProcessInformation;
1507 }
1509 {
1510 /* Get the exception code */
1513 }
1514 _SEH2_END;
1515
1516 /* Getting VDM powers requires the SeTcbPrivilege */
1518 {
1519 /* We don't hold the privilege, bail out */
1522 break;
1523 }
1524
1525 /* Set or clear the flag */
1526 if (VdmPower)
1527 {
1529 }
1530 else
1531 {
1533 }
1534 break;
1535
1536 /* Error/Exception Port */
1538
1539 /* Check buffer length */
1541 {
1543 break;
1544 }
1545
1546 /* Use SEH for capture */
1547 _SEH2_TRY
1548 {
1549 /* Capture the handle */
1550 PortHandle = *(PHANDLE)ProcessInformation;
1551 }
1553 {
1554 /* Get the exception code */
1557 }
1558 _SEH2_END;
1559
1560 /* Setting the error port requires the SeTcbPrivilege */
1562 {
1563 /* We don't hold the privilege, bail out */
1565 break;
1566 }
1567
1568 /* Get the LPC Port */
1570 0,
1571 LpcPortObjectType,
1572 PreviousMode,
1573 (PVOID)&ExceptionPort,
1574 NULL);
1576
1577 /* Change the pointer */
1579 ExceptionPort,
1580 NULL))
1581 {
1582 /* We already had one, fail */
1583 ObDereferenceObject(ExceptionPort);
1585 }
1586 break;
1587
1588 /* Security Token */
1590
1591 /* Check buffer length */
1593 {
1595 break;
1596 }
1597
1598 /* Use SEH for capture */
1599 _SEH2_TRY
1600 {
1601 /* Save the token handle */
1603 Token;
1604 }
1606 {
1607 /* Get the exception code */
1610 }
1611 _SEH2_END;
1612
1613 /* Assign the actual token */
1615 break;
1616
1617 /* Hard error processing */
1619
1620 /* Check buffer length */
1622 {
1624 break;
1625 }
1626
1627 /* Enter SEH for direct buffer read */
1628 _SEH2_TRY
1629 {
1630 DefaultHardErrorMode = *(PULONG)ProcessInformation;
1631 }
1633 {
1634 /* Get exception code */
1637 }
1638 _SEH2_END;
1639
1640 /* Set the mode */
1641 Process->DefaultHardErrorProcessing = DefaultHardErrorMode;
1642
1643 /* Call Ke for the update */
1645 {
1647 }
1648 else
1649 {
1651 }
1653 break;
1654
1655 /* Session ID */
1657
1658 /* Check buffer length */
1660 {
1662 break;
1663 }
1664
1665 /* Enter SEH for capture */
1666 _SEH2_TRY
1667 {
1668 /* Capture the caller's buffer */
1670 }
1672 {
1673 /* Get the exception code */
1676 }
1677 _SEH2_END;
1678
1679 /* Setting the session id requires the SeTcbPrivilege */
1681 {
1682 /* We don't hold the privilege, bail out */
1684 break;
1685 }
1686
1687 /*
1688 * Since we cannot change the session ID of the given
1689 * process anymore because it is set once and for all
1690 * at process creation time and because it is stored
1691 * inside the Process->Session structure managed by MM,
1692 * we fake changing it: we just return success if the
1693 * user-defined value is the same as the session ID of
1694 * the process, and otherwise we fail.
1695 */
1697 {
1699 }
1700 else
1701 {
1703 }
1704
1705 break;
1706
1708
1709 /* Check buffer length */
1711 {
1713 break;
1714 }
1715
1716 /* Enter SEH for capture */
1717 _SEH2_TRY
1718 {
1719 /* Capture the caller's buffer */
1720 PriorityClass = *(PPROCESS_PRIORITY_CLASS)ProcessInformation;
1721 }
1723 {
1724 /* Return the exception code */
1727 }
1728 _SEH2_END;
1729
1730 /* Check for invalid PriorityClass value */
1732 {
1734 break;
