ReactOS 0.4.16-dev-2491-g3dc6630
Macros | Functions | Variables
query.c File Reference
#include <ntoskrnl.h>
#include <debug.h>
Include dependency graph for query.c:

Go to the source code of this file.

Macros

#define NDEBUG
 

Functions

NTSTATUS NTAPI PsReferenceProcessFilePointer (_In_ PEPROCESS Process, _Outptr_ PFILE_OBJECT *FileObject)
 
NTSTATUS NTAPI NtQueryInformationProcess (_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
 
NTSTATUS NTAPI NtSetInformationProcess (_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)
 
NTSTATUS NTAPI NtSetInformationThread (_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength)
 
NTSTATUS NTAPI NtQueryInformationThread (_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)
 

Variables

ULONG PspTraceLevel = 0
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 14 of file query.c.

Function Documentation

◆ NtQueryInformationProcess()

NTSTATUS NTAPI NtQueryInformationProcess ( _In_ HANDLE  ProcessHandle,
_In_ PROCESSINFOCLASS  ProcessInformationClass,
_Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) PVOID  ProcessInformation,
_In_ ULONG  ProcessInformationLength,
_Out_opt_ PULONG  ReturnLength 
)

Definition at line 211 of file query.c.

218{
219 PEPROCESS Process;
220 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
221 NTSTATUS Status;
222 ULONG Length = 0;
223
224 PAGED_CODE();
225
226 /* Validate the information class */
227 Status = DefaultQueryInfoBufferCheck(ProcessInformationClass,
228 PsProcessInfoClass,
229 RTL_NUMBER_OF(PsProcessInfoClass),
230 ICIF_PROBE_READ,
231 ProcessInformation,
232 ProcessInformationLength,
233 ReturnLength,
234 NULL,
235 PreviousMode);
236 if (!NT_SUCCESS(Status))
237 {
238#if DBG
239 DPRINT1("NtQueryInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
240 PspDumpProcessInfoClassName(ProcessInformationClass), Status);
241#endif
242 return Status;
243 }
244
245 if (((ProcessInformationClass == ProcessCookie) ||
246 (ProcessInformationClass == ProcessImageInformation)) &&
247 (ProcessHandle != NtCurrentProcess()))
248 {
249 /*
250 * Retrieving the process cookie is only allowed for the calling process
251 * itself! XP only allows NtCurrentProcess() as process handles even if
252 * a real handle actually represents the current process.
253 */
254 return STATUS_INVALID_PARAMETER;
255 }
256
257 /* Check the information class */
258 switch (ProcessInformationClass)
259 {
260 /* Basic process information */
261 case ProcessBasicInformation:
262 {
263 PPROCESS_BASIC_INFORMATION ProcessBasicInfo = (PPROCESS_BASIC_INFORMATION)ProcessInformation;
264
265 if (ProcessInformationLength != sizeof(PROCESS_BASIC_INFORMATION))
266 {
267 Status = STATUS_INFO_LENGTH_MISMATCH;
268 break;
269 }
270
271 /* Set the return length */
272 Length = sizeof(PROCESS_BASIC_INFORMATION);
273
274 /* Reference the process */
275 Status = ObReferenceObjectByHandle(ProcessHandle,
276 PROCESS_QUERY_INFORMATION,
277 PsProcessType,
278 PreviousMode,
279 (PVOID*)&Process,
280 NULL);
281 if (!NT_SUCCESS(Status)) break;
282
283 /* Protect writes with SEH */
284 _SEH2_TRY
285 {
286 /* Write all the information from the EPROCESS/KPROCESS */
287 ProcessBasicInfo->ExitStatus = Process->ExitStatus;
288 ProcessBasicInfo->PebBaseAddress = Process->Peb;
289 ProcessBasicInfo->AffinityMask = Process->Pcb.Affinity;
290 ProcessBasicInfo->UniqueProcessId = (ULONG_PTR)Process->
291 UniqueProcessId;
292 ProcessBasicInfo->InheritedFromUniqueProcessId =
293 (ULONG_PTR)Process->InheritedFromUniqueProcessId;
294 ProcessBasicInfo->BasePriority = Process->Pcb.BasePriority;
295
296 }
297 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
298 {
299 /* Get exception code */
300 Status = _SEH2_GetExceptionCode();
301 }
302 _SEH2_END;
303
304 /* Dereference the process */
305 ObDereferenceObject(Process);
306 break;
307 }
308
309 /* Process quota limits */
310 case ProcessQuotaLimits:
311 {
312 QUOTA_LIMITS_EX QuotaLimits;
313 BOOLEAN Extended;
314
315 if (ProcessInformationLength != sizeof(QUOTA_LIMITS) &&
316 ProcessInformationLength != sizeof(QUOTA_LIMITS_EX))
317 {
318 Status = STATUS_INFO_LENGTH_MISMATCH;
319 break;
320 }
321
322 /* Set the return length */
323 Length = ProcessInformationLength;
324 Extended = (Length == sizeof(QUOTA_LIMITS_EX));
325
326 /* Reference the process */
327 Status = ObReferenceObjectByHandle(ProcessHandle,
328 PROCESS_QUERY_INFORMATION,
329 PsProcessType,
330 PreviousMode,
331 (PVOID*)&Process,
332 NULL);
333 if (!NT_SUCCESS(Status)) break;
334
335 /* Indicate success */
336 Status = STATUS_SUCCESS;
337
338 RtlZeroMemory(&QuotaLimits, sizeof(QuotaLimits));
339
340 /* Get max/min working set sizes */
341 QuotaLimits.MaximumWorkingSetSize =
342 Process->Vm.MaximumWorkingSetSize << PAGE_SHIFT;
343 QuotaLimits.MinimumWorkingSetSize =
344 Process->Vm.MinimumWorkingSetSize << PAGE_SHIFT;
345
346 /* Get default time limits */
347 QuotaLimits.TimeLimit.QuadPart = -1LL;
348
349 /* Is quota block a default one? */
350 if (Process->QuotaBlock == &PspDefaultQuotaBlock)
351 {
352 /* Get default pools and pagefile limits */
353 QuotaLimits.PagedPoolLimit = (SIZE_T)-1;
354 QuotaLimits.NonPagedPoolLimit = (SIZE_T)-1;
355 QuotaLimits.PagefileLimit = (SIZE_T)-1;
356 }
357 else
358 {
359 /* Get limits from non-default quota block */
360 QuotaLimits.PagedPoolLimit =
361 Process->QuotaBlock->QuotaEntry[PsPagedPool].Limit;
362 QuotaLimits.NonPagedPoolLimit =
363 Process->QuotaBlock->QuotaEntry[PsNonPagedPool].Limit;
364 QuotaLimits.PagefileLimit =
365 Process->QuotaBlock->QuotaEntry[PsPageFile].Limit;
366 }
367
368 /* Get additional information, if needed */
369 if (Extended)
370 {
371 QuotaLimits.Flags |= (Process->Vm.Flags.MaximumWorkingSetHard ?
372 QUOTA_LIMITS_HARDWS_MAX_ENABLE : QUOTA_LIMITS_HARDWS_MAX_DISABLE);
373 QuotaLimits.Flags |= (Process->Vm.Flags.MinimumWorkingSetHard ?
374 QUOTA_LIMITS_HARDWS_MIN_ENABLE : QUOTA_LIMITS_HARDWS_MIN_DISABLE);
375
376 /* FIXME: Get the correct information */
377 //QuotaLimits.WorkingSetLimit = (SIZE_T)-1; // Not used on Win2k3, it is set to 0
378 QuotaLimits.CpuRateLimit.RateData = 0;
379 }
380
381 /* Protect writes with SEH */
382 _SEH2_TRY
383 {
384 RtlCopyMemory(ProcessInformation, &QuotaLimits, Length);
385 }
386 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
387 {
388 /* Get exception code */
389 Status = _SEH2_GetExceptionCode();
390 }
391 _SEH2_END;
392
393 /* Dereference the process */
394 ObDereferenceObject(Process);
395 break;
396 }
397
398 case ProcessIoCounters:
399 {
400 PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation;
401 PROCESS_VALUES ProcessValues;
402
403 if (ProcessInformationLength != sizeof(IO_COUNTERS))
404 {
405 Status = STATUS_INFO_LENGTH_MISMATCH;
406 break;
407 }
408
409 Length = sizeof(IO_COUNTERS);
410
411 /* Reference the process */
412 Status = ObReferenceObjectByHandle(ProcessHandle,
413 PROCESS_QUERY_INFORMATION,
414 PsProcessType,
415 PreviousMode,
416 (PVOID*)&Process,
417 NULL);
418 if (!NT_SUCCESS(Status)) break;
419
420 /* Query IO counters from the process */
421 KeQueryValuesProcess(&Process->Pcb, &ProcessValues);
422
423 _SEH2_TRY
424 {
425 RtlCopyMemory(IoCounters, &ProcessValues.IoInfo, sizeof(IO_COUNTERS));
426 }
427 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
428 {
429 /* Ignore exception */
430 }
431 _SEH2_END;
432
433 /* Set status to success in any case */
434 Status = STATUS_SUCCESS;
435
436 /* Dereference the process */
437 ObDereferenceObject(Process);
438 break;
439 }
440
441 /* Timing */
442 case ProcessTimes:
443 {
444 PKERNEL_USER_TIMES ProcessTime = (PKERNEL_USER_TIMES)ProcessInformation;
445 ULONG UserTime, KernelTime;
446
447 /* Set the return length */
448 if (ProcessInformationLength != sizeof(KERNEL_USER_TIMES))
449 {
450 Status = STATUS_INFO_LENGTH_MISMATCH;
451 break;
452 }
453
454 Length = sizeof(KERNEL_USER_TIMES);
455
456 /* Reference the process */
457 Status = ObReferenceObjectByHandle(ProcessHandle,
458 PROCESS_QUERY_INFORMATION,
459 PsProcessType,
460 PreviousMode,
461 (PVOID*)&Process,
462 NULL);
463 if (!NT_SUCCESS(Status)) break;
464
465 /* Protect writes with SEH */
466 _SEH2_TRY
467 {
468 /* Copy time information from EPROCESS/KPROCESS */
469 KernelTime = KeQueryRuntimeProcess(&Process->Pcb, &UserTime);
470 ProcessTime->CreateTime = Process->CreateTime;
471 ProcessTime->UserTime.QuadPart = (LONGLONG)UserTime * KeMaximumIncrement;
472 ProcessTime->KernelTime.QuadPart = (LONGLONG)KernelTime * KeMaximumIncrement;
473 ProcessTime->ExitTime = Process->ExitTime;
474 }
475 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
476 {
477 /* Get exception code */
478 Status = _SEH2_GetExceptionCode();
479 }
480 _SEH2_END;
481
482 /* Dereference the process */
483 ObDereferenceObject(Process);
484 break;
485 }
486
487 /* Process Debug Port */
488 case ProcessDebugPort:
489
490 if (ProcessInformationLength != sizeof(HANDLE))
491 {
492 Status = STATUS_INFO_LENGTH_MISMATCH;
493 break;
494 }
495
496 /* Set the return length */
497 Length = sizeof(HANDLE);
498
499 /* Reference the process */
500 Status = ObReferenceObjectByHandle(ProcessHandle,
501 PROCESS_QUERY_INFORMATION,
502 PsProcessType,
503 PreviousMode,
504 (PVOID*)&Process,
505 NULL);
506 if (!NT_SUCCESS(Status)) break;
507
508 /* Protect write with SEH */
509 _SEH2_TRY
510 {
511 /* Return whether or not we have a debug port */
512 *(PHANDLE)ProcessInformation = (Process->DebugPort ?
513 (HANDLE)-1 : NULL);
514 }
515 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
516 {
517 /* Get exception code */
518 Status = _SEH2_GetExceptionCode();
519 }
520 _SEH2_END;
521
522 /* Dereference the process */
523 ObDereferenceObject(Process);
524 break;
525
526 case ProcessHandleCount:
527 {
528 ULONG HandleCount;
529
530 if (ProcessInformationLength != sizeof(ULONG))
531 {
532 Status = STATUS_INFO_LENGTH_MISMATCH;
533 break;
534 }
535
536 /* Set the return length*/
537 Length = sizeof(ULONG);
538
539 /* Reference the process */
540 Status = ObReferenceObjectByHandle(ProcessHandle,
541 PROCESS_QUERY_INFORMATION,
542 PsProcessType,
543 PreviousMode,
544 (PVOID*)&Process,
545 NULL);
546 if (!NT_SUCCESS(Status)) break;
547
548 /* Count the number of handles this process has */
549 HandleCount = ObGetProcessHandleCount(Process);
550
551 /* Protect write in SEH */
552 _SEH2_TRY
553 {
554 /* Return the count of handles */
555 *(PULONG)ProcessInformation = HandleCount;
556 }
557 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
558 {
559 /* Get the exception code */
560 Status = _SEH2_GetExceptionCode();
561 }
562 _SEH2_END;
563
564 /* Dereference the process */
565 ObDereferenceObject(Process);
566 break;
567 }
568
569 /* Session ID for the process */
570 case ProcessSessionInformation:
571 {
572 PPROCESS_SESSION_INFORMATION SessionInfo = (PPROCESS_SESSION_INFORMATION)ProcessInformation;
573
574 if (ProcessInformationLength != sizeof(PROCESS_SESSION_INFORMATION))
575 {
576 Status = STATUS_INFO_LENGTH_MISMATCH;
577 break;
578 }
579
580 /* Set the return length*/
581 Length = sizeof(PROCESS_SESSION_INFORMATION);
582
583 /* Reference the process */
584 Status = ObReferenceObjectByHandle(ProcessHandle,
585 PROCESS_QUERY_INFORMATION,
586 PsProcessType,
587 PreviousMode,
588 (PVOID*)&Process,
589 NULL);
590 if (!NT_SUCCESS(Status)) break;
591
592 /* Enter SEH for write safety */
593 _SEH2_TRY
594 {
595 /* Write back the Session ID */
596 SessionInfo->SessionId = PsGetProcessSessionId(Process);
597 }
598 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
599 {
600 /* Get the exception code */
601 Status = _SEH2_GetExceptionCode();
602 }
603 _SEH2_END;
604
605 /* Dereference the process */
606 ObDereferenceObject(Process);
607 break;
608 }
609
610 /* Virtual Memory Statistics */
611 case ProcessVmCounters:
612 {
613 PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation;
614
615 /* Validate the input length */
616 if ((ProcessInformationLength != sizeof(VM_COUNTERS)) &&
617 (ProcessInformationLength != sizeof(VM_COUNTERS_EX)))
618 {
619 Status = STATUS_INFO_LENGTH_MISMATCH;
620 break;
621 }
622
623 /* Reference the process */
624 Status = ObReferenceObjectByHandle(ProcessHandle,
625 PROCESS_QUERY_INFORMATION,
626 PsProcessType,
627 PreviousMode,
628 (PVOID*)&Process,
629 NULL);
630 if (!NT_SUCCESS(Status)) break;
631
632 /* Enter SEH for write safety */
633 _SEH2_TRY
634 {
635 /* Return data from EPROCESS */
636 VmCounters->PeakVirtualSize = Process->PeakVirtualSize;
637 VmCounters->VirtualSize = Process->VirtualSize;
638 VmCounters->PageFaultCount = Process->Vm.PageFaultCount;
639 VmCounters->PeakWorkingSetSize = Process->Vm.PeakWorkingSetSize;
640 VmCounters->WorkingSetSize = Process->Vm.WorkingSetSize;
641 VmCounters->QuotaPeakPagedPoolUsage = Process->QuotaPeak[PsPagedPool];
642 VmCounters->QuotaPagedPoolUsage = Process->QuotaUsage[PsPagedPool];
643 VmCounters->QuotaPeakNonPagedPoolUsage = Process->QuotaPeak[PsNonPagedPool];
644 VmCounters->QuotaNonPagedPoolUsage = Process->QuotaUsage[PsNonPagedPool];
645 VmCounters->PagefileUsage = Process->QuotaUsage[PsPageFile] << PAGE_SHIFT;
646 VmCounters->PeakPagefileUsage = Process->QuotaPeak[PsPageFile] << PAGE_SHIFT;
647 //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
648 //
649
650 /* Set the return length */
651 Length = ProcessInformationLength;
652 }
653 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
654 {
655 /* Get the exception code */
656 Status = _SEH2_GetExceptionCode();
657 }
658 _SEH2_END;
659
660 /* Dereference the process */
661 ObDereferenceObject(Process);
662 break;
663 }
664
665 /* Hard Error Processing Mode */
666 case ProcessDefaultHardErrorMode:
667
668 if (ProcessInformationLength != sizeof(ULONG))
669 {
670 Status = STATUS_INFO_LENGTH_MISMATCH;
671 break;
672 }
673
674 /* Set the return length*/
675 Length = sizeof(ULONG);
676
677 /* Reference the process */
678 Status = ObReferenceObjectByHandle(ProcessHandle,
679 PROCESS_QUERY_INFORMATION,
680 PsProcessType,
681 PreviousMode,
682 (PVOID*)&Process,
683 NULL);
684 if (!NT_SUCCESS(Status)) break;
685
686 /* Enter SEH for writing back data */
687 _SEH2_TRY
688 {
689 /* Write the current processing mode */
690 *(PULONG)ProcessInformation = Process->
691 DefaultHardErrorProcessing;
692 }
693 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
694 {
695 /* Get the exception code */
696 Status = _SEH2_GetExceptionCode();
697 }
698 _SEH2_END;
699
700 /* Dereference the process */
701 ObDereferenceObject(Process);
702 break;
703
704 /* Priority Boosting status */
705 case ProcessPriorityBoost:
706
707 if (ProcessInformationLength != sizeof(ULONG))
708 {
709 Status = STATUS_INFO_LENGTH_MISMATCH;
710 break;
711 }
712
713 /* Set the return length */
714 Length = sizeof(ULONG);
715
716 /* Reference the process */
717 Status = ObReferenceObjectByHandle(ProcessHandle,
718 PROCESS_QUERY_INFORMATION,
719 PsProcessType,
720 PreviousMode,
721 (PVOID*)&Process,
722 NULL);
723 if (!NT_SUCCESS(Status)) break;
724
725 /* Enter SEH for writing back data */
726 _SEH2_TRY
727 {
728 /* Return boost status */
729 *(PULONG)ProcessInformation = Process->Pcb.DisableBoost ?
730 TRUE : FALSE;
731 }
732 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
733 {
734 /* Get the exception code */
735 Status = _SEH2_GetExceptionCode();
736 }
737 _SEH2_END;
738
739 /* Dereference the process */
740 ObDereferenceObject(Process);
741 break;
742
743 /* DOS Device Map */
744 case ProcessDeviceMap:
745 {
746 ULONG Flags;
747
748 if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX))
749 {
750 /* Protect read in SEH */
751 _SEH2_TRY
752 {
753 PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
754
755 Flags = DeviceMapEx->Flags;
756 }
757 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
758 {
759 /* Get the exception code */
760 Status = _SEH2_GetExceptionCode();
761 _SEH2_YIELD(break);
762 }
763 _SEH2_END;
764
765 /* Only one flag is supported and it needs LUID mappings */
766 if ((Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 ||
767 !ObIsLUIDDeviceMapsEnabled())
768 {
769 Status = STATUS_INVALID_PARAMETER;
770 break;
771 }
772 }
773 else
774 {
775 /* This has to be the size of the Query union field for x64 compatibility! */
776 if (ProcessInformationLength != RTL_FIELD_SIZE(PROCESS_DEVICEMAP_INFORMATION, Query))
777 {
778 Status = STATUS_INFO_LENGTH_MISMATCH;
779 break;
780 }
781
782 /* No flags for standard call */
783 Flags = 0;
784 }
785
786 /* Set the return length */
787 Length = ProcessInformationLength;
788
789 /* Reference the process */
790 Status = ObReferenceObjectByHandle(ProcessHandle,
791 PROCESS_QUERY_INFORMATION,
792 PsProcessType,
793 PreviousMode,
794 (PVOID*)&Process,
795 NULL);
796 if (!NT_SUCCESS(Status)) break;
797
798 /* Query the device map information */
799 Status = ObQueryDeviceMapInformation(Process,
800 ProcessInformation,
801 Flags);
802
803 /* Dereference the process */
804 ObDereferenceObject(Process);
805 break;
806 }
807
808 /* Priority class */
809 case ProcessPriorityClass:
810 {
811 PPROCESS_PRIORITY_CLASS PsPriorityClass = (PPROCESS_PRIORITY_CLASS)ProcessInformation;
812
813 if (ProcessInformationLength != sizeof(PROCESS_PRIORITY_CLASS))
814 {
815 Status = STATUS_INFO_LENGTH_MISMATCH;
816 break;
817 }
818
819 /* Set the return length*/
820 Length = sizeof(PROCESS_PRIORITY_CLASS);
821
822 /* Reference the process */
823 Status = ObReferenceObjectByHandle(ProcessHandle,
824 PROCESS_QUERY_INFORMATION,
825 PsProcessType,
826 PreviousMode,
827 (PVOID*)&Process,
828 NULL);
829 if (!NT_SUCCESS(Status)) break;
830
831 /* Enter SEH for writing back data */
832 _SEH2_TRY
833 {
834 /* Return current priority class */
835 PsPriorityClass->PriorityClass = Process->PriorityClass;
836 PsPriorityClass->Foreground = FALSE;
837 }
838 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
839 {
840 /* Get the exception code */
841 Status = _SEH2_GetExceptionCode();
842 }
843 _SEH2_END;
844
845 /* Dereference the process */
846 ObDereferenceObject(Process);
847 break;
848 }
849
850 case ProcessImageFileName:
851 {
852 PUNICODE_STRING ImageName;
853
854 /* Reference the process */
855 Status = ObReferenceObjectByHandle(ProcessHandle,
856 PROCESS_QUERY_INFORMATION,
857 PsProcessType,
858 PreviousMode,
859 (PVOID*)&Process,
860 NULL);
861 if (!NT_SUCCESS(Status)) break;
862
863 /* Get the image path */
864 Status = SeLocateProcessImageName(Process, &ImageName);
865 if (NT_SUCCESS(Status))
866 {
867 /* Set the return length */
868 Length = ImageName->MaximumLength +
869 sizeof(OBJECT_NAME_INFORMATION);
870
871 /* Make sure it's large enough */
872 if (Length <= ProcessInformationLength)
873 {
874 /* Enter SEH to protect write */
875 _SEH2_TRY
876 {
877 /* Copy it */
878 RtlCopyMemory(ProcessInformation,
879 ImageName,
880 Length);
881
882 /* Update pointer */
883 ((PUNICODE_STRING)ProcessInformation)->Buffer =
884 (PWSTR)((PUNICODE_STRING)ProcessInformation + 1);
885 }
886 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
887 {
888 /* Get the exception code */
889 Status = _SEH2_GetExceptionCode();
890 }
891 _SEH2_END;
892 }
893 else
894 {
895 /* Buffer too small */
896 Status = STATUS_INFO_LENGTH_MISMATCH;
897 }
898
899 /* Free the image path */
900 ExFreePoolWithTag(ImageName, TAG_SEPA);
901 }
902 /* Dereference the process */
903 ObDereferenceObject(Process);
904 break;
905 }
906
907#if (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
908 case ProcessImageFileNameWin32:
909 {
910 PFILE_OBJECT FileObject;
911 POBJECT_NAME_INFORMATION ObjectNameInformation;
912
913 /* Reference the process */
914 Status = ObReferenceObjectByHandle(ProcessHandle,
915 // FIXME: Use PROCESS_QUERY_LIMITED_INFORMATION when implemented
916 PROCESS_QUERY_INFORMATION,
917 PsProcessType,
918 PreviousMode,
919 (PVOID*)&Process,
920 NULL);
921 if (!NT_SUCCESS(Status))
922 {
923 break;
924 }
925
926 /* Get the image path */
927 Status = PsReferenceProcessFilePointer(Process, &FileObject);
928 ObDereferenceObject(Process);
929 if (!NT_SUCCESS(Status))
930 {
931 break;
932 }
933 Status = IoQueryFileDosDeviceName(FileObject, &ObjectNameInformation);
934 ObDereferenceObject(FileObject);
935 if (!NT_SUCCESS(Status))
936 {
937 break;
938 }
939
940 /* Determine return length and output */
941 Length = sizeof(UNICODE_STRING) + ObjectNameInformation->Name.MaximumLength;
942 if (Length <= ProcessInformationLength)
943 {
944 _SEH2_TRY
945 {
946 PUNICODE_STRING ImageName = (PUNICODE_STRING)ProcessInformation;
947 ImageName->Length = ObjectNameInformation->Name.Length;
948 ImageName->MaximumLength = ObjectNameInformation->Name.MaximumLength;
949 if (ObjectNameInformation->Name.MaximumLength)
950 {
951 ImageName->Buffer = (PWSTR)(ImageName + 1);
952 RtlCopyMemory(ImageName->Buffer,
953 ObjectNameInformation->Name.Buffer,
954 ObjectNameInformation->Name.MaximumLength);
955 }
956 else
957 {
958 ASSERT(ImageName->Length == 0);
959 ImageName->Buffer = NULL;
960 }
961 }
962 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
963 {
964 Status = _SEH2_GetExceptionCode();
965 }
966 _SEH2_END;
967 }
968 else
969 {
970 Status = STATUS_INFO_LENGTH_MISMATCH;
971 }
972 ExFreePool(ObjectNameInformation);
973
974 break;
975 }
976#endif /* (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA) */
977
978 case ProcessDebugFlags:
979
980 if (ProcessInformationLength != sizeof(ULONG))
981 {
982 Status = STATUS_INFO_LENGTH_MISMATCH;
983 break;
984 }
985
986 /* Set the return length*/
987 Length = sizeof(ULONG);
988
989 /* Reference the process */
990 Status = ObReferenceObjectByHandle(ProcessHandle,
991 PROCESS_QUERY_INFORMATION,
992 PsProcessType,
993 PreviousMode,
994 (PVOID*)&Process,
995 NULL);
996 if (!NT_SUCCESS(Status)) break;
997
998 /* Enter SEH for writing back data */
999 _SEH2_TRY
1000 {
1001 /* Return the debug flag state */
1002 *(PULONG)ProcessInformation = Process->NoDebugInherit ? 0 : 1;
1003 }
1004 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1005 {
1006 /* Get the exception code */
1007 Status = _SEH2_GetExceptionCode();
1008 }
1009 _SEH2_END;
1010
1011 /* Dereference the process */
1012 ObDereferenceObject(Process);
1013 break;
1014
1015 case ProcessBreakOnTermination:
1016
1017 if (ProcessInformationLength != sizeof(ULONG))
1018 {
1019 Status = STATUS_INFO_LENGTH_MISMATCH;
1020 break;
1021 }
1022
1023 /* Set the return length */
1024 Length = sizeof(ULONG);
1025
1026 /* Reference the process */
1027 Status = ObReferenceObjectByHandle(ProcessHandle,
1028 PROCESS_QUERY_INFORMATION,
1029 PsProcessType,
1030 PreviousMode,
1031 (PVOID*)&Process,
1032 NULL);
1033 if (!NT_SUCCESS(Status)) break;
1034
1035 /* Enter SEH for writing back data */
1036 _SEH2_TRY
1037 {
1038 /* Return the BreakOnTermination state */
1039 *(PULONG)ProcessInformation = Process->BreakOnTermination;
1040 }
1041 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1042 {
1043 /* Get the exception code */
1044 Status = _SEH2_GetExceptionCode();
1045 }
1046 _SEH2_END;
1047
1048 /* Dereference the process */
