90 if (
Process->BreakOnTermination)
193 NextEntry = NextEntry->
Next;
197 }
while ((NextEntry !=
NULL) && (NextEntry != (
PVOID)1));
208PspCheckProcessList(
VOID)
229 HeaderLocation =
Info;
233 HeaderLocation =
Info;
237 HeaderLocation =
Info;
241 HeaderLocation =
Info;
262 if (
Process->ActiveProcessLinks.Flink)
273 if (
Process->SeAuditProcessCreationInfo.ImageFileName)
278 Process->SeAuditProcessCreationInfo.ImageFileName =
NULL;
457 PVOID DeallocationStack;
469 CurrentProcess =
Thread->ThreadsProcess;
541 LastThreadExitStatus;
552 CurrentEntry = FirstEntry->
Flink;
553 while (FirstEntry != CurrentEntry)
561 if ((OtherThread !=
Thread) &&
580 PreviousThread = OtherThread;
586 CurrentEntry = CurrentEntry->
Flink;
649 TerminationMsg.
h.u2.ZeroInit = 0;
651 TerminationMsg.
h.u1.s1.TotalLength =
sizeof(TerminationMsg);
652 TerminationMsg.
h.u1.s1.DataLength =
sizeof(TerminationMsg) -
681 NextPort = TerminationPort->
Next;
687 TerminationPort = NextPort;
688 }
while (TerminationPort);
713 TerminationMsg.
h.u2.ZeroInit = 0;
715 TerminationMsg.
h.u1.s1.TotalLength =
sizeof(TerminationMsg);
716 TerminationMsg.
h.u1.s1.DataLength =
sizeof(TerminationMsg) -
720 if (CurrentProcess->ExceptionPort)
781 if (Teb->FreeStackOnTermination)
849 if (CurrentProcess->
Job)
871 CurrentEntry = FirstEntry;
878 CurrentEntry = CurrentEntry->
Flink;
881 if (Apc->RundownRoutine)
884 Apc->RundownRoutine(Apc);
892 while (CurrentEntry != FirstEntry);
934 if (Apc->SystemArgument2)
1005 Thread->ThreadsProcess->ImageFileName);
1117 if (
Process->SetTimerResolution)
1176 KillByHandle =
TRUE;
1181 KillByHandle =
FALSE;
1195 if (
Process->BreakOnTermination)
1226 if (
Thread != CurrentThread)
1241 if (
Process == CurrentProcess)
1261 ((
Process->DebugPort) && (KillByHandle)))
1287 "ThreadHandle: %p ExitStatus: %d\n", ThreadHandle,
ExitStatus);
1321 if (
Thread != CurrentThread)
1346 PVOID TerminationLpcPort;
1356 &TerminationLpcPort,
1368 TerminationPort->
Port = TerminationLpcPort;
#define InterlockedExchange
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
NTSTATUS NTAPI DbgkClearProcessDebugObject(IN PEPROCESS Process, IN PDEBUG_OBJECT SourceDebugObject OPTIONAL)
VOID NTAPI DbgkExitThread(IN NTSTATUS ExitStatus)
VOID NTAPI DbgkExitProcess(IN NTSTATUS ExitStatus)
#define NT_SUCCESS(StatCode)
static const WCHAR Message[]
#define ASSERT_IRQL_EQUAL(x)
#define InterlockedExchangePointer(Target, Value)
#define RemoveEntryList(Entry)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define PsGetCurrentThread()
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define KeLowerIrql(oldIrql)
#define KeQuerySystemTime(t)
#define KeGetCurrentIrql()
#define KeDelayExecutionThread(mode, foo, t)
#define ExWaitForRundownProtectionRelease
#define ExReleaseRundownProtection
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
#define ExAcquireRundownProtection
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
VOID FASTCALL KeReleaseGuardedMutex(IN OUT PKGUARDED_MUTEX GuardedMutex)
VOID FASTCALL KeAcquireGuardedMutex(IN PKGUARDED_MUTEX GuardedMutex)
#define PROCESS_TERMINATE
#define PSF_PROCESS_DELETE_BIT
#define PSF_PROCESS_EXITING_BIT
#define CT_TERMINATED_BIT
NTSYSAPI void WINAPI DbgBreakPoint(void)
#define InterlockedCompareExchangePointer
BOOLEAN KdDebuggerNotPresent
BOOLEAN KdDebuggerEnabled
#define KeLeaveCriticalRegion()
#define KeEnterCriticalRegion()
POBJECT_TYPE LpcPortObjectType
VOID NTAPI LpcExitThread(IN PETHREAD Thread)
#define ExFreePoolWithTag(_P, _T)
static const char * ImageName
#define KeGetPreviousMode()
NTSYSAPI NTSTATUS NTAPI ZwSetTimerResolution(_In_ ULONG RequestedResolution, _In_ BOOLEAN SetOrUnset, _Out_ PULONG ActualResolution)
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
_In_ HANDLE ProcessHandle
#define OBJECT_HEADER_TO_HANDLE_INFO(h)
#define OBJECT_HEADER_TO_CREATOR_INFO(h)
#define OBJECT_HEADER_TO_NAME_INFO(h)
#define OBJECT_HEADER_TO_QUOTA_INFO(h)
#define OBJECT_TO_OBJECT_HEADER(o)
NTSYSAPI ULONG NTAPI DbgPrompt(_In_z_ PCCH Prompt, _Out_writes_bytes_(MaximumResponseLength) PCH Response, _In_ ULONG MaximumResponseLength)
#define NtCurrentProcess()
struct _EPROCESS * PEPROCESS
struct _ETHREAD * PETHREAD
BOOLEAN NTAPI ExDestroyHandle(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle, IN PHANDLE_TABLE_ENTRY HandleTableEntry OPTIONAL)
VOID NTAPI ExTimerRundown(VOID)
VOID NTAPI IoCancelThreadIo(IN PETHREAD Thread)
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
ULONG NTAPI KeSetProcess(struct _KPROCESS *Process, KPRIORITY Increment, BOOLEAN InWait)
PLIST_ENTRY NTAPI KeFlushQueueApc(IN PKTHREAD Thread, IN KPROCESSOR_MODE PreviousMode)
VOID NTAPI KeRundownThread(VOID)
BOOLEAN NTAPI KeReadStateThread(IN PKTHREAD Thread)
VOID NTAPI ExpCheckPoolAllocation(PVOID P, POOL_TYPE PoolType, ULONG Tag)
VOID NTAPI MmDeleteKernelStack(PVOID Stack, BOOLEAN GuiStack)
VOID NTAPI MmCleanProcessAddressSpace(IN PEPROCESS Process)
VOID NTAPI MmDeleteProcessAddressSpace(IN PEPROCESS Process)
VOID NTAPI MmDeleteTeb(struct _EPROCESS *Process, PTEB Teb)
_Out_ PKAPC_STATE ApcState
VOID NTAPI SeAuditProcessExit(_In_ PEPROCESS Process)
Peforms a security auditing against a process that is about to be terminated.