1735 }
1736
1739 {
1740 /* Check the privilege */
1742 ProcessHandle,
1743 PROCESS_SET_INFORMATION,
1744 PreviousMode);
1746 {
1750 }
1751 }
1752
1753 /* Check if we have a job */
1755 {
1757 }
1758
1759 /* Set process priority class */
1761
1762 /* Set process priority mode (foreground or background) */
1764 PriorityClass.Foreground ?
1765 PsProcessPriorityForeground :
1766 PsProcessPriorityBackground);
1768 break;
1769
1771
1772 /* Check buffer length */
1774 {
1776 break;
1777 }
1778
1779 /* Enter SEH for capture */
1780 _SEH2_TRY
1781 {
1782 /* Capture the caller's buffer */
1783 Foreground = *(PPROCESS_FOREGROUND_BACKGROUND)ProcessInformation;
1784 }
1786 {
1787 /* Return the exception code */
1790 }
1791 _SEH2_END;
1792
1793 /* Set process priority mode (foreground or background) */
1795 Foreground.Foreground ?
1796 PsProcessPriorityForeground :
1797 PsProcessPriorityBackground);
1799 break;
1800
1802
1803 /* Validate input length */
1805 {
1807 break;
1808 }
1809
1810 /* Enter SEH for direct buffer read */
1811 _SEH2_TRY
1812 {
1813 BasePriority = *(KPRIORITY*)ProcessInformation;
1814 }
1816 {
1817 /* Get exception code */
1818 Break = 0;
1821 }
1822 _SEH2_END;
1823
1824 /* Extract the memory priority out of there */
1825 if (BasePriority & 0x80000000)
1826 {
1827 MemoryPriority = MEMORY_PRIORITY_FOREGROUND;
1828 BasePriority &= ~0x80000000;
1829 }
1830 else
1831 {
1832 MemoryPriority = MEMORY_PRIORITY_BACKGROUND;
1833 }
1834
1835 /* Validate the number */
1837 {
1840 }
1841
1842 /* Check if the new base is higher */
1844 {
1846 ProcessHandle,
1847 PROCESS_SET_INFORMATION,
1848 PreviousMode);
1850 {
1852 DPRINT1("Privilege to change priority from %lx to %lx lacking\n", Process->Pcb.BasePriority, BasePriority);
1854 }
1855 }
1856
1857 /* Call Ke */
1859
1860 /* Now set the memory priority */
1863 break;
1864
1866
1867 /* Validate input length */
1869 {
1871 break;
1872 }
1873
1874 /* Enter SEH for direct buffer read */
1875 _SEH2_TRY
1876 {
1877 Boost = *(PULONG)ProcessInformation;
1878 }
1880 {
1881 /* Get exception code */
1882 Break = 0;
1885 }
1886 _SEH2_END;
1887
1888 /* Make sure the process isn't dying */
1890 {
1891 /* Lock it */
1892 KeEnterCriticalRegion();
1894
1895 /* Loop the threads */
1899 {
1900 /* Call Ke for the thread */
1903 }
1904
1905 /* Release the lock and rundown */
1907 KeLeaveCriticalRegion();
1909
1910 /* Set success code */
1912 }
1913 else
1914 {
1915 /* Avoid race conditions */
1917 }
1918 break;
1919
1921
1922 /* Check buffer length */
1924 {
1926 break;
1927 }
1928
1929 /* Enter SEH for direct buffer read */
1930 _SEH2_TRY
1931 {
1932 Break = *(PULONG)ProcessInformation;
1933 }
1935 {
1936 /* Get exception code */
1937 Break = 0;
1940 }
1941 _SEH2_END;
1942
1943 /* Setting 'break on termination' requires the SeDebugPrivilege */
1945 {