1049 ObDereferenceObject(Process);
1050 break;
1051
1052 /* Per-process security cookie */
1053 case ProcessCookie:
1054 {
1055 ULONG Cookie;
1056
1057 if (ProcessInformationLength != sizeof(ULONG))
1058 {
1059 /* Length size wrong, bail out */
1060 Status = STATUS_INFO_LENGTH_MISMATCH;
1061 break;
1062 }
1063
1064 /* Get the current process and cookie */
1065 Process = PsGetCurrentProcess();
1066 Cookie = Process->Cookie;
1067 if (!Cookie)
1068 {
1069 LARGE_INTEGER SystemTime;
1070 ULONG NewCookie;
1071 PKPRCB Prcb;
1072
1073 /* Generate a new cookie */
1074 KeQuerySystemTime(&SystemTime);
1075 Prcb = KeGetCurrentPrcb();
1076 NewCookie = Prcb->KeSystemCalls ^ Prcb->InterruptTime ^
1077 SystemTime.u.LowPart ^ SystemTime.u.HighPart;
1078
1079 /* Set the new cookie or return the current one */
1080 Cookie = InterlockedCompareExchange((LONG*)&Process->Cookie,
1081 NewCookie,
1082 Cookie);
1083 if (!Cookie) Cookie = NewCookie;
1084
1085 /* Set the return length */
1086 Length = sizeof(ULONG);
1087 }
1088
1089 /* Indicate success */
1090 Status = STATUS_SUCCESS;
1091
1092 /* Enter SEH to protect write */
1093 _SEH2_TRY
1094 {
1095 /* Write back the cookie */
1096 *(PULONG)ProcessInformation = Cookie;
1097 }
1098 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1099 {
1100 /* Get the exception code */
1101 Status = _SEH2_GetExceptionCode();
1102 }
1103 _SEH2_END;
1104 break;
1105 }
1106
1107 case ProcessImageInformation:
1108
1109 if (ProcessInformationLength != sizeof(SECTION_IMAGE_INFORMATION))
1110 {
1111 /* Break out */
1112 Status = STATUS_INFO_LENGTH_MISMATCH;
1113 break;
1114 }
1115
1116 /* Set the length required and validate it */
1117 Length = sizeof(SECTION_IMAGE_INFORMATION);
1118
1119 /* Indicate success */
1120 Status = STATUS_SUCCESS;
1121
1122 /* Enter SEH to protect write */
1123 _SEH2_TRY
1124 {
1125 MmGetImageInformation((PSECTION_IMAGE_INFORMATION)ProcessInformation);
1126 }
1127 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1128 {
1129 /* Get the exception code */
1130 Status = _SEH2_GetExceptionCode();
1131 }
1132 _SEH2_END;
1133 break;
1134
1135 case ProcessDebugObjectHandle:
1136 {
1137 HANDLE DebugPort = NULL;
1138
1139 if (ProcessInformationLength != sizeof(HANDLE))
1140 {
1141 Status = STATUS_INFO_LENGTH_MISMATCH;
1142 break;
1143 }
1144
1145 /* Set the return length */
1146 Length = sizeof(HANDLE);
1147
1148 /* Reference the process */
1149 Status = ObReferenceObjectByHandle(ProcessHandle,
1150 PROCESS_QUERY_INFORMATION,
1151 PsProcessType,
1152 PreviousMode,
1153 (PVOID*)&Process,
1154 NULL);
1155 if (!NT_SUCCESS(Status)) break;
1156
1157 /* Get the debug port. Continue even if this fails. */
1158 Status = DbgkOpenProcessDebugPort(Process, PreviousMode, &DebugPort);
1159
1160 /* Let go of the process */
1161 ObDereferenceObject(Process);
1162
1163 /* Protect write in SEH */
1164 _SEH2_TRY
1165 {
1166 /* Return debug port's handle */
1167 *(PHANDLE)ProcessInformation = DebugPort;
1168 }
1169 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1170 {
1171 if (DebugPort)
1172 ObCloseHandle(DebugPort, PreviousMode);
1173
1174 /* Get the exception code.
1175 * Note: This overwrites any previous failure status. */
1176 Status = _SEH2_GetExceptionCode();
1177 }
1178 _SEH2_END;
1179 break;
1180 }
1181
1182 case ProcessHandleTracing:
1183 DPRINT1("Handle tracing not implemented: %lu\n", ProcessInformationClass);
1184 Status = STATUS_NOT_IMPLEMENTED;
1185 break;
1186
1187 case ProcessLUIDDeviceMapsEnabled:
1188
1189 if (ProcessInformationLength != sizeof(ULONG))
1190 {
1191 Status = STATUS_INFO_LENGTH_MISMATCH;
1192 break;
1193 }
1194
1195 /* Set the return length */
1196 Length = sizeof(ULONG);
1197
1198 /* Indicate success */
1199 Status = STATUS_SUCCESS;
1200
1201 /* Protect write in SEH */
1202 _SEH2_TRY
1203 {
1204 /* Query Ob */
1205 *(PULONG)ProcessInformation = ObIsLUIDDeviceMapsEnabled();
1206 }
1207 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1208 {
1209 /* Get the exception code */
1210 Status = _SEH2_GetExceptionCode();
1211 }
1212 _SEH2_END;
1213 break;
1214
1215 case ProcessWx86Information:
1216
1217 if (ProcessInformationLength != sizeof(ULONG))
1218 {
1219 Status = STATUS_INFO_LENGTH_MISMATCH;
1220 break;
1221 }
1222
1223 /* Set the return length */
1224 Length = sizeof(ULONG);
1225
1226 /* Reference the process */
1227 Status = ObReferenceObjectByHandle(ProcessHandle,
1228 PROCESS_QUERY_INFORMATION,
1229 PsProcessType,
1230 PreviousMode,
1231 (PVOID*)&Process,
1232 NULL);
1233 if (!NT_SUCCESS(Status)) break;
1234
1235 /* Protect write in SEH */
1236 _SEH2_TRY
1237 {
1238 /* Return if the flag is set */
1239 *(PULONG)ProcessInformation = (ULONG)Process->VdmAllowed;
1240 }
1241 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1242 {
1243 /* Get the exception code */
1244 Status = _SEH2_GetExceptionCode();
1245 }
1246 _SEH2_END;
1247
1248 /* Dereference the process */
1249 ObDereferenceObject(Process);
1250 break;
1251
1252 case ProcessWow64Information:
1253 {
1254 ULONG_PTR Wow64 = 0;
1255
1256 if (ProcessInformationLength != sizeof(ULONG_PTR))
1257 {
1258 Status = STATUS_INFO_LENGTH_MISMATCH;
1259 break;
1260 }
1261
1262 /* Set the return length */
1263 Length = sizeof(ULONG_PTR);
1264
1265 /* Reference the process */
1266 Status = ObReferenceObjectByHandle(ProcessHandle,
1267 PROCESS_QUERY_INFORMATION,
1268 PsProcessType,
1269 PreviousMode,
1270 (PVOID*)&Process,
1271 NULL);
1272 if (!NT_SUCCESS(Status)) break;
1273
1274#ifdef _WIN64
1275 /* Make sure the process isn't dying */
1276 if (ExAcquireRundownProtection(&Process->RundownProtect))
1277 {
1278 /* Get the WOW64 process structure */
1279 Wow64 = (ULONG_PTR)Process->Wow64Process;
1280 /* Release the lock */
1281 ExReleaseRundownProtection(&Process->RundownProtect);
1282 }
1283#endif
1284
1285 /* Dereference the process */
1286 ObDereferenceObject(Process);
1287
1288 /* Protect write with SEH */
1289 _SEH2_TRY
1290 {
1291 /* Return the Wow64 process information */
1292 *(PULONG_PTR)ProcessInformation = Wow64;
1293 }
1294 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1295 {
1296 /* Get exception code */
1297 Status = _SEH2_GetExceptionCode();
1298 }
1299 _SEH2_END;
1300 break;
1301 }
1302
1303 case ProcessExecuteFlags:
1304 {
1305 ULONG ExecuteOptions = 0;
1306
1307 if (ProcessInformationLength != sizeof(ULONG))
1308 {
1309 Status = STATUS_INFO_LENGTH_MISMATCH;
1310 break;
1311 }
1312
1313 /* Set the return length */
1314 Length = sizeof(ULONG);
1315
1316 if (ProcessHandle != NtCurrentProcess())
1317 {
1318 Status = STATUS_INVALID_PARAMETER;
1319 break;
1320 }
1321
1322 /* Get the options */
1323 Status = MmGetExecuteOptions(&ExecuteOptions);
1324 if (NT_SUCCESS(Status))
1325 {
1326 /* Protect write with SEH */
1327 _SEH2_TRY
1328 {
1329 /* Return them */
1330 *(PULONG)ProcessInformation = ExecuteOptions;
1331 }
1332 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1333 {
1334 /* Get exception code */
1335 Status = _SEH2_GetExceptionCode();
1336 }
1337 _SEH2_END;
1338 }
1339 break;
1340 }
1341
1342 case ProcessLdtInformation:
1343 DPRINT1("VDM/16-bit not implemented: %lu\n", ProcessInformationClass);
1344 Status = STATUS_NOT_IMPLEMENTED;
1345 break;
1346
1347 case ProcessWorkingSetWatch:
1348 DPRINT1("WS Watch not implemented: %lu\n", ProcessInformationClass);
1349 Status = STATUS_NOT_IMPLEMENTED;
1350 break;
1351
1352 case ProcessPooledUsageAndLimits:
1353 DPRINT1("Pool limits not implemented: %lu\n", ProcessInformationClass);
1354 Status = STATUS_NOT_IMPLEMENTED;
1355 break;
1356
1357 /* Not supported by Server 2003 */
1358 default:
1359#if DBG
1360 DPRINT1("Unsupported info class: %s\n", PspDumpProcessInfoClassName(ProcessInformationClass));
1361#endif
1362 Status = STATUS_INVALID_INFO_CLASS;
1363 }
1364
1365 /* Check if caller wants the return length and if there is one */
1366 if (ReturnLength != NULL && Length != 0)
1367 {
1368 /* Protect write with SEH */
1369 _SEH2_TRY
1370 {
1371 *ReturnLength = Length;
1372 }
1373 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1374 {
1375 /* Get exception code.
1376 * Note: This overwrites any previous failure status. */
1377 Status = _SEH2_GetExceptionCode();
1378 }
1379 _SEH2_END;
1380 }
1381
1382 return Status;
1383}
PAGED_CODE
#define PAGED_CODE()
Definition: Bus_PDO_EvalMethod.c:89
ObjectNameInformation
@ ObjectNameInformation
Definition: DriverTester.h:55
ReturnLength
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
Definition: KdSystemDebugControl.c:34
PreviousMode
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
Definition: KdSystemDebugControl.c:35
RTL_NUMBER_OF
#define RTL_NUMBER_OF(x)
Definition: RtlRegistry.c:12
BOOLEAN
unsigned char BOOLEAN
Definition: actypes.h:127
NTSTATUS
LONG NTSTATUS
Definition: precomp.h:26
DPRINT1
#define DPRINT1
Definition: precomp.h:8
Query
BOOL Query(LPCTSTR *ServiceArgs, DWORD ArgCount, BOOL bExtended)
Definition: query.c:292
ProcessDebugPort
@ ProcessDebugPort
Definition: cicbase.cpp:64
ProcessBreakOnTermination
@ ProcessBreakOnTermination
Definition: cicbase.cpp:67
ProcessBasicInformation
@ ProcessBasicInformation
Definition: cicbase.cpp:63
ProcessWow64Information
@ ProcessWow64Information
Definition: cicbase.cpp:65
ProcessImageFileName
@ ProcessImageFileName
Definition: cicbase.cpp:66
STATUS_NOT_IMPLEMENTED
#define STATUS_NOT_IMPLEMENTED
Definition: d3dkmdt.h:42
DbgkOpenProcessDebugPort
NTSTATUS NTAPI DbgkOpenProcessDebugPort(IN PEPROCESS Process, IN KPROCESSOR_MODE PreviousMode, OUT HANDLE *DebugHandle)
Definition: dbgkobj.c:1526
NULL
#define NULL
Definition: types.h:112
TRUE
#define TRUE
Definition: types.h:120
FALSE
#define FALSE
Definition: types.h:117
NT_SUCCESS
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:33
ULONG_PTR
#define ULONG_PTR
Definition: config.h:101
PUNICODE_STRING
UNICODE_STRING * PUNICODE_STRING
Definition: env_spec_w32.h:373
PAGE_SHIFT
#define PAGE_SHIFT
Definition: env_spec_w32.h:45
KeQuerySystemTime
#define KeQuerySystemTime(t)
Definition: env_spec_w32.h:570
ExFreePool
#define ExFreePool(addr)
Definition: env_spec_w32.h:352
UNICODE_STRING
struct _UNICODE_STRING UNICODE_STRING
ExReleaseRundownProtection
#define ExReleaseRundownProtection
Definition: ex.h:139
ExGetPreviousMode
#define ExGetPreviousMode
Definition: ex.h:143
ExAcquireRundownProtection
#define ExAcquireRundownProtection
Definition: ex.h:138
Process
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
Definition: fsrtlfuncs.h:223
Status
Status
Definition: gdiplustypes.h:25
ICIF_PROBE_READ
#define ICIF_PROBE_READ
Definition: icif.h:25
PROCESS_PRIORITY_CLASS
struct _PROCESS_PRIORITY_CLASS PROCESS_PRIORITY_CLASS
PROCESS_QUERY_INFORMATION
#define PROCESS_QUERY_INFORMATION
Definition: pstypes.h:167
PPROCESS_PRIORITY_CLASS
struct _PROCESS_PRIORITY_CLASS * PPROCESS_PRIORITY_CLASS
PsNonPagedPool
@ PsNonPagedPool
Definition: pstypes.h:1110
PsPageFile
@ PsPageFile
Definition: pstypes.h:1112
PsPagedPool
@ PsPagedPool
Definition: pstypes.h:1111
EXCEPTION_EXECUTE_HANDLER
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:90
QUOTA_LIMITS_HARDWS_MIN_DISABLE
#define QUOTA_LIMITS_HARDWS_MIN_DISABLE
PROCESS_LUID_DOSDEVICES_ONLY
#define PROCESS_LUID_DOSDEVICES_ONLY
Definition: pstypes.h:228
IO_COUNTERS
struct _IO_COUNTERS IO_COUNTERS
PROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION PROCESS_SESSION_INFORMATION
PPROCESS_SESSION_INFORMATION
struct _PROCESS_SESSION_INFORMATION * PPROCESS_SESSION_INFORMATION
QUOTA_LIMITS_HARDWS_MAX_DISABLE
#define QUOTA_LIMITS_HARDWS_MAX_DISABLE
QUOTA_LIMITS_EX
struct _QUOTA_LIMITS_EX QUOTA_LIMITS_EX
QUOTA_LIMITS_HARDWS_MAX_ENABLE
#define QUOTA_LIMITS_HARDWS_MAX_ENABLE
QUOTA_LIMITS_HARDWS_MIN_ENABLE
#define QUOTA_LIMITS_HARDWS_MIN_ENABLE
PIO_COUNTERS
struct _IO_COUNTERS * PIO_COUNTERS
InterlockedCompareExchange
#define InterlockedCompareExchange
Definition: interlocked.h:119
RTL_FIELD_SIZE
#define RTL_FIELD_SIZE(type, field)
Definition: kdb_expr.c:86
if
if(dx< 0)
Definition: linetemp.h:194
ASSERT
#define ASSERT(a)
Definition: mode.c:44
ExFreePoolWithTag
#define ExFreePoolWithTag(_P, _T)
Definition: module.h:1109
ImageName
static const char * ImageName
Definition: image.c:34
KeGetCurrentPrcb
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
Definition: ketypes.h:1187
ProcessHandle
_In_ HANDLE ProcessHandle
Definition: mmfuncs.h:403
SECTION_IMAGE_INFORMATION
struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION
NtCurrentProcess
#define NtCurrentProcess()
Definition: nt_native.h:1660
OBJECT_NAME_INFORMATION
struct _OBJECT_NAME_INFORMATION OBJECT_NAME_INFORMATION
Length
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
KeQueryRuntimeProcess
ULONG NTAPI KeQueryRuntimeProcess(IN PKPROCESS Process, OUT PULONG UserTime)
Definition: procobj.c:860
KeQueryValuesProcess
VOID NTAPI KeQueryValuesProcess(IN PKPROCESS Process, PPROCESS_VALUES Values)
Definition: procobj.c:525
MmGetImageInformation
VOID NTAPI MmGetImageInformation(OUT PSECTION_IMAGE_INFORMATION ImageInformation)
Definition: section.c:1619
MmGetExecuteOptions
NTSTATUS NTAPI MmGetExecuteOptions(IN PULONG ExecuteOptions)
Definition: pagfault.c:2653
DefaultQueryInfoBufferCheck
static __inline NTSTATUS DefaultQueryInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ ULONG Flags, _In_opt_ PVOID Buffer, _In_ ULONG BufferLength, _In_opt_ PULONG ReturnLength, _In_opt_ PULONG_PTR ReturnLengthPtr, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtQuery*** system call is invoked from...
Definition: probe.h:219
IoQueryFileDosDeviceName
NTSTATUS NTAPI IoQueryFileDosDeviceName(IN PFILE_OBJECT FileObject, OUT POBJECT_NAME_INFORMATION *ObjectNameInformation)
Definition: file.c:3664
KeMaximumIncrement
ULONG KeMaximumIncrement
Definition: clock.c:20
PsProcessType
POBJECT_TYPE PsProcessType
Definition: process.c:20
PsGetProcessSessionId
ULONG NTAPI PsGetProcessSessionId(IN PEPROCESS Process)
Definition: process.c:1163
PsReferenceProcessFilePointer
NTSTATUS NTAPI PsReferenceProcessFilePointer(_In_ PEPROCESS Process, _Outptr_ PFILE_OBJECT *FileObject)
Definition: query.c:24
SeLocateProcessImageName
NTSTATUS NTAPI SeLocateProcessImageName(_In_ PEPROCESS Process, _Out_ PUNICODE_STRING *ProcessImageName)
Finds the process image name of a specific process.
Definition: audit.c:199
PHANDLE
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:455
STATUS_INVALID_INFO_CLASS
#define STATUS_INVALID_INFO_CLASS
Definition: ntstatus.h:333
ObGetProcessHandleCount
ULONG NTAPI ObGetProcessHandleCount(IN PEPROCESS Process)
Definition: obhandle.c:56
ObIsLUIDDeviceMapsEnabled
ULONG NTAPI ObIsLUIDDeviceMapsEnabled(VOID)
Definition: devicemap.c:662
ObQueryDeviceMapInformation
NTSTATUS NTAPI ObQueryDeviceMapInformation(_In_opt_ PEPROCESS Process, _Out_ PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo, _In_ ULONG Flags)
Definition: devicemap.c:539
ObCloseHandle
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
Definition: obhandle.c:3379
ObReferenceObjectByHandle
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
Definition: obref.c:494
LONG
long LONG
Definition: pedump.c:60
PspDefaultQuotaBlock
EPROCESS_QUOTA_BLOCK PspDefaultQuotaBlock
Definition: quota.c:16
PsProcessInfoClass
static const INFORMATION_CLASS_INFO PsProcessInfoClass[]
Definition: ps_i.h:15
PPROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION
PROCESS_BASIC_INFORMATION
struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION
_SEH2_GetExceptionCode
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:204
_SEH2_EXCEPT
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:104
_SEH2_END
#define _SEH2_END
Definition: pseh2_64.h:194
_SEH2_TRY
#define _SEH2_TRY
Definition: pseh2_64.h:93
_SEH2_YIELD
#define _SEH2_YIELD(__stmt)
Definition: pseh2_64.h:207
STATUS_SUCCESS
#define STATUS_SUCCESS
Definition: shellext.h:65
_EPROCESS
Definition: pstypes.h:1350
_IO_COUNTERS
Definition: pstypes.h:82
_KERNEL_USER_TIMES
Definition: winternl.h:2373
_KERNEL_USER_TIMES::UserTime
LARGE_INTEGER UserTime
Definition: winternl.h:2377
_KERNEL_USER_TIMES::CreateTime
LARGE_INTEGER CreateTime
Definition: winternl.h:2374
_KERNEL_USER_TIMES::KernelTime
LARGE_INTEGER KernelTime
Definition: winternl.h:2376
_KERNEL_USER_TIMES::ExitTime
LARGE_INTEGER ExitTime
Definition: winternl.h:2375
_KPRCB
Definition: ketypes.h:654
_KPRCB::InterruptTime
ULONG InterruptTime
Definition: ketypes.h:834
_KPRCB::KeSystemCalls
ULONG KeSystemCalls
Definition: ketypes.h:745
_OBJECT_NAME_INFORMATION
Definition: nt_native.h:1272
_PROCESS_BASIC_INFORMATION
Definition: winternl.h:404
_PROCESS_BASIC_INFORMATION::PebBaseAddress
PPEB PebBaseAddress
Definition: winternl.h:406
_PROCESS_BASIC_INFORMATION::AffinityMask
ULONG_PTR AffinityMask
Definition: pstypes.h:359
_PROCESS_BASIC_INFORMATION::InheritedFromUniqueProcessId
ULONG_PTR InheritedFromUniqueProcessId
Definition: pstypes.h:362
_PROCESS_BASIC_INFORMATION::ExitStatus
NTSTATUS ExitStatus
Definition: pstypes.h:357
_PROCESS_BASIC_INFORMATION::BasePriority
KPRIORITY BasePriority
Definition: pstypes.h:360
_PROCESS_BASIC_INFORMATION::UniqueProcessId
ULONG_PTR UniqueProcessId
Definition: winternl.h:408
_PROCESS_DEVICEMAP_INFORMATION_EX
Definition: pstypes.h:392
_PROCESS_DEVICEMAP_INFORMATION_EX::Flags
ULONG Flags
Definition: pstypes.h:402
_PROCESS_DEVICEMAP_INFORMATION
Definition: pstypes.h:380
_PROCESS_PRIORITY_CLASS
Definition: pstypes.h:1039
_PROCESS_PRIORITY_CLASS::PriorityClass
UCHAR PriorityClass
Definition: pstypes.h:1041
_PROCESS_PRIORITY_CLASS::Foreground
BOOLEAN Foreground
Definition: pstypes.h:1040
_PROCESS_SESSION_INFORMATION
Definition: pstypes.h:405
_PROCESS_VALUES
Definition: ke.h:45
_PROCESS_VALUES::IoInfo
IO_COUNTERS IoInfo
Definition: ke.h:48
_QUOTA_LIMITS_EX
Definition: pstypes.h:67
_QUOTA_LIMITS_EX::MaximumWorkingSetSize
SIZE_T MaximumWorkingSetSize
Definition: pstypes.h:71
_QUOTA_LIMITS_EX::PagedPoolLimit
SIZE_T PagedPoolLimit
Definition: pstypes.h:68
_QUOTA_LIMITS_EX::PagefileLimit
SIZE_T PagefileLimit
Definition: pstypes.h:72
_QUOTA_LIMITS_EX::Flags
ULONG Flags
Definition: pstypes.h:78
_QUOTA_LIMITS_EX::TimeLimit
LARGE_INTEGER TimeLimit
Definition: pstypes.h:73
_QUOTA_LIMITS_EX::CpuRateLimit
RATE_QUOTA_LIMIT CpuRateLimit
Definition: pstypes.h:79
_QUOTA_LIMITS_EX::NonPagedPoolLimit
SIZE_T NonPagedPoolLimit
Definition: pstypes.h:69
_QUOTA_LIMITS_EX::MinimumWorkingSetSize
SIZE_T MinimumWorkingSetSize
Definition: pstypes.h:70
_QUOTA_LIMITS
Definition: lsa.idl:286
_SECTION_IMAGE_INFORMATION
Definition: mmtypes.h:340
_SessionInfo
Definition: mmdrv.h:130
_UNICODE_STRING
Definition: env_spec_w32.h:368
_VM_COUNTERS
Definition: winternl.h:3130
_VM_COUNTERS::PeakWorkingSetSize
SIZE_T PeakWorkingSetSize
Definition: winternl.h:3134
_VM_COUNTERS::PeakPagefileUsage
SIZE_T PeakPagefileUsage
Definition: winternl.h:3141
_VM_COUNTERS::PageFaultCount
ULONG PageFaultCount
Definition: winternl.h:3133
_VM_COUNTERS::QuotaPagedPoolUsage
SIZE_T QuotaPagedPoolUsage
Definition: winternl.h:3137
_VM_COUNTERS::QuotaPeakPagedPoolUsage
SIZE_T QuotaPeakPagedPoolUsage
Definition: winternl.h:3136
_VM_COUNTERS::QuotaPeakNonPagedPoolUsage
SIZE_T QuotaPeakNonPagedPoolUsage
Definition: winternl.h:3138
_VM_COUNTERS::PeakVirtualSize
SIZE_T PeakVirtualSize
Definition: winternl.h:3131
_VM_COUNTERS::VirtualSize
SIZE_T VirtualSize
Definition: winternl.h:3132
_VM_COUNTERS::QuotaNonPagedPoolUsage
SIZE_T QuotaNonPagedPoolUsage
Definition: winternl.h:3139
_VM_COUNTERS::WorkingSetSize
SIZE_T WorkingSetSize
Definition: winternl.h:3135
_VM_COUNTERS::PagefileUsage
SIZE_T PagefileUsage
Definition: winternl.h:3140
TAG_SEPA
#define TAG_SEPA
Definition: tag.h:155
PWSTR
uint16_t * PWSTR
Definition: typedefs.h:56
PULONG_PTR
uint32_t * PULONG_PTR
Definition: typedefs.h:65
PULONG
uint32_t * PULONG
Definition: typedefs.h:59
LONGLONG
int64_t LONGLONG
Definition: typedefs.h:68
HANDLE
PVOID HANDLE
Definition: typedefs.h:73
SIZE_T
ULONG_PTR SIZE_T
Definition: typedefs.h:80
RtlCopyMemory
#define RtlCopyMemory(Destination, Source, Length)
Definition: typedefs.h:263
RtlZeroMemory
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
ULONG_PTR
uint32_t ULONG_PTR
Definition: typedefs.h:65
ULONG
uint32_t ULONG
Definition: typedefs.h:59
STATUS_INVALID_PARAMETER
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INFO_LENGTH_MISMATCH
Definition: udferr_usr.h:133
HandleCount
static ULONG HandleCount
Definition: uefidisk.c:119
_LARGE_INTEGER
Definition: typedefs.h:103
_LARGE_INTEGER::QuadPart
LONGLONG QuadPart
Definition: typedefs.h:114
_LARGE_INTEGER::u
struct _LARGE_INTEGER::@2480 u
_RATE_QUOTA_LIMIT::RateData
ULONG RateData
Definition: pstypes.h:60
FileObject
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
Definition: wdfdevice.h:550
KERNEL_USER_TIMES
struct _KERNEL_USER_TIMES KERNEL_USER_TIMES
PKERNEL_USER_TIMES
struct _KERNEL_USER_TIMES * PKERNEL_USER_TIMES
ProcessLUIDDeviceMapsEnabled
@ ProcessLUIDDeviceMapsEnabled
Definition: winternl.h:1910
ProcessWx86Information
@ ProcessWx86Information
Definition: winternl.h:1901
ProcessDebugFlags
@ ProcessDebugFlags
Definition: winternl.h:1913
ProcessSessionInformation
@ ProcessSessionInformation
Definition: winternl.h:1906
ProcessVmCounters
@ ProcessVmCounters
Definition: winternl.h:1885
ProcessPriorityClass
@ ProcessPriorityClass
Definition: winternl.h:1900
ProcessPriorityBoost
@ ProcessPriorityBoost
Definition: winternl.h:1904
ProcessImageInformation
@ ProcessImageInformation
Definition: winternl.h:1919
ProcessExecuteFlags
@ ProcessExecuteFlags
Definition: winternl.h:1916
ProcessCookie
@ ProcessCookie
Definition: winternl.h:1918
ProcessPooledUsageAndLimits
@ ProcessPooledUsageAndLimits
Definition: winternl.h:1896
ProcessIoCounters
@ ProcessIoCounters
Definition: winternl.h:1884
ProcessImageFileNameWin32
@ ProcessImageFileNameWin32
Definition: winternl.h:1925
ProcessDefaultHardErrorMode
@ ProcessDefaultHardErrorMode
Definition: winternl.h:1894
ProcessDeviceMap
@ ProcessDeviceMap
Definition: winternl.h:1905
ProcessQuotaLimits
@ ProcessQuotaLimits
Definition: winternl.h:1883
ProcessHandleTracing
@ ProcessHandleTracing
Definition: winternl.h:1914
ProcessTimes
@ ProcessTimes
Definition: winternl.h:1886
ProcessDebugObjectHandle
@ ProcessDebugObjectHandle
Definition: winternl.h:1912
ProcessWorkingSetWatch
@ ProcessWorkingSetWatch
Definition: winternl.h:1897
ProcessLdtInformation
@ ProcessLdtInformation
Definition: winternl.h:1892
ProcessHandleCount
@ ProcessHandleCount
Definition: winternl.h:1902
PVM_COUNTERS
struct _VM_COUNTERS * PVM_COUNTERS
VM_COUNTERS_EX
struct _VM_COUNTERS_EX VM_COUNTERS_EX
Flags
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
Cookie
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
Definition: cmfuncs.h:14
PFILE_OBJECT
* PFILE_OBJECT
Definition: iotypes.h:1998
UserTime
_Out_ PULONG UserTime
Definition: kefuncs.h:759
KPROCESSOR_MODE
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
ObDereferenceObject
#define ObDereferenceObject
Definition: obfuncs.h:203
PsGetCurrentProcess
#define PsGetCurrentProcess
Definition: psfuncs.h:17

Referenced by _main(), BaseInitializeStaticServerData(), check_live_target(), CheckRemoteDebuggerPresent(), CON_API_NOCONSOLE(), EmptyWorkingSet(), EnumProcessModules(), FindModule(), get_shiminfo(), getCommandLineFromProcess(), GetDriveTypeW(), GetErrorMode(), GetExitCodeProcess(), GetLogicalDrives(), GetPriorityClass(), GetProcessAffinityMask(), GetProcessExecutablePath(), GetProcessHandleCount(), GetProcessId(), GetProcessImageFileNameA(), GetProcessImageFileNameW(), GetProcessIoCounters(), GetProcessMemoryInfo(), GetProcessPriorityBoost(), GetProcessTimes(), GetProcessVersion(), GetProcessWorkingSetSizeEx(), GetSourcePaths(), GetWsChanges(), GlobalMemoryStatusEx(), init_module_iterator(), init_module_iterator_wow64(), InitFunctionPtrs(), Is64BitSystem(), IsCriticalProcess(), IsWow64Process(), PerfDataGetCommandLine(), PrintProcess(), ProcessIdToSessionId(), PsaEnumerateProcessModules(), QueryFlag(), QueryFullProcessImageNameW(), QueryProcessCycleTime(), QuerySetProcessValidator(), RtlpQueryRemoteProcessModules(), SmpApiLoop(), SmpCreateVolumeDescriptors(), SmpGetProcessMuSessionId(), test_dead_process(), test_GlobalMemoryStatus(), Test_ProcessBasicInformation(), Test_ProcessPriorityClassAlignment(), Test_ProcessQuotaLimits(), Test_ProcessQuotaLimitsEx(), Test_ProcessTimes(), Test_ProcessWx86Information(), test_section_access(), UnhandledExceptionFilter(), UserpGetClientFileName(), wmain(), and Wow64QueryFlag().