1946 /* We don't hold the privilege, bail out */
1948 break;
1949 }
1950
1951 /* Set or clear the flag */
1952 if (Break)
1953 {
1955 }
1956 else
1957 {
1959 }
1960
1961 break;
1962
1964
1965 /* Check buffer length */
1967 {
1969 break;
1970 }
1971
1972 /* Enter SEH for direct buffer read */
1973 _SEH2_TRY
1974 {
1976 }
1978 {
1979 /* Get exception code */
1980 Break = 0;
1983 }
1984 _SEH2_END;
1985
1986 /* Make sure it's valid for the CPUs present */
1989 {
1991 break;
1992 }
1993
1994 /* Check if it's within job affinity limits */
1996 {
1997 /* Not yet implemented */
1998 UNIMPLEMENTED;
2000 break;
2001 }
2002
2003 /* Make sure the process isn't dying */
2005 {
2006 /* Lock it */
2007 KeEnterCriticalRegion();
2009
2010 /* Call Ke to do the work */
2012
2013 /* Release the lock and rundown */
2015 KeLeaveCriticalRegion();
2017
2018 /* Set success code */
2020 }
2021 else
2022 {
2023 /* Avoid race conditions */
2025 }
2026 break;
2027
2028 /* Priority Boosting status */
2030
2031 /* Validate input length */
2033 {
2035 break;
2036 }
2037
2038 /* Enter SEH for direct buffer read */
2039 _SEH2_TRY
2040 {
2041 DisableBoost = *(PBOOLEAN)ProcessInformation;
2042 }
2044 {
2045 /* Get exception code */
2046 Break = 0;
2049 }
2050 _SEH2_END;
2051
2052 /* Make sure the process isn't dying */
2054 {
2055 /* Lock it */
2056 KeEnterCriticalRegion();
2058
2059 /* Call Ke to do the work */
2061
2062 /* Loop the threads too */
2066 {
2067 /* Call Ke for the thread */
2070 }
2071
2072 /* Release the lock and rundown */
2074 KeLeaveCriticalRegion();
2076
2077 /* Set success code */
2079 }
2080 else
2081 {
2082 /* Avoid race conditions */
2084 }
2085 break;
2086
2088
2089 /* Check buffer length */
2091 {
2093 break;
2094 }
2095
2096 /* Enter SEH for direct buffer read */
2097 _SEH2_TRY
2098 {
2099 DebugFlags = *(PULONG)ProcessInformation;
2100 }
2102 {
2103 /* Get exception code */
2106 }
2107 _SEH2_END;
2108
2109 /* Set the mode */
2110 if (DebugFlags & ~1)
2111 {
2113 }
2114 else
2115 {
2116 if (DebugFlags & 1)
2117 {
2119 }
2120 else
2121 {
2123 }
2124 }
2125
2126 /* Done */
2128 break;
2129
2131
2132 /* Check buffer length */
2134 {
2136 break;
2137 }
2138
2139 /* Enter SEH for direct buffer read */
2140 _SEH2_TRY
2141 {
2142 EnableFixup = *(PULONG)ProcessInformation;
2143 }
2145 {
2146 /* Get exception code */
2149 }
2150 _SEH2_END;
2151
2152 /* Set the mode */
2153 if (EnableFixup)
2154 {
2156 }
2157 else
2158 {
2159 Process->DefaultHardErrorProcessing &= ~SEM_NOALIGNMENTFAULTEXCEPT;
2160 }
2161
2162 /* Call Ke for the update */
2165 break;
2166
2168
2169 /* Only TCB can do this */
2171 {
2172 /* We don't hold the privilege, bail out */
2175 break;
2176 }
2177
2178 /* Only supported on x86 */
2179#if defined (_X86_)
2180 Ke386SetIOPL();
2181#elif defined(_M_AMD64)
2182 /* On x64 this function isn't implemented.