◆ NtQueryInformationThread()

NTSTATUS NTAPI NtQueryInformationThread ( _In_ HANDLE  ThreadHandle,
_In_ THREADINFOCLASS  ThreadInformationClass,
_Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) PVOID  ThreadInformation,
_In_ ULONG  ThreadInformationLength,
_Out_opt_ PULONG  ReturnLength 
)

Definition at line 2899 of file query.c.

2906{
2907 PETHREAD Thread;
2908 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
2909 NTSTATUS Status;
2910 ULONG Access;
2911 ULONG Length = 0;
2912
2913 PAGED_CODE();
2914
2915 /* Validate the information class */
2916 Status = DefaultQueryInfoBufferCheck(ThreadInformationClass,
2917 PsThreadInfoClass,
2918 RTL_NUMBER_OF(PsThreadInfoClass),
2919 ICIF_PROBE_READ,
2920 ThreadInformation,
2921 ThreadInformationLength,
2922 ReturnLength,
2923 NULL,
2924 PreviousMode);
2925 if (!NT_SUCCESS(Status))
2926 {
2927#if DBG
2928 DPRINT1("NtQueryInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
2929 PspDumpThreadInfoClassName(ThreadInformationClass), Status);
2930#endif
2931 return Status;
2932 }
2933
2934 /* Check what class this is */
2935 Access = THREAD_QUERY_INFORMATION;
2936
2937 /* Check what kind of information class this is */
2938 switch (ThreadInformationClass)
2939 {
2940 /* Basic thread information */
2941 case ThreadBasicInformation:
2942 {
2943 PTHREAD_BASIC_INFORMATION ThreadBasicInfo =
2944 (PTHREAD_BASIC_INFORMATION)ThreadInformation;
2945
2946 /* Set the return length */
2947 Length = sizeof(THREAD_BASIC_INFORMATION);
2948
2949 if (ThreadInformationLength != Length)
2950 {
2951 Status = STATUS_INFO_LENGTH_MISMATCH;
2952 break;
2953 }
2954
2955 /* Reference the thread */
2956 Status = ObReferenceObjectByHandle(ThreadHandle,
2957 Access,
2958 PsThreadType,
2959 PreviousMode,
2960 (PVOID*)&Thread,
2961 NULL);
2962 if (!NT_SUCCESS(Status))
2963 break;
2964
2965 /* Protect writes with SEH */
2966 _SEH2_TRY
2967 {
2968 /* Write all the information from the ETHREAD/KTHREAD */
2969 ThreadBasicInfo->ExitStatus = Thread->ExitStatus;
2970 ThreadBasicInfo->TebBaseAddress = (PVOID)Thread->Tcb.Teb;
2971 ThreadBasicInfo->ClientId = Thread->Cid;
2972 ThreadBasicInfo->AffinityMask = Thread->Tcb.Affinity;
2973 ThreadBasicInfo->Priority = Thread->Tcb.Priority;
2974 ThreadBasicInfo->BasePriority = KeQueryBasePriorityThread(&Thread->Tcb);
2975 }
2976 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2977 {
2978 /* Get exception code */
2979 Status = _SEH2_GetExceptionCode();
2980 }
2981 _SEH2_END;
2982
2983 /* Dereference the thread */
2984 ObDereferenceObject(Thread);
2985 break;
2986 }
2987
2988 /* Thread time information */
2989 case ThreadTimes:
2990 {
2991 PKERNEL_USER_TIMES ThreadTime = (PKERNEL_USER_TIMES)ThreadInformation;
2992
2993 /* Set the return length */
2994 Length = sizeof(KERNEL_USER_TIMES);
2995
2996 if (ThreadInformationLength != Length)
2997 {
2998 Status = STATUS_INFO_LENGTH_MISMATCH;
2999 break;
3000 }
3001
3002 /* Reference the thread */
3003 Status = ObReferenceObjectByHandle(ThreadHandle,
3004 Access,
3005 PsThreadType,
3006 PreviousMode,
3007 (PVOID*)&Thread,
3008 NULL);
3009 if (!NT_SUCCESS(Status))
3010 break;
3011
3012 /* Protect writes with SEH */
3013 _SEH2_TRY
3014 {
3015 /* Copy time information from ETHREAD/KTHREAD */
3016 ThreadTime->KernelTime.QuadPart = Thread->Tcb.KernelTime * KeMaximumIncrement;
3017 ThreadTime->UserTime.QuadPart = Thread->Tcb.UserTime * KeMaximumIncrement;
3018 ThreadTime->CreateTime = Thread->CreateTime;
3019
3020 /* Exit time is in a union and only valid on actual exit! */
3021 if (KeReadStateThread(&Thread->Tcb))
3022 {
3023 ThreadTime->ExitTime = Thread->ExitTime;
3024 }
3025 else
3026 {
3027 ThreadTime->ExitTime.QuadPart = 0;
3028 }
3029 }
3030 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3031 {
3032 /* Get exception code */
3033 Status = _SEH2_GetExceptionCode();
3034 }
3035 _SEH2_END;
3036
3037 /* Dereference the thread */
3038 ObDereferenceObject(Thread);
3039 break;
3040 }
3041
3042 case ThreadQuerySetWin32StartAddress:
3043 {
3044 /* Set the return length*/
3045 Length = sizeof(PVOID);
3046
3047 if (ThreadInformationLength != Length)
3048 {
3049 Status = STATUS_INFO_LENGTH_MISMATCH;
3050 break;
3051 }
3052
3053 /* Reference the thread */
3054 Status = ObReferenceObjectByHandle(ThreadHandle,
3055 Access,
3056 PsThreadType,
3057 PreviousMode,
3058 (PVOID*)&Thread,
3059 NULL);
3060 if (!NT_SUCCESS(Status))
3061 break;
3062
3063 /* Protect write with SEH */
3064 _SEH2_TRY
3065 {
3066 /* Return the Win32 Start Address */
3067 *(PVOID*)ThreadInformation = Thread->Win32StartAddress;
3068 }
3069 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3070 {
3071 /* Get exception code */
3072 Status = _SEH2_GetExceptionCode();
3073 }
3074 _SEH2_END;
3075
3076 /* Dereference the thread */
3077 ObDereferenceObject(Thread);
3078 break;
3079 }
3080
3081 case ThreadPerformanceCount:
3082 {
3083 /* Set the return length*/
3084 Length = sizeof(LARGE_INTEGER);
3085
3086 if (ThreadInformationLength != Length)
3087 {
3088 Status = STATUS_INFO_LENGTH_MISMATCH;
3089 break;
3090 }
3091
3092 /* Reference the thread */
3093 Status = ObReferenceObjectByHandle(ThreadHandle,
3094 Access,
3095 PsThreadType,
3096 PreviousMode,
3097 (PVOID*)&Thread,
3098 NULL);
3099 if (!NT_SUCCESS(Status))
3100 break;
3101
3102 /* Protect write with SEH */
3103 _SEH2_TRY
3104 {
3105 /* FIXME */
3106 (*(PLARGE_INTEGER)ThreadInformation).QuadPart = 0;
3107 }
3108 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3109 {
3110 /* Get exception code */
3111 Status = _SEH2_GetExceptionCode();
3112 }
3113 _SEH2_END;
3114
3115 /* Dereference the thread */
3116 ObDereferenceObject(Thread);
3117 break;
3118 }
3119
3120 case ThreadAmILastThread:
3121 {
3122 /* Set the return length*/
3123 Length = sizeof(ULONG);
3124
3125 if (ThreadInformationLength != Length)
3126 {
3127 Status = STATUS_INFO_LENGTH_MISMATCH;
3128 break;
3129 }
3130
3131 /* Reference the thread */
3132 Status = ObReferenceObjectByHandle(ThreadHandle,
3133 Access,
3134 PsThreadType,
3135 PreviousMode,
3136 (PVOID*)&Thread,
3137 NULL);
3138 if (!NT_SUCCESS(Status))
3139 break;
3140
3141 /* Protect write with SEH */
3142 _SEH2_TRY
3143 {
3144 /* Return whether or not we are the last thread */
3145 *(PULONG)ThreadInformation = ((Thread->ThreadsProcess->
3146 ThreadListHead.Flink->Flink ==
3147 &Thread->ThreadsProcess->
3148 ThreadListHead) ?
3149 TRUE : FALSE);
3150 }
3151 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3152 {
3153 /* Get exception code */
3154 Status = _SEH2_GetExceptionCode();
3155 }
3156 _SEH2_END;
3157
3158 /* Dereference the thread */
3159 ObDereferenceObject(Thread);
3160 break;
3161 }
3162
3163 case ThreadIsIoPending:
3164 {
3165 KIRQL OldIrql;
3166
3167 /* Set the return length*/
3168 Length = sizeof(ULONG);
3169
3170 if (ThreadInformationLength != Length)
3171 {
3172 Status = STATUS_INFO_LENGTH_MISMATCH;
3173 break;
3174 }
3175
3176 /* Reference the thread */
3177 Status = ObReferenceObjectByHandle(ThreadHandle,
3178 Access,
3179 PsThreadType,
3180 PreviousMode,
3181 (PVOID*)&Thread,
3182 NULL);
3183 if (!NT_SUCCESS(Status))
3184 break;
3185
3186 /* Raise the IRQL to protect the IRP list */
3187 KeRaiseIrql(APC_LEVEL, &OldIrql);
3188
3189 /* Protect write with SEH */
3190 _SEH2_TRY
3191 {
3192 /* Check if the IRP list is empty or not */
3193 *(PULONG)ThreadInformation = !IsListEmpty(&Thread->IrpList);
3194 }
3195 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3196 {
3197 /* Get exception code */
3198 Status = _SEH2_GetExceptionCode();
3199 }
3200 _SEH2_END;
3201
3202 /* Lower IRQL back */
3203 KeLowerIrql(OldIrql);
3204
3205 /* Dereference the thread */
3206 ObDereferenceObject(Thread);
3207 break;
3208 }
3209
3210 /* LDT and GDT information */
3211 case ThreadDescriptorTableEntry:
3212 {
3213#if defined(_X86_)
3214 /* Reference the thread */
3215 Status = ObReferenceObjectByHandle(ThreadHandle,
3216 Access,
3217 PsThreadType,
3218 PreviousMode,
3219 (PVOID*)&Thread,
3220 NULL);
3221 if (!NT_SUCCESS(Status))
3222 break;
3223
3224 /* Call the worker routine */
3225 Status = PspQueryDescriptorThread(Thread,
3226 ThreadInformation,
3227 ThreadInformationLength,
3228 ReturnLength);
3229
3230 /* Dereference the thread */
3231 ObDereferenceObject(Thread);
3232#else
3233 /* Only implemented on x86 */
3234 Status = STATUS_NOT_IMPLEMENTED;
3235#endif
3236 break;
3237 }
3238
3239 case ThreadPriorityBoost:
3240 {
3241 /* Set the return length*/
3242 Length = sizeof(ULONG);
3243
3244 if (ThreadInformationLength != Length)
3245 {
3246 Status = STATUS_INFO_LENGTH_MISMATCH;
3247 break;
3248 }
3249
3250 /* Reference the thread */
3251 Status = ObReferenceObjectByHandle(ThreadHandle,
3252 Access,
3253 PsThreadType,
3254 PreviousMode,
3255 (PVOID*)&Thread,
3256 NULL);
3257 if (!NT_SUCCESS(Status))
3258 break;
3259
3260 _SEH2_TRY
3261 {
3262 *(PULONG)ThreadInformation = Thread->Tcb.DisableBoost ? 1 : 0;
3263 }
3264 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3265 {
3266 Status = _SEH2_GetExceptionCode();
3267 }
3268 _SEH2_END;
3269
3270 /* Dereference the thread */
3271 ObDereferenceObject(Thread);
3272 break;
3273 }
3274
3275#if (NTDDI_VERSION >= NTDDI_VISTA)
3276 case ThreadHideFromDebugger:
3277 {
3278 /* Set the return length */
3279 Length = sizeof(BOOLEAN);
3280
3281 if (ThreadInformationLength != Length)
3282 {
3283 Status = STATUS_INFO_LENGTH_MISMATCH;
3284 break;
3285 }
3286
3287 /* Reference the thread */
3288 Status = ObReferenceObjectByHandle(ThreadHandle,
3289 Access,
3290 PsThreadType,
3291 PreviousMode,
3292 (PVOID*)&Thread,
3293 NULL);
3294 if (!NT_SUCCESS(Status))
3295 break;
3296
3297 /* Protect write with SEH */
3298 _SEH2_TRY
3299 {
3300 *(PBOOLEAN)ThreadInformation = Thread->HideFromDebugger;
3301 }
3302 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3303 {
3304 /* Get exception code */
3305 Status = _SEH2_GetExceptionCode();
3306 }
3307 _SEH2_END;
3308
3309 /* Dereference the thread */
3310 ObDereferenceObject(Thread);
3311 break;
3312 }
3313#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
3314
3315 case ThreadBreakOnTermination:
3316 {
3317 /* Set the return length */
3318 Length = sizeof(ULONG);
3319
3320 if (ThreadInformationLength != Length)
3321 {
3322 Status = STATUS_INFO_LENGTH_MISMATCH;
3323 break;
3324 }
3325
3326 /* Reference the thread */
3327 Status = ObReferenceObjectByHandle(ThreadHandle,
3328 Access,
3329 PsThreadType,
3330 PreviousMode,
3331 (PVOID*)&Thread,
3332 NULL);
3333 if (!NT_SUCCESS(Status))
3334 break;
3335
3336 _SEH2_TRY
3337 {
3338 *(PULONG)ThreadInformation = Thread->BreakOnTermination;
3339 }
3340 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3341 {
3342 Status = _SEH2_GetExceptionCode();
3343 }
3344 _SEH2_END;
3345
3346 /* Dereference the thread */
3347 ObDereferenceObject(Thread);
3348 break;
3349 }
3350
3351 case ThreadIsTerminated:
3352 {
3353 ULONG ThreadTerminated;
3354
3355 /* Set the return length*/
3356 Length = sizeof(ThreadTerminated);
3357
3358 if (ThreadInformationLength != Length)
3359 {
3360 Status = STATUS_INFO_LENGTH_MISMATCH;
3361 break;
3362 }
3363
3364 /* Reference the thread */
3365 Status = ObReferenceObjectByHandle(ThreadHandle,
3366 Access,
3367 PsThreadType,
3368 PreviousMode,
3369 (PVOID*)&Thread,
3370 NULL);
3371 if (!NT_SUCCESS(Status))
3372 break;
3373
3374 ThreadTerminated = PsIsThreadTerminating(Thread);
3375
3376 _SEH2_TRY
3377 {
3378 *(PULONG)ThreadInformation = ThreadTerminated ? 1 : 0;
3379 }
3380 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3381 {
3382 Status = _SEH2_GetExceptionCode();
3383 }
3384 _SEH2_END;
3385
3386 /* Dereference the thread */
3387 ObDereferenceObject(Thread);
3388 break;
3389 }
3390
3391 /* Anything else */
3392 default:
3393 /* Not yet implemented */
3394#if DBG
3395 DPRINT1("Not implemented: %s\n", PspDumpThreadInfoClassName(ThreadInformationClass));
3396#endif
3397 Status = STATUS_NOT_IMPLEMENTED;
3398 }
3399
3400 /* Protect write with SEH */
3401 _SEH2_TRY
3402 {
3403 /* Check if caller wanted return length */
3404 if (ReturnLength) *ReturnLength = Length;
3405 }
3406 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
3407 {
3408 /* Get exception code */
3409 Status = _SEH2_GetExceptionCode();
3410 }
3411 _SEH2_END;
3412
3413 return Status;
3414}
THREAD_BASIC_INFORMATION
struct _THREAD_BASIC_INFORMATION THREAD_BASIC_INFORMATION
ThreadDescriptorTableEntry
@ ThreadDescriptorTableEntry
Definition: compat.h:941
ThreadAmILastThread
@ ThreadAmILastThread
Definition: compat.h:947
ThreadTimes
@ ThreadTimes
Definition: compat.h:936
ThreadQuerySetWin32StartAddress
@ ThreadQuerySetWin32StartAddress
Definition: compat.h:944
ThreadIsTerminated
@ ThreadIsTerminated
Definition: compat.h:955
ThreadBreakOnTermination
@ ThreadBreakOnTermination
Definition: compat.h:953
ThreadBasicInformation
@ ThreadBasicInformation
Definition: compat.h:935
ThreadPriorityBoost
@ ThreadPriorityBoost
Definition: compat.h:949
ThreadPerformanceCount
@ ThreadPerformanceCount
Definition: compat.h:946
ThreadIsIoPending
@ ThreadIsIoPending
Definition: compat.h:951
ThreadHideFromDebugger
@ ThreadHideFromDebugger
Definition: compat.h:952
PTHREAD_BASIC_INFORMATION
struct _THREAD_BASIC_INFORMATION * PTHREAD_BASIC_INFORMATION
IsListEmpty
#define IsListEmpty(ListHead)
Definition: env_spec_w32.h:954
KIRQL
UCHAR KIRQL
Definition: env_spec_w32.h:591
KeRaiseIrql
#define KeRaiseIrql(irql, oldIrql)
Definition: env_spec_w32.h:597
APC_LEVEL
#define APC_LEVEL
Definition: env_spec_w32.h:695
KeLowerIrql
#define KeLowerIrql(oldIrql)
Definition: env_spec_w32.h:602
Thread
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
Definition: fltkernel.h:2653
THREAD_QUERY_INFORMATION
#define THREAD_QUERY_INFORMATION
Definition: pstypes.h:150
ThreadListHead
static LIST_ENTRY ThreadListHead
Definition: sys_arch.c:6
ThreadInformationLength
_In_ THREADINFOCLASS _In_ ULONG ThreadInformationLength
Definition: psfuncs.h:844
ThreadInformationClass
_In_ THREADINFOCLASS ThreadInformationClass
Definition: psfuncs.h:841
KeQueryBasePriorityThread
LONG NTAPI KeQueryBasePriorityThread(IN PKTHREAD Thread)
Definition: thrdobj.c:52
KeReadStateThread
BOOLEAN NTAPI KeReadStateThread(IN PKTHREAD Thread)
Definition: thrdobj.c:42
PsThreadType
POBJECT_TYPE PsThreadType
Definition: thread.c:20
PsIsThreadTerminating
BOOLEAN NTAPI PsIsThreadTerminating(IN PETHREAD Thread)
Definition: thread.c:868
BOOLEAN
#define BOOLEAN
Definition: pedump.c:73
PsThreadInfoClass
static const INFORMATION_CLASS_INFO PsThreadInfoClass[]
Definition: ps_i.h:362
PspQueryDescriptorThread
NTSTATUS NTAPI PspQueryDescriptorThread(IN PETHREAD Thread, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
Definition: psldt.c:43
_ETHREAD
Definition: pstypes.h:1191
_ETHREAD::ExitTime
LARGE_INTEGER ExitTime
Definition: pstypes.h:1196
_ETHREAD::ExitStatus
NTSTATUS ExitStatus
Definition: pstypes.h:1202
_ETHREAD::Tcb
KTHREAD Tcb
Definition: pstypes.h:1192
_ETHREAD::Win32StartAddress
PVOID Win32StartAddress
Definition: pstypes.h:1241
_ETHREAD::Cid
CLIENT_ID Cid
Definition: pstypes.h:1217
_ETHREAD::IrpList
LIST_ENTRY IrpList
Definition: pstypes.h:1233
_ETHREAD::CreateTime
LARGE_INTEGER CreateTime
Definition: pstypes.h:1193
_ETHREAD::BreakOnTermination
ULONG BreakOnTermination
Definition: pstypes.h:1273
_ETHREAD::HideFromDebugger
ULONG HideFromDebugger
Definition: pstypes.h:1269
_KTHREAD::Affinity
GROUP_AFFINITY Affinity
Definition: ketypes.h:2066
_KTHREAD::DisableBoost
ULONG DisableBoost
Definition: ketypes.h:1853
_KTHREAD::Priority
SCHAR Priority
Definition: ketypes.h:1910
_KTHREAD::Teb
PVOID Teb
Definition: ketypes.h:1935
_KTHREAD::KernelTime
ULONG KernelTime
Definition: ketypes.h:2115
_KTHREAD::UserTime
ULONG UserTime
Definition: ketypes.h:2131
_LIST_ENTRY::Flink
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
_THREAD_BASIC_INFORMATION
Definition: compat.h:926
_THREAD_BASIC_INFORMATION::ClientId
CLIENT_ID ClientId
Definition: compat.h:929
_THREAD_BASIC_INFORMATION::Priority
KPRIORITY Priority
Definition: compat.h:931
_THREAD_BASIC_INFORMATION::BasePriority
KPRIORITY BasePriority
Definition: compat.h:932
_THREAD_BASIC_INFORMATION::ExitStatus
NTSTATUS ExitStatus
Definition: compat.h:927
_THREAD_BASIC_INFORMATION::TebBaseAddress
PVOID TebBaseAddress
Definition: compat.h:928
_THREAD_BASIC_INFORMATION::AffinityMask
KAFFINITY AffinityMask
Definition: compat.h:930
PBOOLEAN
unsigned char * PBOOLEAN
Definition: typedefs.h:53
LARGE_INTEGER
union _LARGE_INTEGER LARGE_INTEGER
PVOID
void * PVOID
Definition: typedefs.h:50
PLARGE_INTEGER
union _LARGE_INTEGER * PLARGE_INTEGER
Definition: file.c:85
OldIrql
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
Definition: kefuncs.h:778