2183 On Windows 2003 it returns success.
2184 On Vista+ it returns STATUS_NOT_IMPLEMENTED. */
2186 (RtlRosGetAppcompatVersion() > _WIN32_WINNT_WS03))
2187 {
2189 }
2190#else
2192#endif
2193 /* Done */
2194 break;
2195
2197
2198 /* Check buffer length */
2200 {
2202 break;
2203 }
2204
2206 {
2208 break;
2209 }
2210
2211 /* Enter SEH for direct buffer read */
2212 _SEH2_TRY
2213 {
2214 NoExecute = *(PULONG)ProcessInformation;
2215 }
2217 {
2218 /* Get exception code */
2221 }
2222 _SEH2_END;
2223
2224 /* Call Mm for the update */
2226 break;
2227
2229
2230 /* Check buffer length */
2232 {
2234 break;
2235 }
2236
2237 /* Use SEH for capture */
2238 _SEH2_TRY
2239 {
2240 /* Capture the handle */
2242 }
2244 {
2245 /* Get the exception code */
2248 }
2249 _SEH2_END;
2250
2251 /* Call Ob to set the device map */
2253 break;
2254
2255
2256 /* We currently don't implement any of these */
2262 break;
2263
2265
2267 1,
2268 ProcessInformation,
2269 ProcessInformationLength,
2270 PreviousMode);
2271 break;
2272
2276 break;
2277
2281 break;
2282
2283 /* Anything else is invalid */
2284 default:
2285#if DBG
2286 DPRINT1("Invalid Server 2003 Info Class: %s\n", PspDumpProcessInfoClassName(ProcessInformationClass));
2287#endif
2289 }
2290
2291 /* Dereference and return status */
2294}
Definition: tokenizer.hpp:28
FORCEINLINE VOID ExAcquirePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1108
FORCEINLINE VOID ExReleasePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1216
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
Definition: pstypes.h:108
struct _PROCESS_FOREGROUND_BACKGROUND * PPROCESS_FOREGROUND_BACKGROUND
#define LOW_PRIORITY
#define HIGH_PRIORITY
#define InterlockedCompareExchangePointer
Definition: interlocked.h:144
struct _PROCESS_ACCESS_TOKEN * PPROCESS_ACCESS_TOKEN
KAFFINITY NTAPI KeSetAffinityProcess(IN PKPROCESS Process, IN KAFFINITY Affinity)
Definition: procobj.c:265
BOOLEAN NTAPI KeSetDisableBoostProcess(IN PKPROCESS Process, IN BOOLEAN Disable)
Definition: procobj.c:331
BOOLEAN NTAPI KeSetDisableBoostThread(IN OUT PKTHREAD Thread, IN BOOLEAN Disable)
Definition: thrdobj.c:86
BOOLEAN NTAPI KeSetAutoAlignmentProcess(IN PKPROCESS Process, IN BOOLEAN Enable)
Definition: procobj.c:313
VOID NTAPI KeBoostPriorityThread(IN PKTHREAD Thread, IN KPRIORITY Increment)
Definition: thrdobj.c:220
KPRIORITY NTAPI KeSetPriorityAndQuantumProcess(IN PKPROCESS Process, IN KPRIORITY Priority, IN UCHAR Quantum OPTIONAL)
Definition: procobj.c:349
NTSTATUS NTAPI MmSetExecuteOptions(IN ULONG ExecuteOptions)
Definition: pagfault.c:2711
NTSTATUS NTAPI MmSetMemoryPriorityProcess(IN PEPROCESS Process, IN UCHAR MemoryPriority)
Definition: procsup.c:543
static __inline NTSTATUS DefaultSetInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ PVOID Buffer, _In_ ULONG BufferLength, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtSet*** system call is invoked from u...
Definition: probe.h:70
BOOLEAN NTAPI SeCheckPrivilegedObject(_In_ LUID PrivilegeValue, _In_ HANDLE ObjectHandle, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE PreviousMode)
Checks a privileged object if such object has the specific privilege submitted by the caller.
Definition: priv.c:803
VOID NTAPI PsSetProcessPriorityByClass(IN PEPROCESS Process, IN PSPROCESSPRIORITYMODE Type)
Definition: process.c:1325
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
Definition: priv.c:744
NTSTATUS NTAPI ObSetDeviceMap(IN PEPROCESS Process, IN HANDLE DirectoryHandle)
Definition: devicemap.c:24
NTSTATUS NTAPI PspSetPrimaryToken(IN PEPROCESS Process, IN HANDLE TokenHandle OPTIONAL, IN PACCESS_TOKEN Token OPTIONAL)
Definition: security.c:215
NTSTATUS NTAPI PspSetQuotaLimits(_In_ PEPROCESS Process, _In_ ULONG Unused, _In_ PVOID QuotaLimits, _In_ ULONG QuotaLimitsLength, _In_ KPROCESSOR_MODE PreviousMode)
This function adjusts the working set limits of a process and sets up new quota limits when necessary...