Referenced by CreateRemoteThread(), CsrCreateProcess(), CsrCreateRemoteThread(), CsrCreateThread(), CsrInsertThread(), CsrSbCreateSession(), DbgUiConvertStateChangeStructure(), ExitThread(), fetch_thread_info(), GetExitCodeThread(), GetProcessIdOfThread(), GetThreadDescription(), GetThreadGroupAffinity(), GetThreadId(), GetThreadIdealProcessorEx(), GetThreadIOPendingFlag(), GetThreadPriority(), GetThreadPriorityBoost(), GetThreadSelectorEntry(), GetThreadTimes(), i386_stack_walk(), init_funcs(), InitFunctionPtrs(), PrintThreads(), QuerySetThreadValidator(), RtlFreeUserThreadStack(), RtlpIsIoPending(), SetThreadAffinityMask(), TerminateThread(), Test_ThreadBasicInformationClass(), Test_ThreadHideFromDebuggerClass(), and test_tls_links().

◆ NtSetInformationProcess()

NTSTATUS NTAPI NtSetInformationProcess ( _In_ HANDLE  ProcessHandle,
_In_ PROCESSINFOCLASS  ProcessInformationClass,
_In_reads_bytes_(ProcessInformationLength) PVOID  ProcessInformation,
_In_ ULONG  ProcessInformationLength 
)

Definition at line 1390 of file query.c.