Definition: quota.c:1045
STDMETHOD() Next(THIS_ ULONG celt, IAssociationElement *pElement, ULONG *pceltFetched) PURE
Definition: typedefs.h:120
Definition: ntddk.h:9
Definition: pstypes.h:1054
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
Definition: halfuncs.h:174
Referenced by _main(), CreateProcessInternalW(), CSR_API(), CsrCreateProcess(), CsrpSetDefaultProcessHardErrorMode(), CsrSbCreateSession(), CsrSetBackgroundPriority(), CsrSetForegroundPriority(), CsrSetToNormalPriority(), CsrSetToShutdownPriority(), EmptyWorkingSet(), InitFunctionPtrs(), InitializeProcessForWsWatch(), InsertTokenToProcessCommon(), LdrpInitializeProcess(), QuerySetProcessValidator(), SetErrorMode(), SetPriorityClass(), SetProcessAffinityMask(), SetProcessInformation(), SetProcessPriorityBoost(), SetProcessWorkingSetSizeEx(), SmpInit(), SmpSbCreateSession(), SmpSetProcessMuSessionId(), test_exec_memory_writes(), Test_ProcBasePriorityClass(), test_process_instrumentation_callback(), Test_ProcessWx86InformationClass(), Test_ProcForegroundBackgroundClass(), and Test_ProcRaisePriorityClass().
◆ NtSetInformationThread()
| NTSTATUS NTAPI NtSetInformationThread | ( | _In_ HANDLE | ThreadHandle, |
| _In_ THREADINFOCLASS | ThreadInformationClass, | ||
| _In_reads_bytes_(ThreadInformationLength) PVOID | ThreadInformation, | ||
| _In_ ULONG | ThreadInformationLength | ||
| ) |
Definition at line 2301 of file query.c.
2306{
2312 PTEB Teb;
2313
2314 PAGED_CODE();
2315
2316 /* Validate the information class */
2318 PsThreadInfoClass,
2320 ThreadInformation,
2321 ThreadInformationLength,
2322 PreviousMode);
2324 {
2325#if DBG
2326 DPRINT1("NtSetInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
2328#endif
2330 }
2331
2332 /* Check what kind of information class this is */
2334 {
2335 /* Thread priority */
2337 {
2338 /* Check buffer length */
2340 {
2342 break;
2343 }
2344
2345 /* Use SEH for capture */
2346 _SEH2_TRY
2347 {
2348 /* Get the priority */
2350 }
2352 {
2353 /* Get the exception code */
2356 }
2357 _SEH2_END;
2358
2359 /* Validate it */
2362 {
2363 /* Fail */
2365 break;
2366 }
2367
2368 /* Check for the required privilege */
2370 {
2373 ThreadHandle,
2374 THREAD_SET_INFORMATION,
2375 PreviousMode);
2377 {
2380 }
2381 }
2382
2383 /* Reference the thread */
2385 THREAD_SET_INFORMATION,
2386 PsThreadType,
2387 PreviousMode,
2389 NULL);
2391 break;
2392
2393 /* Set the priority */
2395
2396 /* Dereference the thread */
2398 break;
2399 }
2400
2402 {
2403 /* Check buffer length */
2405 {
2407 break;
2408 }
2409
2410 /* Use SEH for capture */
2411 _SEH2_TRY
2412 {
2413 /* Get the priority */
2415 }
2417 {
2418 /* Get the exception code */
2421 }
2422 _SEH2_END;
2423
2424 /* Validate it */
2427 {
2428 /* These ones are OK */
2431 {
2432 /* Check if the process is real time */
2435 {
2436 /* It isn't, fail */
2438 break;
2439 }
2440 }
2441 }
2442
2443 /* Reference the thread */
2445 THREAD_SET_INFORMATION,
2446 PsThreadType,
2447 PreviousMode,
2449 NULL);
2451 break;
2452
2453 /* Set the base priority */
2455
2456 /* Dereference the thread */
2458 break;
2459 }
2460
2462 {
2464
2465 /* Check buffer length */
2467 {
2469 break;
2470 }
2471
2472 /* Use SEH for capture */
2473 _SEH2_TRY
2474 {
2475 /* Get the priority */
2477 }
2479 {
2480 /* Get the exception code */
2483 }
2484 _SEH2_END;
2485
2486 /* Validate it */
2488 {
2489 /* Fail */
2491 break;
2492 }
2493
2494 /* Reference the thread */
2496 THREAD_SET_INFORMATION,
2497 PsThreadType,
2498 PreviousMode,
2500 NULL);
2502 break;
2503
2504 /* Get the process */
2506
2507 /* Try to acquire rundown */
2509 {
2510 /* Lock it */
2511 KeEnterCriticalRegion();
2513
2514 /* Combine masks */
2517 {
2518 /* Fail */
2520 }
2521 else
2522 {
2523 /* Set the affinity */
2525 }
2526
2527 /* Release the lock and rundown */
2529 KeLeaveCriticalRegion();
2531 }
2532 else
2533 {
2534 /* Too late */
2536 }
2537
2538 /* Dereference the thread */
2540 break;
2541 }
2542
2544 {
2546
2547 /* Check buffer length */
2549 {
2551 break;
2552 }
2553
2554 /* Use SEH for capture */
2555 _SEH2_TRY
2556 {
2557 /* Save the token handle */
2559 }
2561 {
2562 /* Get the exception code */
2565 }
2566 _SEH2_END;
2567
2568 /* Reference the thread */
2570 THREAD_SET_THREAD_TOKEN,
2571 PsThreadType,
2572 PreviousMode,
2574 NULL);
2576 break;
2577
2578 /* Assign the actual token */
2580
2581 /* Dereference the thread */
2583 break;
2584 }
2585
2587 {
2589
2590 /* Check buffer length */
2592 {
2594 break;
2595 }
2596
2597 /* Use SEH for capture */
2598 _SEH2_TRY
2599 {
2600 /* Get the priority */
2602 }
2604 {
2605 /* Get the exception code */
2608 }
2609 _SEH2_END;
2610
2611 /* Reference the thread */
2613 THREAD_SET_INFORMATION,
2614 PsThreadType,
2615 PreviousMode,
2617 NULL);
2619 break;
2620
2621 /* Set the address */
2623
2624 /* Dereference the thread */
2626 break;
2627 }
2628
2630 {
2631 ULONG_PTR IdealProcessor;
2632
2633 /* Check buffer length */
2635 {
2637 break;
2638 }
2639
2640 /* Use SEH for capture */
2641 _SEH2_TRY
2642 {
2643 /* Get the priority */
2644 IdealProcessor = *(PULONG_PTR)ThreadInformation;
2645 }
2647 {
2648 /* Get the exception code */
2651 }
2652 _SEH2_END;
2653
2654 /* Validate it */
2656 {
2657 /* Fail */
2659 break;
2660 }
2661
2662 /* Reference the thread */
2664 THREAD_SET_INFORMATION,
2665 PsThreadType,
2666 PreviousMode,
2668 NULL);
2670 break;
2671
2672 /* Set the ideal */
2674 (CCHAR)IdealProcessor);
2675
2676 /* Get the TEB and protect the thread */
2679 {
2680 /* Save the ideal processor */
2682
2683 /* Release rundown protection */
2685 }
2686
2687 /* Dereference the thread */
2689 break;
2690 }
2691
2693 {
2694 ULONG_PTR DisableBoost;
2695
2696 /* Check buffer length */
2698 {
2700 break;
2701 }
2702
2703 /* Use SEH for capture */
2704 _SEH2_TRY
2705 {
2706 /* Get the priority */
2707 DisableBoost = *(PULONG_PTR)ThreadInformation;
2708 }
2710 {
2711 /* Get the exception code */
2714 }
2715 _SEH2_END;
2716
2717 /* Reference the thread */
2719 THREAD_SET_INFORMATION,
2720 PsThreadType,
2721 PreviousMode,
2723 NULL);