1395{
1396 PEPROCESS Process;
1397 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
1398 ACCESS_MASK Access;
1399 NTSTATUS Status;
1400 HANDLE PortHandle = NULL;
1401 HANDLE TokenHandle = NULL;
1402 HANDLE DirectoryHandle = NULL;
1403 PROCESS_SESSION_INFORMATION SessionInfo = {0};
1404 PROCESS_PRIORITY_CLASS PriorityClass = {0};
1405 PROCESS_FOREGROUND_BACKGROUND Foreground = {0};
1406 PVOID ExceptionPort;
1407 ULONG Break;
1408 KAFFINITY ValidAffinity, Affinity = 0;
1409 KPRIORITY BasePriority = 0;
1410 UCHAR MemoryPriority = 0;
1411 BOOLEAN DisableBoost = 0;
1412 ULONG DefaultHardErrorMode = 0;
1413 ULONG DebugFlags = 0, EnableFixup = 0, Boost = 0;
1414 ULONG NoExecute = 0, VdmPower = 0;
1415 BOOLEAN HasPrivilege;
1416 PLIST_ENTRY Next;
1417 PETHREAD Thread;
1418 PAGED_CODE();
1419
1420 /* Validate the information class */
1421 Status = DefaultSetInfoBufferCheck(ProcessInformationClass,
1422 PsProcessInfoClass,
1423 RTL_NUMBER_OF(PsProcessInfoClass),
1424 ProcessInformation,
1425 ProcessInformationLength,
1426 PreviousMode);
1427 if (!NT_SUCCESS(Status))
1428 {
1429#if DBG
1430 DPRINT1("NtSetInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
1431 PspDumpProcessInfoClassName(ProcessInformationClass), Status);
1432#endif
1433 return Status;
1434 }
1435
1436 /* Check what class this is */
1437 Access = PROCESS_SET_INFORMATION;
1438 if (ProcessInformationClass == ProcessSessionInformation)
1439 {
1440 /* Setting the Session ID needs a special mask */
1441 Access |= PROCESS_SET_SESSIONID;
1442 }
1443 else if (ProcessInformationClass == ProcessExceptionPort)
1444 {
1445 /* Setting the exception port needs a special mask */
1446 Access |= PROCESS_SUSPEND_RESUME;
1447 }
1448
1449 /* Reference the process */
1450 Status = ObReferenceObjectByHandle(ProcessHandle,
1451 Access,
1452 PsProcessType,
1453 PreviousMode,
1454 (PVOID*)&Process,
1455 NULL);
1456 if (!NT_SUCCESS(Status)) return Status;
1457
1458 /* Check what kind of information class this is */
1459 switch (ProcessInformationClass)
1460 {
1461 case ProcessWx86Information:
1462
1463 /* Check buffer length */
1464 if (ProcessInformationLength != sizeof(ULONG))
1465 {
1466 Status = STATUS_INFO_LENGTH_MISMATCH;
1467 break;
1468 }
1469
1470 /* Use SEH for capture */
1471 _SEH2_TRY
1472 {
1473 /* Capture the boolean */
1474 VdmPower = *(PULONG)ProcessInformation;
1475 }
1476 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1477 {
1478 /* Get the exception code */
1479 Status = _SEH2_GetExceptionCode();
1480 _SEH2_YIELD(break);
1481 }
1482 _SEH2_END;
1483
1484 /* Getting VDM powers requires the SeTcbPrivilege */
1485 if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode))
1486 {
1487 /* We don't hold the privilege, bail out */
1488 Status = STATUS_PRIVILEGE_NOT_HELD;
1489 DPRINT1("Need TCB privilege\n");
1490 break;
1491 }
1492
1493 /* Set or clear the flag */
1494 if (VdmPower)
1495 {
1496 PspSetProcessFlag(Process, PSF_VDM_ALLOWED_BIT);
1497 }
1498 else
1499 {
1500 PspClearProcessFlag(Process, PSF_VDM_ALLOWED_BIT);
1501 }
1502 break;
1503
1504 /* Error/Exception Port */
1505 case ProcessExceptionPort:
1506
1507 /* Check buffer length */
1508 if (ProcessInformationLength != sizeof(HANDLE))
1509 {
1510 Status = STATUS_INFO_LENGTH_MISMATCH;
1511 break;
1512 }
1513
1514 /* Use SEH for capture */
1515 _SEH2_TRY
1516 {
1517 /* Capture the handle */
1518 PortHandle = *(PHANDLE)ProcessInformation;
1519 }
1520 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1521 {
1522 /* Get the exception code */
1523 Status = _SEH2_GetExceptionCode();
1524 _SEH2_YIELD(break);
1525 }
1526 _SEH2_END;
1527
1528 /* Setting the error port requires the SeTcbPrivilege */
1529 if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode))
1530 {
1531 /* We don't hold the privilege, bail out */
1532 Status = STATUS_PRIVILEGE_NOT_HELD;
1533 break;
1534 }
1535
1536 /* Get the LPC Port */
1537 Status = ObReferenceObjectByHandle(PortHandle,
1538 0,
1539 LpcPortObjectType,
1540 PreviousMode,
1541 (PVOID)&ExceptionPort,
1542 NULL);
1543 if (!NT_SUCCESS(Status)) break;
1544
1545 /* Change the pointer */
1546 if (InterlockedCompareExchangePointer(&Process->ExceptionPort,
1547 ExceptionPort,
1548 NULL))
1549 {
1550 /* We already had one, fail */
1551 ObDereferenceObject(ExceptionPort);
1552 Status = STATUS_PORT_ALREADY_SET;
1553 }
1554 break;
1555
1556 /* Security Token */
1557 case ProcessAccessToken:
1558
1559 /* Check buffer length */
1560 if (ProcessInformationLength != sizeof(PROCESS_ACCESS_TOKEN))
1561 {
1562 Status = STATUS_INFO_LENGTH_MISMATCH;
1563 break;
1564 }
1565
1566 /* Use SEH for capture */
1567 _SEH2_TRY
1568 {
1569 /* Save the token handle */
1570 TokenHandle = ((PPROCESS_ACCESS_TOKEN)ProcessInformation)->
1571 Token;
1572 }
1573 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1574 {
1575 /* Get the exception code */
1576 Status = _SEH2_GetExceptionCode();
1577 _SEH2_YIELD(break);
1578 }
1579 _SEH2_END;
1580
1581 /* Assign the actual token */
1582 Status = PspSetPrimaryToken(Process, TokenHandle, NULL);
1583 break;
1584
1585 /* Hard error processing */
1586 case ProcessDefaultHardErrorMode:
1587
1588 /* Check buffer length */
1589 if (ProcessInformationLength != sizeof(ULONG))
1590 {
1591 Status = STATUS_INFO_LENGTH_MISMATCH;
1592 break;
1593 }
1594
1595 /* Enter SEH for direct buffer read */
1596 _SEH2_TRY
1597 {
1598 DefaultHardErrorMode = *(PULONG)ProcessInformation;
1599 }
1600 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1601 {
1602 /* Get exception code */
1603 Status = _SEH2_GetExceptionCode();
1604 _SEH2_YIELD(break);
1605 }
1606 _SEH2_END;
1607
1608 /* Set the mode */
1609 Process->DefaultHardErrorProcessing = DefaultHardErrorMode;
1610
1611 /* Call Ke for the update */
1612 if (DefaultHardErrorMode & SEM_NOALIGNMENTFAULTEXCEPT)
1613 {
1614 KeSetAutoAlignmentProcess(&Process->Pcb, TRUE);
1615 }
1616 else
1617 {
1618 KeSetAutoAlignmentProcess(&Process->Pcb, FALSE);
1619 }
1620 Status = STATUS_SUCCESS;
1621 break;
1622
1623 /* Session ID */
1624 case ProcessSessionInformation:
1625
1626 /* Check buffer length */
1627 if (ProcessInformationLength != sizeof(PROCESS_SESSION_INFORMATION))
1628 {
1629 Status = STATUS_INFO_LENGTH_MISMATCH;
1630 break;
1631 }
1632
1633 /* Enter SEH for capture */
1634 _SEH2_TRY
1635 {
1636 /* Capture the caller's buffer */
1637 SessionInfo = *(PPROCESS_SESSION_INFORMATION)ProcessInformation;
1638 }
1639 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1640 {
1641 /* Get the exception code */
1642 Status = _SEH2_GetExceptionCode();
1643 _SEH2_YIELD(break);
1644 }
1645 _SEH2_END;
1646
1647 /* Setting the session id requires the SeTcbPrivilege */
1648 if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode))
1649 {
1650 /* We don't hold the privilege, bail out */
1651 Status = STATUS_PRIVILEGE_NOT_HELD;
1652 break;
1653 }
1654
1655 /*
1656 * Since we cannot change the session ID of the given
1657 * process anymore because it is set once and for all
1658 * at process creation time and because it is stored
1659 * inside the Process->Session structure managed by MM,
1660 * we fake changing it: we just return success if the
1661 * user-defined value is the same as the session ID of
1662 * the process, and otherwise we fail.
1663 */
1664 if (SessionInfo.SessionId == PsGetProcessSessionId(Process))
1665 {
1666 Status = STATUS_SUCCESS;
1667 }
1668 else
1669 {
1670 Status = STATUS_ACCESS_DENIED;
1671 }
1672
1673 break;
1674
1675 case ProcessPriorityClass:
1676
1677 /* Check buffer length */
1678 if (ProcessInformationLength != sizeof(PROCESS_PRIORITY_CLASS))
1679 {
1680 Status = STATUS_INFO_LENGTH_MISMATCH;
1681 break;
1682 }
1683
1684 /* Enter SEH for capture */
1685 _SEH2_TRY
1686 {
1687 /* Capture the caller's buffer */
1688 PriorityClass = *(PPROCESS_PRIORITY_CLASS)ProcessInformation;
1689 }
1690 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1691 {
1692 /* Return the exception code */
1693 Status = _SEH2_GetExceptionCode();
1694 _SEH2_YIELD(break);
1695 }
1696 _SEH2_END;
1697
1698 /* Check for invalid PriorityClass value */
1699 if (PriorityClass.PriorityClass > PROCESS_PRIORITY_CLASS_ABOVE_NORMAL)
1700 {
1701 Status = STATUS_INVALID_PARAMETER;
1702 break;
1703 }
1704
1705 if ((PriorityClass.PriorityClass != Process->PriorityClass) &&
1706 (PriorityClass.PriorityClass == PROCESS_PRIORITY_CLASS_REALTIME))
1707 {
1708 /* Check the privilege */
1709 HasPrivilege = SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege,
1710 ProcessHandle,
1711 PROCESS_SET_INFORMATION,
1712 PreviousMode);
1713 if (!HasPrivilege)
1714 {
1715 ObDereferenceObject(Process);
1716 DPRINT1("Privilege to change priority to realtime lacking\n");
1717 return STATUS_PRIVILEGE_NOT_HELD;
1718 }
1719 }
1720
1721 /* Check if we have a job */
1722 if (Process->Job)
1723 {
1724 DPRINT1("Jobs not yet supported\n");
1725 }
1726
1727 /* Set process priority class */
1728 Process->PriorityClass = PriorityClass.PriorityClass;
1729
1730 /* Set process priority mode (foreground or background) */
1731 PsSetProcessPriorityByClass(Process,
1732 PriorityClass.Foreground ?
1733 PsProcessPriorityForeground :
1734 PsProcessPriorityBackground);
1735 Status = STATUS_SUCCESS;
1736 break;
1737
1738 case ProcessForegroundInformation:
1739
1740 /* Check buffer length */
1741 if (ProcessInformationLength != sizeof(PROCESS_FOREGROUND_BACKGROUND))
1742 {
1743 Status = STATUS_INFO_LENGTH_MISMATCH;
1744 break;
1745 }
1746
1747 /* Enter SEH for capture */
1748 _SEH2_TRY
1749 {
1750 /* Capture the caller's buffer */
1751 Foreground = *(PPROCESS_FOREGROUND_BACKGROUND)ProcessInformation;
1752 }
1753 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1754 {
1755 /* Return the exception code */
1756 Status = _SEH2_GetExceptionCode();
1757 _SEH2_YIELD(break);
1758 }
1759 _SEH2_END;
1760
1761 /* Set process priority mode (foreground or background) */
1762 PsSetProcessPriorityByClass(Process,
1763 Foreground.Foreground ?
1764 PsProcessPriorityForeground :
1765 PsProcessPriorityBackground);
1766 Status = STATUS_SUCCESS;
1767 break;
1768
1769 case ProcessBasePriority:
1770
1771 /* Validate input length */
1772 if (ProcessInformationLength != sizeof(KPRIORITY))
1773 {
1774 Status = STATUS_INFO_LENGTH_MISMATCH;
1775 break;
1776 }
1777
1778 /* Enter SEH for direct buffer read */
1779 _SEH2_TRY
1780 {
1781 BasePriority = *(KPRIORITY*)ProcessInformation;
1782 }
1783 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1784 {
1785 /* Get exception code */
1786 Break = 0;
1787 Status = _SEH2_GetExceptionCode();
1788 _SEH2_YIELD(break);
1789 }
1790 _SEH2_END;
1791
1792 /* Extract the memory priority out of there */
1793 if (BasePriority & 0x80000000)
1794 {
1795 MemoryPriority = MEMORY_PRIORITY_FOREGROUND;
1796 BasePriority &= ~0x80000000;
1797 }
1798 else
1799 {
1800 MemoryPriority = MEMORY_PRIORITY_BACKGROUND;
1801 }
1802
1803 /* Validate the number */
1804 if ((BasePriority > HIGH_PRIORITY) || (BasePriority <= LOW_PRIORITY))
1805 {
1806 ObDereferenceObject(Process);
1807 return STATUS_INVALID_PARAMETER;
1808 }
1809
1810 /* Check if the new base is higher */
1811 if (BasePriority > Process->Pcb.BasePriority)
1812 {
1813 HasPrivilege = SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege,
1814 ProcessHandle,
1815 PROCESS_SET_INFORMATION,
1816 PreviousMode);
1817 if (!HasPrivilege)
1818 {
1819 ObDereferenceObject(Process);
1820 DPRINT1("Privilege to change priority from %lx to %lx lacking\n", Process->Pcb.BasePriority, BasePriority);
1821 return STATUS_PRIVILEGE_NOT_HELD;
1822 }
1823 }
1824
1825 /* Call Ke */
1826 KeSetPriorityAndQuantumProcess(&Process->Pcb, BasePriority, 0);
1827
1828 /* Now set the memory priority */
1829 MmSetMemoryPriorityProcess(Process, MemoryPriority);
1830 Status = STATUS_SUCCESS;
1831 break;
1832
1833 case ProcessRaisePriority:
1834
1835 /* Validate input length */
1836 if (ProcessInformationLength != sizeof(ULONG))
1837 {
1838 Status = STATUS_INFO_LENGTH_MISMATCH;
1839 break;
1840 }
1841
1842 /* Enter SEH for direct buffer read */
1843 _SEH2_TRY
1844 {
1845 Boost = *(PULONG)ProcessInformation;
1846 }
1847 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1848 {
1849 /* Get exception code */
1850 Break = 0;
1851 Status = _SEH2_GetExceptionCode();
1852 _SEH2_YIELD(break);
1853 }
1854 _SEH2_END;
1855
1856 /* Make sure the process isn't dying */
1857 if (ExAcquireRundownProtection(&Process->RundownProtect))
1858 {
1859 /* Lock it */
1860 KeEnterCriticalRegion();
1861 ExAcquirePushLockShared(&Process->ProcessLock);
1862
1863 /* Loop the threads */
1864 for (Next = Process->ThreadListHead.Flink;
1865 Next != &Process->ThreadListHead;
1866 Next = Next->Flink)
1867 {
1868 /* Call Ke for the thread */
1869 Thread = CONTAINING_RECORD(Next, ETHREAD, ThreadListEntry);
1870 KeBoostPriorityThread(&Thread->Tcb, Boost);
1871 }
1872
1873 /* Release the lock and rundown */
1874 ExReleasePushLockShared(&Process->ProcessLock);
1875 KeLeaveCriticalRegion();
1876 ExReleaseRundownProtection(&Process->RundownProtect);
1877
1878 /* Set success code */
1879 Status = STATUS_SUCCESS;
1880 }
1881 else
1882 {
1883 /* Avoid race conditions */
1884 Status = STATUS_PROCESS_IS_TERMINATING;
1885 }
1886 break;
1887
1888 case ProcessBreakOnTermination:
1889
1890 /* Check buffer length */
1891 if (ProcessInformationLength != sizeof(ULONG))
1892 {
1893 Status = STATUS_INFO_LENGTH_MISMATCH;
1894 break;
1895 }
1896
1897 /* Enter SEH for direct buffer read */
1898 _SEH2_TRY
1899 {
1900 Break = *(PULONG)ProcessInformation;
1901 }
1902 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1903 {
1904 /* Get exception code */
1905 Break = 0;
1906 Status = _SEH2_GetExceptionCode();
1907 _SEH2_YIELD(break);
1908 }
1909 _SEH2_END;
1910
1911 /* Setting 'break on termination' requires the SeDebugPrivilege */
1912 if (!SeSinglePrivilegeCheck(SeDebugPrivilege, PreviousMode))
1913 {
1914 /* We don't hold the privilege, bail out */
1915 Status = STATUS_PRIVILEGE_NOT_HELD;
1916 break;
1917 }
1918
1919 /* Set or clear the flag */
1920 if (Break)
1921 {
1922 PspSetProcessFlag(Process, PSF_BREAK_ON_TERMINATION_BIT);
1923 }
1924 else
1925 {
1926 PspClearProcessFlag(Process, PSF_BREAK_ON_TERMINATION_BIT);
1927 }
1928
1929 break;
1930
1931 case ProcessAffinityMask:
1932
1933 /* Check buffer length */
1934 if (ProcessInformationLength != sizeof(KAFFINITY))
1935 {
1936 Status = STATUS_INFO_LENGTH_MISMATCH;
1937 break;
1938 }
1939
1940 /* Enter SEH for direct buffer read */
1941 _SEH2_TRY
1942 {
1943 Affinity = *(PKAFFINITY)ProcessInformation;
1944 }
1945 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1946 {
1947 /* Get exception code */
1948 Break = 0;
1949 Status = _SEH2_GetExceptionCode();
1950 _SEH2_YIELD(break);
1951 }
1952 _SEH2_END;
1953
1954 /* Make sure it's valid for the CPUs present */
1955 ValidAffinity = Affinity & KeActiveProcessors;
1956 if (!Affinity || (ValidAffinity != Affinity))
1957 {
1958 Status = STATUS_INVALID_PARAMETER;
1959 break;
1960 }
1961
1962 /* Check if it's within job affinity limits */
1963 if (Process->Job)
1964 {
1965 /* Not yet implemented */
1966 UNIMPLEMENTED;
1967 Status = STATUS_NOT_IMPLEMENTED;
1968 break;
1969 }
1970
1971 /* Make sure the process isn't dying */
1972 if (ExAcquireRundownProtection(&Process->RundownProtect))
1973 {
1974 /* Lock it */
1975 KeEnterCriticalRegion();
1976 ExAcquirePushLockShared(&Process->ProcessLock);
1977
1978 /* Call Ke to do the work */
1979 KeSetAffinityProcess(&Process->Pcb, ValidAffinity);
1980
1981 /* Release the lock and rundown */
1982 ExReleasePushLockShared(&Process->ProcessLock);
1983 KeLeaveCriticalRegion();
1984 ExReleaseRundownProtection(&Process->RundownProtect);
1985
1986 /* Set success code */
1987 Status = STATUS_SUCCESS;
1988 }
1989 else
1990 {
1991 /* Avoid race conditions */
1992 Status = STATUS_PROCESS_IS_TERMINATING;
1993 }
1994 break;
1995
1996 /* Priority Boosting status */
1997 case ProcessPriorityBoost:
1998
1999 /* Validate input length */
2000 if (ProcessInformationLength != sizeof(ULONG))
2001 {
2002 Status = STATUS_INFO_LENGTH_MISMATCH;
2003 break;
2004 }
2005
2006 /* Enter SEH for direct buffer read */
2007 _SEH2_TRY
2008 {
2009 DisableBoost = *(PBOOLEAN)ProcessInformation;
2010 }
2011 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2012 {
2013 /* Get exception code */
2014 Break = 0;
2015 Status = _SEH2_GetExceptionCode();
2016 _SEH2_YIELD(break);
2017 }
2018 _SEH2_END;
2019
2020 /* Make sure the process isn't dying */
2021 if (ExAcquireRundownProtection(&Process->RundownProtect))
2022 {
2023 /* Lock it */
2024 KeEnterCriticalRegion();
2025 ExAcquirePushLockShared(&Process->ProcessLock);
2026
2027 /* Call Ke to do the work */
2028 KeSetDisableBoostProcess(&Process->Pcb, DisableBoost);
2029
2030 /* Loop the threads too */
2031 for (Next = Process->ThreadListHead.Flink;
2032 Next != &Process->ThreadListHead;
2033 Next = Next->Flink)
2034 {
2035 /* Call Ke for the thread */
2036 Thread = CONTAINING_RECORD(Next, ETHREAD, ThreadListEntry);
2037 KeSetDisableBoostThread(&Thread->Tcb, DisableBoost);
2038 }
2039
2040 /* Release the lock and rundown */
2041 ExReleasePushLockShared(&Process->ProcessLock);
2042 KeLeaveCriticalRegion();
2043 ExReleaseRundownProtection(&Process->RundownProtect);
2044
2045 /* Set success code */
2046 Status = STATUS_SUCCESS;
2047 }
2048 else
2049 {
2050 /* Avoid race conditions */
2051 Status = STATUS_PROCESS_IS_TERMINATING;
2052 }
2053 break;
2054
2055 case ProcessDebugFlags:
2056
2057 /* Check buffer length */
2058 if (ProcessInformationLength != sizeof(ULONG))
2059 {
2060 Status = STATUS_INFO_LENGTH_MISMATCH;
2061 break;
2062 }
2063
2064 /* Enter SEH for direct buffer read */
2065 _SEH2_TRY
2066 {
2067 DebugFlags = *(PULONG)ProcessInformation;
2068 }
2069 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2070 {
2071 /* Get exception code */
2072 Status = _SEH2_GetExceptionCode();
2073 _SEH2_YIELD(break);
2074 }
2075 _SEH2_END;
2076
2077 /* Set the mode */
2078 if (DebugFlags & ~1)
2079 {
2080 Status = STATUS_INVALID_PARAMETER;
2081 }
2082 else
2083 {
2084 if (DebugFlags & 1)
2085 {
2086 PspClearProcessFlag(Process, PSF_NO_DEBUG_INHERIT_BIT);
2087 }
2088 else
2089 {
2090 PspSetProcessFlag(Process, PSF_NO_DEBUG_INHERIT_BIT);
2091 }
2092 }
2093
2094 /* Done */
2095 Status = STATUS_SUCCESS;
2096 break;
2097
2098 case ProcessEnableAlignmentFaultFixup:
2099
2100 /* Check buffer length */
2101 if (ProcessInformationLength != sizeof(BOOLEAN))
2102 {
2103 Status = STATUS_INFO_LENGTH_MISMATCH;
2104 break;
2105 }
2106
2107 /* Enter SEH for direct buffer read */
2108 _SEH2_TRY
2109 {
2110 EnableFixup = *(PULONG)ProcessInformation;
2111 }
2112 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2113 {
2114 /* Get exception code */
2115 Status = _SEH2_GetExceptionCode();
2116 _SEH2_YIELD(break);
2117 }
2118 _SEH2_END;
2119
2120 /* Set the mode */
2121 if (EnableFixup)
2122 {
2123 Process->DefaultHardErrorProcessing |= SEM_NOALIGNMENTFAULTEXCEPT;
2124 }
2125 else
2126 {
2127 Process->DefaultHardErrorProcessing &= ~SEM_NOALIGNMENTFAULTEXCEPT;
2128 }
2129
2130 /* Call Ke for the update */
2131 KeSetAutoAlignmentProcess(&Process->Pcb, FALSE);
2132 Status = STATUS_SUCCESS;
2133 break;
2134
2135 case ProcessUserModeIOPL:
2136
2137 /* Only TCB can do this */
2138 if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode))
2139 {
2140 /* We don't hold the privilege, bail out */
2141 DPRINT1("Need TCB to set IOPL\n");
2142 Status = STATUS_PRIVILEGE_NOT_HELD;
2143 break;
2144 }
2145
2146 /* Only supported on x86 */
2147#if defined (_X86_)
2148 Ke386SetIOPL();
2149#elif defined(_M_AMD64)
2150 /* On x64 this function isn't implemented.
2151 On Windows 2003 it returns success.
2152 On Vista+ it returns STATUS_NOT_IMPLEMENTED. */
2153 if ((ExGetPreviousMode() != KernelMode) &&
2154 (RtlRosGetAppcompatVersion() > _WIN32_WINNT_WS03))
2155 {
2156 Status = STATUS_NOT_IMPLEMENTED;
2157 }
2158#else
2159 Status = STATUS_NOT_IMPLEMENTED;
2160#endif
2161 /* Done */
2162 break;
2163
2164 case ProcessExecuteFlags:
2165
2166 /* Check buffer length */
2167 if (ProcessInformationLength != sizeof(ULONG))
2168 {
2169 Status = STATUS_INFO_LENGTH_MISMATCH;
2170 break;
2171 }
2172
2173 if (ProcessHandle != NtCurrentProcess())
2174 {
2175 Status = STATUS_INVALID_PARAMETER;
2176 break;
2177 }
2178
2179 /* Enter SEH for direct buffer read */
2180 _SEH2_TRY
2181 {
2182 NoExecute = *(PULONG)ProcessInformation;
2183 }
2184 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2185 {
2186 /* Get exception code */
2187 Status = _SEH2_GetExceptionCode();
2188 _SEH2_YIELD(break);
2189 }
2190 _SEH2_END;
2191
2192 /* Call Mm for the update */
2193 Status = MmSetExecuteOptions(NoExecute);
2194 break;
2195
2196 case ProcessDeviceMap:
2197
2198 /* Check buffer length */
2199 if (ProcessInformationLength != sizeof(HANDLE))
2200 {
2201 Status = STATUS_INFO_LENGTH_MISMATCH;
2202 break;
2203 }
2204
2205 /* Use SEH for capture */
2206 _SEH2_TRY
2207 {
2208 /* Capture the handle */
2209 DirectoryHandle = *(PHANDLE)ProcessInformation;
2210 }
2211 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2212 {
2213 /* Get the exception code */
2214 Status = _SEH2_GetExceptionCode();
2215 _SEH2_YIELD(break);
2216 }
2217 _SEH2_END;
2218
2219 /* Call Ob to set the device map */
2220 Status = ObSetDeviceMap(Process, DirectoryHandle);
2221 break;
2222
2223
2224 /* We currently don't implement any of these */
2225 case ProcessLdtInformation:
2226 case ProcessLdtSize:
2227 case ProcessIoPortHandlers:
2228 DPRINT1("VDM/16-bit Request not implemented: %lu\n", ProcessInformationClass);
2229 Status = STATUS_NOT_IMPLEMENTED;
2230 break;
2231
2232 case ProcessQuotaLimits:
2233
2234 Status = PspSetQuotaLimits(Process,
2235 1,
2236 ProcessInformation,
2237 ProcessInformationLength,
2238 PreviousMode);
2239 break;
2240
2241 case ProcessWorkingSetWatch:
2242 DPRINT1("WS watch not implemented\n");
2243 Status = STATUS_NOT_IMPLEMENTED;
2244 break;
2245
2246 case ProcessHandleTracing:
2247 DPRINT1("Handle tracing not implemented\n");
2248 Status = STATUS_NOT_IMPLEMENTED;
2249 break;
2250
2251 /* Anything else is invalid */
2252 default:
2253#if DBG
2254 DPRINT1("Invalid Server 2003 Info Class: %s\n", PspDumpProcessInfoClassName(ProcessInformationClass));
2255#endif
2256 Status = STATUS_INVALID_INFO_CLASS;
2257 }
2258
2259 /* Dereference and return status */
2260 ObDereferenceObject(Process);
2261 return Status;
2262}
STATUS_PRIVILEGE_NOT_HELD
#define STATUS_PRIVILEGE_NOT_HELD
Definition: DriverTester.h:9
DirectoryHandle
static HANDLE DirectoryHandle
Definition: ObType.c:48
PKAFFINITY
KAFFINITY * PKAFFINITY
Definition: basetsd.h:189
UNIMPLEMENTED
#define UNIMPLEMENTED
Definition: ntoskrnl.c:15
KAFFINITY
ULONG_PTR KAFFINITY
Definition: compat.h:85
KPRIORITY
LONG KPRIORITY
Definition: compat.h:803
ExAcquirePushLockShared
FORCEINLINE VOID ExAcquirePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1108
ExReleasePushLockShared
FORCEINLINE VOID ExReleasePushLockShared(PEX_PUSH_LOCK PushLock)
Definition: ex.h:1216
PROCESS_SUSPEND_RESUME
#define PROCESS_SUSPEND_RESUME
Definition: pstypes.h:168
PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
Definition: pstypes.h:113
PSF_NO_DEBUG_INHERIT_BIT
#define PSF_NO_DEBUG_INHERIT_BIT
Definition: pstypes.h:275
PROCESS_SET_SESSIONID
#define PROCESS_SET_SESSIONID
Definition: pstypes.h:160
PsProcessPriorityForeground
@ PsProcessPriorityForeground
Definition: pstypes.h:460
PsProcessPriorityBackground
@ PsProcessPriorityBackground
Definition: pstypes.h:461
PROCESS_SET_INFORMATION
#define PROCESS_SET_INFORMATION
Definition: pstypes.h:166
PSF_VDM_ALLOWED_BIT
#define PSF_VDM_ALLOWED_BIT
Definition: pstypes.h:297
PROCESS_PRIORITY_CLASS_REALTIME
#define PROCESS_PRIORITY_CLASS_REALTIME
Definition: pstypes.h:111
PPROCESS_FOREGROUND_BACKGROUND
struct _PROCESS_FOREGROUND_BACKGROUND * PPROCESS_FOREGROUND_BACKGROUND
MEMORY_PRIORITY_BACKGROUND
#define MEMORY_PRIORITY_BACKGROUND
Definition: pstypes.h:125
PSF_BREAK_ON_TERMINATION_BIT
#define PSF_BREAK_ON_TERMINATION_BIT
Definition: pstypes.h:286
MEMORY_PRIORITY_FOREGROUND
#define MEMORY_PRIORITY_FOREGROUND
Definition: pstypes.h:127
LOW_PRIORITY
#define LOW_PRIORITY
HIGH_PRIORITY
#define HIGH_PRIORITY
InterlockedCompareExchangePointer
#define InterlockedCompareExchangePointer
Definition: interlocked.h:144
KeLeaveCriticalRegion
#define KeLeaveCriticalRegion()
Definition: ke_x.h:119
KeEnterCriticalRegion
#define KeEnterCriticalRegion()
Definition: ke_x.h:88
LpcPortObjectType
POBJECT_TYPE LpcPortObjectType
Definition: port.c:17
KernelMode
#define KernelMode
Definition: asm.h:38
TokenHandle
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
Definition: psfuncs.h:727
SEM_NOALIGNMENTFAULTEXCEPT
#define SEM_NOALIGNMENTFAULTEXCEPT
Definition: rtltypes.h:71
ACCESS_MASK
ULONG ACCESS_MASK
Definition: nt_native.h:40
PPROCESS_ACCESS_TOKEN
struct _PROCESS_ACCESS_TOKEN * PPROCESS_ACCESS_TOKEN
KeSetAffinityProcess
KAFFINITY NTAPI KeSetAffinityProcess(IN PKPROCESS Process, IN KAFFINITY Affinity)
Definition: procobj.c:265
KeActiveProcessors
KAFFINITY KeActiveProcessors
Definition: processor.c:16
Ke386SetIOPL
VOID NTAPI Ke386SetIOPL(VOID)
Definition: v86vdm.c:595
KeSetDisableBoostProcess
BOOLEAN NTAPI KeSetDisableBoostProcess(IN PKPROCESS Process, IN BOOLEAN Disable)
Definition: procobj.c:331
KeSetDisableBoostThread
BOOLEAN NTAPI KeSetDisableBoostThread(IN OUT PKTHREAD Thread, IN BOOLEAN Disable)
Definition: thrdobj.c:86
KeSetAutoAlignmentProcess
BOOLEAN NTAPI KeSetAutoAlignmentProcess(IN PKPROCESS Process, IN BOOLEAN Enable)
Definition: procobj.c:313
KeBoostPriorityThread
VOID NTAPI KeBoostPriorityThread(IN PKTHREAD Thread, IN KPRIORITY Increment)
Definition: thrdobj.c:220
KeSetPriorityAndQuantumProcess
KPRIORITY NTAPI KeSetPriorityAndQuantumProcess(IN PKPROCESS Process, IN KPRIORITY Priority, IN UCHAR Quantum OPTIONAL)
Definition: procobj.c:349
MmSetExecuteOptions
NTSTATUS NTAPI MmSetExecuteOptions(IN ULONG ExecuteOptions)
Definition: pagfault.c:2695
MmSetMemoryPriorityProcess
NTSTATUS NTAPI MmSetMemoryPriorityProcess(IN PEPROCESS Process, IN UCHAR MemoryPriority)
Definition: procsup.c:487
DefaultSetInfoBufferCheck
static __inline NTSTATUS DefaultSetInfoBufferCheck(_In_ ULONG Class, _In_ const INFORMATION_CLASS_INFO *ClassList, _In_ ULONG ClassListEntries, _In_ PVOID Buffer, _In_ ULONG BufferLength, _In_ KPROCESSOR_MODE PreviousMode)
Probe helper that validates the provided parameters whenever a NtSet*** system call is invoked from u...
Definition: probe.h:70
SeDebugPrivilege
const LUID SeDebugPrivilege
Definition: priv.c:39
SeCheckPrivilegedObject
BOOLEAN NTAPI SeCheckPrivilegedObject(_In_ LUID PrivilegeValue, _In_ HANDLE ObjectHandle, _In_ ACCESS_MASK DesiredAccess, _In_ KPROCESSOR_MODE PreviousMode)
Checks a privileged object if such object has the specific privilege submitted by the caller.
Definition: priv.c:803
SeTcbPrivilege
const LUID SeTcbPrivilege
Definition: priv.c:26
SeIncreaseBasePriorityPrivilege
const LUID SeIncreaseBasePriorityPrivilege
Definition: priv.c:33
PsSetProcessPriorityByClass
VOID NTAPI PsSetProcessPriorityByClass(IN PEPROCESS Process, IN PSPROCESSPRIORITYMODE Type)
Definition: process.c:1325
SeSinglePrivilegeCheck
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
Definition: priv.c:744
STATUS_PROCESS_IS_TERMINATING
#define STATUS_PROCESS_IS_TERMINATING
Definition: ntstatus.h:596
STATUS_PORT_ALREADY_SET
#define STATUS_PORT_ALREADY_SET
Definition: ntstatus.h:402
ObSetDeviceMap
NTSTATUS NTAPI ObSetDeviceMap(IN PEPROCESS Process, IN HANDLE DirectoryHandle)
Definition: devicemap.c:24
PspSetPrimaryToken
NTSTATUS NTAPI PspSetPrimaryToken(IN PEPROCESS Process, IN HANDLE TokenHandle OPTIONAL, IN PACCESS_TOKEN Token OPTIONAL)
Definition: security.c:215
PspSetQuotaLimits
NTSTATUS NTAPI PspSetQuotaLimits(_In_ PEPROCESS Process, _In_ ULONG Unused, _In_ PVOID QuotaLimits, _In_ ULONG QuotaLimitsLength, _In_ KPROCESSOR_MODE PreviousMode)
This function adjusts the working set limits of a process and sets up new quota limits when necessary...
Definition: quota.c:1045
PspClearProcessFlag
#define PspClearProcessFlag(Process, Flag)
Definition: ps_x.h:35
PspSetProcessFlag
#define PspSetProcessFlag(Process, Flag)
Definition: ps_x.h:33
_WIN32_WINNT_WS03
#define _WIN32_WINNT_WS03
Definition: sdkddkver.h:23
Next
STDMETHOD() Next(THIS_ ULONG celt, IAssociationElement *pElement, ULONG *pceltFetched) PURE
_LIST_ENTRY
Definition: typedefs.h:120
_PROCESS_ACCESS_TOKEN
Definition: ntddk.h:9
_PROCESS_FOREGROUND_BACKGROUND
Definition: pstypes.h:1048
_PROCESS_FOREGROUND_BACKGROUND::Foreground
BOOLEAN Foreground
Definition: pstypes.h:1049
CONTAINING_RECORD
#define CONTAINING_RECORD(address, type, field)
Definition: typedefs.h:260
STATUS_ACCESS_DENIED
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
HasPrivilege
BOOLEAN HasPrivilege(IN PPRIVILEGE_SET Privilege)
Definition: shutdown.c:92
ProcessAffinityMask
@ ProcessAffinityMask
Definition: winternl.h:1903
ProcessIoPortHandlers
@ ProcessIoPortHandlers
Definition: winternl.h:1895
ProcessRaisePriority
@ ProcessRaisePriority
Definition: winternl.h:1888
ProcessLdtSize
@ ProcessLdtSize
Definition: winternl.h:1893
ProcessEnableAlignmentFaultFixup
@ ProcessEnableAlignmentFaultFixup
Definition: winternl.h:1899
ProcessBasePriority
@ ProcessBasePriority
Definition: winternl.h:1887
ProcessAccessToken
@ ProcessAccessToken
Definition: winternl.h:1891
ProcessForegroundInformation
@ ProcessForegroundInformation
Definition: winternl.h:1907
ProcessExceptionPort
@ ProcessExceptionPort
Definition: winternl.h:1890
ProcessUserModeIOPL
@ ProcessUserModeIOPL
Definition: winternl.h:1898
Affinity
_In_ ULONG _In_ ULONG _In_ ULONG _Out_ PKIRQL _Out_ PKAFFINITY Affinity
Definition: halfuncs.h:174
UCHAR
unsigned char UCHAR
Definition: xmlstorage.h:181