2725 break;
2726
2727 /* Call the kernel */
2729
2730 /* Dereference the thread */
2732 break;
2733 }
2734
2736 {
2738 PETHREAD ProcThread;
2739
2740 /* Check buffer length */
2742 {
2744 break;
2745 }
2746
2747 /* Use SEH for capture */
2748 _SEH2_TRY
2749 {
2750 /* Get the priority */
2752 }
2754 {
2755 /* Get the exception code */
2758 }
2759 _SEH2_END;
2760
2761 /* Reference the thread */
2763 THREAD_SET_INFORMATION,
2764 PsThreadType,
2765 PreviousMode,
2767 NULL);
2769 break;
2770
2771 /* This is only valid for the current thread */
2773 {
2774 /* Fail */
2777 break;
2778 }
2779
2780 /* Get the process */
2782
2783 /* Loop the threads */
2785 while (ProcThread)
2786 {
2787 /* Acquire rundown */
2789 {
2790 /* Get the TEB */
2792 if (Teb)
2793 {
2794 /* Check if we're in the expansion range */
2796 {
2798 TLS_EXPANSION_SLOTS) - 1)
2799 {
2800 /* Check if we have expansion slots */
2802 if (ExpansionSlots)
2803 {
2804 /* Clear the index */
2806 }
2807 }
2808 }
2809 else
2810 {
2811 /* Clear the index */
2813 }
2814 }
2815
2816 /* Release rundown */
2818 }
2819
2820 /* Go to the next thread */
2822 }
2823
2824 /* Dereference the thread */
2826 break;
2827 }
2828
2830 {
2831 ULONG Break;
2832
2833 /* Check buffer length */
2835 {
2837 break;
2838 }
2839
2840 /* Enter SEH for direct buffer read */
2841 _SEH2_TRY
2842 {
2843 Break = *(PULONG)ThreadInformation;
2844 }
2846 {
2847 /* Get exception code */
2848 Break = 0;
2851 }
2852 _SEH2_END;
2853
2854 /* Setting 'break on termination' requires the SeDebugPrivilege */
2856 {
2857 /* We don't hold the privilege, bail out */
2859 break;
2860 }
2861
2862 /* Reference the thread */
2864 THREAD_SET_INFORMATION,
2865 PsThreadType,
2866 PreviousMode,
2868 NULL);
2870 break;
2871
2872 /* Set or clear the flag */
2873 if (Break)
2874 {
2876 }
2877 else
2878 {
2880 }
2881
2882 /* Dereference the thread */
2884 break;
2885 }
2886
2888 {
2889 /* Check buffer length */
2891 {
2893 break;
2894 }
2895
2896 /* Reference the thread */
2898 THREAD_SET_INFORMATION,
2899 PsThreadType,
2900 PreviousMode,
2902 NULL);
2904 break;
2905
2906 /* Set the flag */
2908
2909 /* Dereference the thread */
2911 break;
2912 }
2913
2914#if (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__)
2916 {
2917 UNICODE_STRING CapturedThreadName;
2918 PUNICODE_STRING NewThreadName;
2919
2920 /* Check buffer length */
2922 {
2924 break;
2925 }
2926
2927 /* Reference the thread.
2928 * NOTE: Win10+ uses THREAD_SET_LIMITED_INFORMATION instead;
2929 * however some tools misuse thread names to perform suspicious
2930 * operations; therefore we try to mess with these by requiring
2931 * a bit more of access rights. */
2933 THREAD_SET_INFORMATION,
2934 PsThreadType,
2935 PreviousMode,
2937 NULL);
2939 break;
2940
2941 /* Probe and capture the thread name */
2943 PreviousMode,
2944 (PUNICODE_STRING)ThreadInformation);
2946 {
2948 break;
2949 }
2950
2951 /* Allocate a new buffer only if the thread name isn't empty
2952 * (REMARK: We only consider Length instead of MaximumLength).
2953 * If empty, just reset the thread name pointer to NULL instead
2954 * of allocating an empty UNICODE_STRING. */
2955 NewThreadName = NULL;
2957 {
2961 if (!NewThreadName)
2962 {
2964 }
2965 else
2966 {
2967 /* Copy the new thread name */
2968 NewThreadName->Length =
2972 CapturedThreadName.Buffer,
2973 CapturedThreadName.Length);
2974 }
2975 }
2976
2977 /* Free the captured string */
2979
2980 /* Replace the original thread name with the new one */
2982 {
2983 PUNICODE_STRING OldThreadName;
2988
2989 /* Free the old thread name */
2990 if (OldThreadName)
2992 }
2993
2994 /* Dereference the thread */
2996 break;
2997 }
2998#endif /* (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__) */
2999
3000 /* Anything else */
3001 default:
3002 /* Not yet implemented */
3003#if DBG
3005#endif
3007 }
3008
3010}
#define LOW_REALTIME_PRIORITY
NTSTATUS NTAPI PsAssignImpersonationToken(IN PETHREAD Thread, IN HANDLE TokenHandle)
Definition: security.c:502
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
Definition: process.c:75
FORCEINLINE VOID PspLockThreadSecurityExclusive(IN PETHREAD Thread)
Definition: ps_x.h:177
FORCEINLINE VOID PspUnlockThreadSecurityExclusive(IN PETHREAD Thread)
Definition: ps_x.h:188
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
Definition: probe.h:142
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
Definition: probe.h:239
Definition: compat.h:836
UCHAR NTAPI KeSetIdealProcessorThread(IN PKTHREAD Thread, IN UCHAR Processor)
Definition: thrdobj.c:1066
LONG NTAPI KeSetBasePriorityThread(IN PKTHREAD Thread, IN LONG Increment)
Definition: thrdobj.c:1157
KPRIORITY NTAPI KeSetPriorityThread(IN PKTHREAD Thread, IN KPRIORITY Priority)
Definition: thrdobj.c:1300
KAFFINITY NTAPI KeSetAffinityThread(IN PKTHREAD Thread, IN KAFFINITY Affinity)
Definition: thrdobj.c:1276
_In_ WDFINTERRUPT _In_ WDF_INTERRUPT_POLICY _In_ WDF_INTERRUPT_PRIORITY Priority
Definition: wdfinterrupt.h:655
Referenced by BaseGetNamedObjectDirectory(), BaseProcessStartup(), CreateProcessAsUserCommon(), CsrRevertToSelf(), DoThreadNameTest(), exec_write_handler(), ImpersonateLoggedOnUser(), init_funcs(), InitFunctionPtrs(), InitializeDeviceData(), MiInitBalancerThread(), NpGetUserNamep(), QuerySetThreadValidator(), RevertToSelf(), RtlpExecuteIoWorkItem(), RtlpExecuteWorkItem(), set_thread_name(), SetThreadAffinityMask(), SetThreadDescription(), SetThreadGroupAffinity(), SetThreadIdealProcessor(), SetThreadInformation(), SetThreadPriority(), SetThreadPriorityBoost(), SetThreadToken(), START_TEST(), test_exec_memory_writes(), test_object_permanence(), test_thread_description(), Test_ThreadHideFromDebuggerClass(), Test_ThreadPriorityClass(), and TlsFree().
◆ PsReferenceProcessFilePointer()
| NTSTATUS NTAPI PsReferenceProcessFilePointer | ( | _In_ PEPROCESS | Process, |
| _Outptr_ PFILE_OBJECT * | FileObject | ||
| ) |
Definition at line 24 of file query.c.
27{
28 PSECTION Section;
29 PAGED_CODE();
30
31 /* Lock the process */
33 {
35 }
36
37 /* Get the section */
38 Section = Process->SectionObject;
39 if (Section)
40 {
41 /* Get the file object and reference it */
44 }
45
46 /* Release the protection */
48
49 /* Return status */
51}
PFILE_OBJECT NTAPI MmGetFileObjectForSection(IN PVOID Section)
Definition: section.c:1546
Definition: mmtypes.h:810
Referenced by NtQueryInformationProcess(), and SeLocateProcessImageName().