Referenced by _main(), CreateProcessInternalW(), CSR_API(), CsrCreateProcess(), CsrpSetDefaultProcessHardErrorMode(), CsrSbCreateSession(), CsrSetBackgroundPriority(), CsrSetForegroundPriority(), CsrSetToNormalPriority(), CsrSetToShutdownPriority(), EmptyWorkingSet(), InitFunctionPtrs(), InitializeProcessForWsWatch(), InsertTokenToProcessCommon(), LdrpInitializeProcess(), QuerySetProcessValidator(), SetErrorMode(), SetPriorityClass(), SetProcessAffinityMask(), SetProcessInformation(), SetProcessPriorityBoost(), SetProcessWorkingSetSizeEx(), SmpInit(), SmpSbCreateSession(), SmpSetProcessMuSessionId(), Test_ProcBasePriorityClass(), Test_ProcessWx86InformationClass(), Test_ProcForegroundBackgroundClass(), and Test_ProcRaisePriorityClass().

◆ NtSetInformationThread()

NTSTATUS NTAPI NtSetInformationThread ( _In_ HANDLE  ThreadHandle,
_In_ THREADINFOCLASS  ThreadInformationClass,
_In_reads_bytes_(ThreadInformationLength) PVOID  ThreadInformation,
_In_ ULONG  ThreadInformationLength 
)

Definition at line 2269 of file query.c.

2274{
2275 PETHREAD Thread;
2276 KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
2277 NTSTATUS Status;
2278 KPRIORITY Priority = 0;
2279 PEPROCESS Process;
2280 PTEB Teb;
2281
2282 PAGED_CODE();
2283
2284 /* Validate the information class */
2285 Status = DefaultSetInfoBufferCheck(ThreadInformationClass,
2286 PsThreadInfoClass,
2287 RTL_NUMBER_OF(PsThreadInfoClass),
2288 ThreadInformation,
2289 ThreadInformationLength,
2290 PreviousMode);
2291 if (!NT_SUCCESS(Status))
2292 {
2293#if DBG
2294 DPRINT1("NtSetInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
2295 PspDumpThreadInfoClassName(ThreadInformationClass), Status);
2296#endif
2297 return Status;
2298 }
2299
2300 /* Check what kind of information class this is */
2301 switch (ThreadInformationClass)
2302 {
2303 /* Thread priority */
2304 case ThreadPriority:
2305 {
2306 /* Check buffer length */
2307 if (ThreadInformationLength != sizeof(KPRIORITY))
2308 {
2309 Status = STATUS_INFO_LENGTH_MISMATCH;
2310 break;
2311 }
2312
2313 /* Use SEH for capture */
2314 _SEH2_TRY
2315 {
2316 /* Get the priority */
2317 Priority = *(PLONG)ThreadInformation;
2318 }
2319 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2320 {
2321 /* Get the exception code */
2322 Status = _SEH2_GetExceptionCode();
2323 _SEH2_YIELD(break);
2324 }
2325 _SEH2_END;
2326
2327 /* Validate it */
2328 if ((Priority > HIGH_PRIORITY) ||
2329 (Priority <= LOW_PRIORITY))
2330 {
2331 /* Fail */
2332 Status = STATUS_INVALID_PARAMETER;
2333 break;
2334 }
2335
2336 /* Check for the required privilege */
2337 if (Priority >= LOW_REALTIME_PRIORITY)
2338 {
2339 BOOLEAN HasPrivilege;
2340 HasPrivilege = SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege,
2341 ThreadHandle,
2342 THREAD_SET_INFORMATION,
2343 PreviousMode);
2344 if (!HasPrivilege)
2345 {
2346 DPRINT1("Privilege to change priority to %lx lacking\n", Priority);
2347 return STATUS_PRIVILEGE_NOT_HELD;
2348 }
2349 }
2350
2351 /* Reference the thread */
2352 Status = ObReferenceObjectByHandle(ThreadHandle,
2353 THREAD_SET_INFORMATION,
2354 PsThreadType,
2355 PreviousMode,
2356 (PVOID*)&Thread,
2357 NULL);
2358 if (!NT_SUCCESS(Status))
2359 break;
2360
2361 /* Set the priority */
2362 KeSetPriorityThread(&Thread->Tcb, Priority);
2363
2364 /* Dereference the thread */
2365 ObDereferenceObject(Thread);
2366 break;
2367 }
2368
2369 case ThreadBasePriority:
2370 {
2371 /* Check buffer length */
2372 if (ThreadInformationLength != sizeof(LONG))
2373 {
2374 Status = STATUS_INFO_LENGTH_MISMATCH;
2375 break;
2376 }
2377
2378 /* Use SEH for capture */
2379 _SEH2_TRY
2380 {
2381 /* Get the priority */
2382 Priority = *(PLONG)ThreadInformation;
2383 }
2384 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2385 {
2386 /* Get the exception code */
2387 Status = _SEH2_GetExceptionCode();
2388 _SEH2_YIELD(break);
2389 }
2390 _SEH2_END;
2391
2392 /* Validate it */
2393 if ((Priority > THREAD_BASE_PRIORITY_MAX) ||
2394 (Priority < THREAD_BASE_PRIORITY_MIN))
2395 {
2396 /* These ones are OK */
2397 if ((Priority != THREAD_BASE_PRIORITY_LOWRT + 1) &&
2398 (Priority != THREAD_BASE_PRIORITY_IDLE - 1))
2399 {
2400 /* Check if the process is real time */
2401 if (PsGetCurrentProcess()->PriorityClass !=
2402 PROCESS_PRIORITY_CLASS_REALTIME)
2403 {
2404 /* It isn't, fail */
2405 Status = STATUS_INVALID_PARAMETER;
2406 break;
2407 }
2408 }
2409 }
2410
2411 /* Reference the thread */
2412 Status = ObReferenceObjectByHandle(ThreadHandle,
2413 THREAD_SET_INFORMATION,
2414 PsThreadType,
2415 PreviousMode,
2416 (PVOID*)&Thread,
2417 NULL);
2418 if (!NT_SUCCESS(Status))
2419 break;
2420
2421 /* Set the base priority */
2422 KeSetBasePriorityThread(&Thread->Tcb, Priority);
2423
2424 /* Dereference the thread */
2425 ObDereferenceObject(Thread);
2426 break;
2427 }
2428
2429 case ThreadAffinityMask:
2430 {
2431 KAFFINITY Affinity = 0, CombinedAffinity;
2432
2433 /* Check buffer length */
2434 if (ThreadInformationLength != sizeof(ULONG_PTR))
2435 {
2436 Status = STATUS_INFO_LENGTH_MISMATCH;
2437 break;
2438 }
2439
2440 /* Use SEH for capture */
2441 _SEH2_TRY
2442 {
2443 /* Get the priority */
2444 Affinity = *(PULONG_PTR)ThreadInformation;
2445 }
2446 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2447 {
2448 /* Get the exception code */
2449 Status = _SEH2_GetExceptionCode();
2450 _SEH2_YIELD(break);
2451 }
2452 _SEH2_END;
2453
2454 /* Validate it */
2455 if (!Affinity)
2456 {
2457 /* Fail */
2458 Status = STATUS_INVALID_PARAMETER;
2459 break;
2460 }
2461
2462 /* Reference the thread */
2463 Status = ObReferenceObjectByHandle(ThreadHandle,
2464 THREAD_SET_INFORMATION,
2465 PsThreadType,
2466 PreviousMode,
2467 (PVOID*)&Thread,
2468 NULL);
2469 if (!NT_SUCCESS(Status))
2470 break;
2471
2472 /* Get the process */
2473 Process = Thread->ThreadsProcess;
2474
2475 /* Try to acquire rundown */
2476 if (ExAcquireRundownProtection(&Process->RundownProtect))
2477 {
2478 /* Lock it */
2479 KeEnterCriticalRegion();
2480 ExAcquirePushLockShared(&Process->ProcessLock);
2481
2482 /* Combine masks */
2483 CombinedAffinity = Affinity & Process->Pcb.Affinity;
2484 if (CombinedAffinity != Affinity)
2485 {
2486 /* Fail */
2487 Status = STATUS_INVALID_PARAMETER;
2488 }
2489 else
2490 {
2491 /* Set the affinity */
2492 KeSetAffinityThread(&Thread->Tcb, CombinedAffinity);
2493 }
2494
2495 /* Release the lock and rundown */
2496 ExReleasePushLockShared(&Process->ProcessLock);
2497 KeLeaveCriticalRegion();
2498 ExReleaseRundownProtection(&Process->RundownProtect);
2499 }
2500 else
2501 {
2502 /* Too late */
2503 Status = STATUS_PROCESS_IS_TERMINATING;
2504 }
2505
2506 /* Dereference the thread */
2507 ObDereferenceObject(Thread);
2508 break;
2509 }
2510
2511 case ThreadImpersonationToken:
2512 {
2513 HANDLE TokenHandle;
2514
2515 /* Check buffer length */
2516 if (ThreadInformationLength != sizeof(HANDLE))
2517 {
2518 Status = STATUS_INFO_LENGTH_MISMATCH;
2519 break;
2520 }
2521
2522 /* Use SEH for capture */
2523 _SEH2_TRY
2524 {
2525 /* Save the token handle */
2526 TokenHandle = *(PHANDLE)ThreadInformation;
2527 }
2528 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2529 {
2530 /* Get the exception code */
2531 Status = _SEH2_GetExceptionCode();
2532 _SEH2_YIELD(break);
2533 }
2534 _SEH2_END;
2535
2536 /* Reference the thread */
2537 Status = ObReferenceObjectByHandle(ThreadHandle,
2538 THREAD_SET_THREAD_TOKEN,
2539 PsThreadType,
2540 PreviousMode,
2541 (PVOID*)&Thread,
2542 NULL);
2543 if (!NT_SUCCESS(Status))
2544 break;
2545
2546 /* Assign the actual token */
2547 Status = PsAssignImpersonationToken(Thread, TokenHandle);
2548
2549 /* Dereference the thread */
2550 ObDereferenceObject(Thread);
2551 break;
2552 }
2553
2554 case ThreadQuerySetWin32StartAddress:
2555 {
2556 PVOID Address;
2557
2558 /* Check buffer length */
2559 if (ThreadInformationLength != sizeof(ULONG_PTR))
2560 {
2561 Status = STATUS_INFO_LENGTH_MISMATCH;
2562 break;
2563 }
2564
2565 /* Use SEH for capture */
2566 _SEH2_TRY
2567 {
2568 /* Get the priority */
2569 Address = *(PVOID*)ThreadInformation;
2570 }
2571 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2572 {
2573 /* Get the exception code */
2574 Status = _SEH2_GetExceptionCode();
2575 _SEH2_YIELD(break);
2576 }
2577 _SEH2_END;
2578
2579 /* Reference the thread */
2580 Status = ObReferenceObjectByHandle(ThreadHandle,
2581 THREAD_SET_INFORMATION,
2582 PsThreadType,
2583 PreviousMode,
2584 (PVOID*)&Thread,
2585 NULL);
2586 if (!NT_SUCCESS(Status))
2587 break;
2588
2589 /* Set the address */
2590 Thread->Win32StartAddress = Address;
2591
2592 /* Dereference the thread */
2593 ObDereferenceObject(Thread);
2594 break;
2595 }
2596
2597 case ThreadIdealProcessor:
2598 {
2599 ULONG_PTR IdealProcessor;
2600
2601 /* Check buffer length */
2602 if (ThreadInformationLength != sizeof(ULONG_PTR))
2603 {
2604 Status = STATUS_INFO_LENGTH_MISMATCH;
2605 break;
2606 }
2607
2608 /* Use SEH for capture */
2609 _SEH2_TRY
2610 {
2611 /* Get the priority */
2612 IdealProcessor = *(PULONG_PTR)ThreadInformation;
2613 }
2614 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2615 {
2616 /* Get the exception code */
2617 Status = _SEH2_GetExceptionCode();
2618 _SEH2_YIELD(break);
2619 }
2620 _SEH2_END;
2621
2622 /* Validate it */
2623 if (IdealProcessor > MAXIMUM_PROCESSORS)
2624 {
2625 /* Fail */
2626 Status = STATUS_INVALID_PARAMETER;
2627 break;
2628 }
2629
2630 /* Reference the thread */
2631 Status = ObReferenceObjectByHandle(ThreadHandle,
2632 THREAD_SET_INFORMATION,
2633 PsThreadType,
2634 PreviousMode,
2635 (PVOID*)&Thread,
2636 NULL);
2637 if (!NT_SUCCESS(Status))
2638 break;
2639
2640 /* Set the ideal */
2641 Status = KeSetIdealProcessorThread(&Thread->Tcb,
2642 (CCHAR)IdealProcessor);
2643
2644 /* Get the TEB and protect the thread */
2645 Teb = Thread->Tcb.Teb;
2646 if (Teb && ExAcquireRundownProtection(&Thread->RundownProtect))
2647 {
2648 /* Save the ideal processor */
2649 Teb->IdealProcessor = Thread->Tcb.IdealProcessor;
2650
2651 /* Release rundown protection */
2652 ExReleaseRundownProtection(&Thread->RundownProtect);
2653 }
2654
2655 /* Dereference the thread */
2656 ObDereferenceObject(Thread);
2657 break;
2658 }
2659
2660 case ThreadPriorityBoost:
2661 {
2662 ULONG_PTR DisableBoost;
2663
2664 /* Check buffer length */
2665 if (ThreadInformationLength != sizeof(ULONG_PTR))
2666 {
2667 Status = STATUS_INFO_LENGTH_MISMATCH;
2668 break;
2669 }
2670
2671 /* Use SEH for capture */
2672 _SEH2_TRY
2673 {
2674 /* Get the priority */
2675 DisableBoost = *(PULONG_PTR)ThreadInformation;
2676 }
2677 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2678 {
2679 /* Get the exception code */
2680 Status = _SEH2_GetExceptionCode();
2681 _SEH2_YIELD(break);
2682 }
2683 _SEH2_END;
2684
2685 /* Reference the thread */
2686 Status = ObReferenceObjectByHandle(ThreadHandle,
2687 THREAD_SET_INFORMATION,
2688 PsThreadType,
2689 PreviousMode,
2690 (PVOID*)&Thread,
2691 NULL);
2692 if (!NT_SUCCESS(Status))
2693 break;
2694
2695 /* Call the kernel */
2696 KeSetDisableBoostThread(&Thread->Tcb, (BOOLEAN)DisableBoost);
2697
2698 /* Dereference the thread */
2699 ObDereferenceObject(Thread);
2700 break;
2701 }
2702
2703 case ThreadZeroTlsCell:
2704 {
2705 ULONG_PTR TlsIndex;
2706 PETHREAD ProcThread;
2707
2708 /* Check buffer length */
2709 if (ThreadInformationLength != sizeof(ULONG))
2710 {
2711 Status = STATUS_INFO_LENGTH_MISMATCH;
2712 break;
2713 }
2714
2715 /* Use SEH for capture */
2716 _SEH2_TRY
2717 {
2718 /* Get the priority */
2719 TlsIndex = *(PULONG)ThreadInformation;
2720 }
2721 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2722 {
2723 /* Get the exception code */
2724 Status = _SEH2_GetExceptionCode();
2725 _SEH2_YIELD(break);
2726 }
2727 _SEH2_END;
2728
2729 /* Reference the thread */
2730 Status = ObReferenceObjectByHandle(ThreadHandle,
2731 THREAD_SET_INFORMATION,
2732 PsThreadType,
2733 PreviousMode,
2734 (PVOID*)&Thread,
2735 NULL);
2736 if (!NT_SUCCESS(Status))
2737 break;
2738
2739 /* This is only valid for the current thread */
2740 if (Thread != PsGetCurrentThread())
2741 {
2742 /* Fail */
2743 Status = STATUS_INVALID_PARAMETER;
2744 ObDereferenceObject(Thread);
2745 break;
2746 }
2747
2748 /* Get the process */
2749 Process = Thread->ThreadsProcess;
2750
2751 /* Loop the threads */
2752 ProcThread = PsGetNextProcessThread(Process, NULL);
2753 while (ProcThread)
2754 {
2755 /* Acquire rundown */
2756 if (ExAcquireRundownProtection(&ProcThread->RundownProtect))
2757 {
2758 /* Get the TEB */
2759 Teb = ProcThread->Tcb.Teb;
2760 if (Teb)
2761 {
2762 /* Check if we're in the expansion range */
2763 if (TlsIndex > TLS_MINIMUM_AVAILABLE - 1)
2764 {
2765 if (TlsIndex < (TLS_MINIMUM_AVAILABLE +
2766 TLS_EXPANSION_SLOTS) - 1)
2767 {
2768 /* Check if we have expansion slots */
2769 PVOID* ExpansionSlots = Teb->TlsExpansionSlots;
2770 if (ExpansionSlots)
2771 {
2772 /* Clear the index */
2773 ExpansionSlots[TlsIndex - TLS_MINIMUM_AVAILABLE] = 0;
2774 }
2775 }
2776 }
2777 else
2778 {
2779 /* Clear the index */
2780 Teb->TlsSlots[TlsIndex] = NULL;
2781 }
2782 }
2783
2784 /* Release rundown */
2785 ExReleaseRundownProtection(&ProcThread->RundownProtect);
2786 }
2787
2788 /* Go to the next thread */
2789 ProcThread = PsGetNextProcessThread(Process, ProcThread);
2790 }
2791
2792 /* Dereference the thread */
2793 ObDereferenceObject(Thread);
2794 break;
2795 }
2796
2797 case ThreadBreakOnTermination:
2798 {
2799 ULONG Break;
2800
2801 /* Check buffer length */
2802 if (ThreadInformationLength != sizeof(ULONG))
2803 {
2804 Status = STATUS_INFO_LENGTH_MISMATCH;
2805 break;
2806 }
2807
2808 /* Enter SEH for direct buffer read */
2809 _SEH2_TRY
2810 {
2811 Break = *(PULONG)ThreadInformation;
2812 }
2813 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
2814 {
2815 /* Get exception code */
2816 Break = 0;
2817 Status = _SEH2_GetExceptionCode();
2818 _SEH2_YIELD(break);
2819 }
2820 _SEH2_END;
2821
2822 /* Setting 'break on termination' requires the SeDebugPrivilege */
2823 if (!SeSinglePrivilegeCheck(SeDebugPrivilege, PreviousMode))
2824 {
2825 /* We don't hold the privilege, bail out */
2826 Status = STATUS_PRIVILEGE_NOT_HELD;
2827 break;
2828 }
2829
2830 /* Reference the thread */
2831 Status = ObReferenceObjectByHandle(ThreadHandle,
2832 THREAD_SET_INFORMATION,
2833 PsThreadType,
2834 PreviousMode,
2835 (PVOID*)&Thread,
2836 NULL);
2837 if (!NT_SUCCESS(Status))
2838 break;
2839
2840 /* Set or clear the flag */
2841 if (Break)
2842 {
2843 PspSetCrossThreadFlag(Thread, CT_BREAK_ON_TERMINATION_BIT);
2844 }
2845 else
2846 {
2847 PspClearCrossThreadFlag(Thread, CT_BREAK_ON_TERMINATION_BIT);
2848 }
2849
2850 /* Dereference the thread */
2851 ObDereferenceObject(Thread);
2852 break;
2853 }
2854
2855 case ThreadHideFromDebugger:
2856 {
2857 /* Check buffer length */
2858 if (ThreadInformationLength != 0)
2859 {
2860 Status = STATUS_INFO_LENGTH_MISMATCH;
2861 break;
2862 }
2863
2864 /* Reference the thread */
2865 Status = ObReferenceObjectByHandle(ThreadHandle,
2866 THREAD_SET_INFORMATION,
2867 PsThreadType,
2868 PreviousMode,
2869 (PVOID*)&Thread,
2870 NULL);
2871 if (!NT_SUCCESS(Status))
2872 break;
2873
2874 /* Set the flag */
2875 PspSetCrossThreadFlag(Thread, CT_HIDE_FROM_DEBUGGER_BIT);
2876
2877 /* Dereference the thread */
2878 ObDereferenceObject(Thread);
2879 break;
2880 }
2881
2882 /* Anything else */
2883 default:
2884 /* Not yet implemented */
2885#if DBG
2886 DPRINT1("Not implemented: %s\n", PspDumpThreadInfoClassName(ThreadInformationClass));
2887#endif
2888 Status = STATUS_NOT_IMPLEMENTED;
2889 }
2890
2891 return Status;
2892}
ThreadPriority
@ ThreadPriority
Definition: compat.h:937
ThreadIdealProcessor
@ ThreadIdealProcessor
Definition: compat.h:948
ThreadImpersonationToken
@ ThreadImpersonationToken
Definition: compat.h:940
ThreadAffinityMask
@ ThreadAffinityMask
Definition: compat.h:939
ThreadBasePriority
@ ThreadBasePriority
Definition: compat.h:938
ThreadZeroTlsCell
@ ThreadZeroTlsCell
Definition: compat.h:945
PsGetCurrentThread
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
MAXIMUM_PROCESSORS
#define MAXIMUM_PROCESSORS
Definition: rwlock.h:5
THREAD_SET_THREAD_TOKEN
#define THREAD_SET_THREAD_TOKEN
Definition: pstypes.h:151
THREAD_BASE_PRIORITY_LOWRT
#define THREAD_BASE_PRIORITY_LOWRT
Definition: pstypes.h:183
CT_HIDE_FROM_DEBUGGER_BIT
#define CT_HIDE_FROM_DEBUGGER_BIT
Definition: pstypes.h:241
THREAD_BASE_PRIORITY_MIN
#define THREAD_BASE_PRIORITY_MIN
Definition: pstypes.h:185
THREAD_BASE_PRIORITY_MAX
#define THREAD_BASE_PRIORITY_MAX
Definition: pstypes.h:184
THREAD_BASE_PRIORITY_IDLE
#define THREAD_BASE_PRIORITY_IDLE
Definition: pstypes.h:186
TLS_EXPANSION_SLOTS
#define TLS_EXPANSION_SLOTS
Definition: pstypes.h:311
CT_BREAK_ON_TERMINATION_BIT
#define CT_BREAK_ON_TERMINATION_BIT
Definition: pstypes.h:245
LOW_REALTIME_PRIORITY
#define LOW_REALTIME_PRIORITY
THREAD_SET_INFORMATION
#define THREAD_SET_INFORMATION
Definition: nt_native.h:1340
PsAssignImpersonationToken
NTSTATUS NTAPI PsAssignImpersonationToken(IN PETHREAD Thread, IN HANDLE TokenHandle)
Definition: security.c:502
Address
static WCHAR Address[46]
Definition: ping.c:68
PsGetNextProcessThread
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
Definition: process.c:75
PspSetCrossThreadFlag
#define PspSetCrossThreadFlag(Thread, Flag)
Definition: ps_x.h:25
PspClearCrossThreadFlag
#define PspClearCrossThreadFlag(Thread, Flag)
Definition: ps_x.h:27
TLS_MINIMUM_AVAILABLE
#define TLS_MINIMUM_AVAILABLE
Definition: ntddk_ex.h:236
_ETHREAD::RundownProtect
EX_RUNDOWN_REF RundownProtect
Definition: pstypes.h:1248
_KTHREAD::IdealProcessor
ULONG IdealProcessor
Definition: ketypes.h:2072
_TEB
Definition: compat.h:836
_TEB::TlsExpansionSlots
PVOID * TlsExpansionSlots
Definition: compat.h:894
_TEB::TlsSlots
PVOID TlsSlots[64]
Definition: compat.h:879
KeSetIdealProcessorThread
UCHAR NTAPI KeSetIdealProcessorThread(IN PKTHREAD Thread, IN UCHAR Processor)
Definition: thrdobj.c:1066
KeSetBasePriorityThread
LONG NTAPI KeSetBasePriorityThread(IN PKTHREAD Thread, IN LONG Increment)
Definition: thrdobj.c:1157
KeSetPriorityThread
KPRIORITY NTAPI KeSetPriorityThread(IN PKTHREAD Thread, IN KPRIORITY Priority)
Definition: thrdobj.c:1300
KeSetAffinityThread
KAFFINITY NTAPI KeSetAffinityThread(IN PKTHREAD Thread, IN KAFFINITY Affinity)
Definition: thrdobj.c:1276
PLONG
int32_t * PLONG
Definition: typedefs.h:58
CCHAR
char CCHAR
Definition: typedefs.h:51
Priority
_In_ WDFINTERRUPT _In_ WDF_INTERRUPT_POLICY _In_ WDF_INTERRUPT_PRIORITY Priority
Definition: wdfinterrupt.h:655
TlsIndex
#define TlsIndex
Definition: ws2_32p.h:277

Referenced by BaseGetNamedObjectDirectory(), BaseProcessStartup(), CreateProcessAsUserCommon(), CsrRevertToSelf(), ImpersonateLoggedOnUser(), init_funcs(), InitFunctionPtrs(), InitializeDeviceData(), MiInitBalancerThread(), NpGetUserNamep(), QuerySetThreadValidator(), RevertToSelf(), RtlpExecuteIoWorkItem(), RtlpExecuteWorkItem(), set_thread_name(), SetThreadAffinityMask(), SetThreadDescription(), SetThreadGroupAffinity(), SetThreadIdealProcessor(), SetThreadInformation(), SetThreadPriority(), SetThreadPriorityBoost(), SetThreadToken(), START_TEST(), test_thread_description(), Test_ThreadHideFromDebuggerClass(), Test_ThreadPriorityClass(), and TlsFree().

◆ PsReferenceProcessFilePointer()

NTSTATUS NTAPI PsReferenceProcessFilePointer ( _In_ PEPROCESS  Process,
_Outptr_ PFILE_OBJECT *  FileObject 
)

Definition at line 24 of file query.c.

27{
28 PSECTION Section;
29 PAGED_CODE();
30
31 /* Lock the process */
32 if (!ExAcquireRundownProtection(&Process->RundownProtect))
33 {
34 return STATUS_PROCESS_IS_TERMINATING;
35 }
36
37 /* Get the section */
38 Section = Process->SectionObject;
39 if (Section)
40 {
41 /* Get the file object and reference it */
42 *FileObject = MmGetFileObjectForSection((PVOID)Section);
43 ObReferenceObject(*FileObject);
44 }
45
46 /* Release the protection */
47 ExReleaseRundownProtection(&Process->RundownProtect);
48
49 /* Return status */
50 return Section ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL;
51}
MmGetFileObjectForSection
PFILE_OBJECT NTAPI MmGetFileObjectForSection(IN PVOID Section)
Definition: section.c:1542
_SECTION
Definition: mmtypes.h:810
STATUS_UNSUCCESSFUL
#define STATUS_UNSUCCESSFUL
Definition: udferr_usr.h:132
ObReferenceObject
#define ObReferenceObject
Definition: obfuncs.h:204

Referenced by NtQueryInformationProcess(), and SeLocateProcessImageName().

Variable Documentation

◆ PspTraceLevel

ULONG PspTraceLevel = 0

Definition at line 18 of file query.c.