BOOLEAN NTAPI SeDetailedAuditingWithToken(_In_ PTOKEN Token)
Peforms a detailed security auditing with an access token.
BOOLEAN NTAPI KeInsertQueueApc(IN PKAPC Apc, IN PVOID SystemArgument1, IN PVOID SystemArgument2, IN KPRIORITY PriorityBoost)
VOID NTAPI KeInitializeApc(IN PKAPC Apc, IN PKTHREAD Thread, IN KAPC_ENVIRONMENT TargetEnvironment, IN PKKERNEL_ROUTINE KernelRoutine, IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL, IN PKNORMAL_ROUTINE NormalRoutine, IN KPROCESSOR_MODE Mode, IN PVOID Context)
NTSTATUS NTAPI LpcRequestPort(IN PVOID PortObject, IN PPORT_MESSAGE LpcMessage)
LIST_ENTRY PspReaperListHead
NTSTATUS NTAPI NtTerminateThread(IN HANDLE ThreadHandle, IN NTSTATUS ExitStatus)
VOID NTAPI PspDeleteProcess(IN PVOID ObjectBody)
VOID NTAPI PspExitNormalApc(IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
NTSTATUS NTAPI PsTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
NTSTATUS NTAPI NtTerminateProcess(IN HANDLE ProcessHandle OPTIONAL, IN NTSTATUS ExitStatus)
BOOLEAN NTAPI PspIsProcessExiting(IN PEPROCESS Process)
VOID NTAPI PspExitThread(IN NTSTATUS ExitStatus)
VOID NTAPI PspCatchCriticalBreak(IN PCHAR Message, IN PVOID ProcessOrThread, IN PCHAR ImageName)
VOID NTAPI PsExitSpecialApc(IN PKAPC Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine, IN OUT PVOID *NormalContext, IN OUT PVOID *SystemArgument1, IN OUT PVOID *SystemArgument2)
NTSTATUS NTAPI PsTerminateSystemThread(IN NTSTATUS ExitStatus)
NTSTATUS NTAPI PspTerminateThreadByPointer(IN PETHREAD Thread, IN NTSTATUS ExitStatus, IN BOOLEAN bSelf)
VOID NTAPI PspShutdownProcessManager(VOID)
VOID NTAPI PspExitApcRundown(IN PKAPC Apc)
NTSTATUS NTAPI PspTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
VOID NTAPI PspDeleteThread(IN PVOID ObjectBody)
NTSTATUS NTAPI NtRegisterThreadTerminatePort(IN HANDLE PortHandle)
WORK_QUEUE_ITEM PspReaperWorkItem
VOID NTAPI PspReapRoutine(IN PVOID Context)
VOID NTAPI PspExitProcess(IN BOOLEAN LastThread, IN PEPROCESS Process)
POBJECT_TYPE PsProcessType
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
POBJECT_TYPE PsThreadType
#define STATUS_SYSTEM_SHUTDOWN
#define STATUS_THREAD_IS_TERMINATING
#define DBG_TERMINATE_PROCESS
#define STATUS_PROCESS_IS_TERMINATING
#define STATUS_NOTHING_TO_TERMINATE
#define STATUS_CANT_TERMINATE_SELF
VOID NTAPI ObKillProcess(IN PEPROCESS Process)
VOID NTAPI ObDereferenceDeviceMap(IN PEPROCESS Process)
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
VOID NTAPI ObClearProcessHandleTable(IN PEPROCESS Process)
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
VOID NTAPI PopCleanupPowerState(IN PPOWER_STATE PowerState)
BOOLEAN NTAPI KeIsAttachedProcess(VOID)
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
VOID NTAPI PspRemoveProcessFromJob(IN PEPROCESS Process, IN PEJOB Job)
PKWIN32_THREAD_CALLOUT PspW32ThreadCallout
VOID NTAPI PspExitProcessFromJob(IN PEJOB Job, IN PEPROCESS Process)
PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout
#define PSTRACE(x, fmt,...)
PHANDLE_TABLE PspCidTable
VOID NTAPI PspDereferenceQuotaBlock(_In_opt_ PEPROCESS Process, _In_ PEPROCESS_QUOTA_BLOCK QuotaBlock)
De-references a quota block when quotas have been returned back because of an object de-allocation or...
VOID NTAPI PspDeleteProcessSecurity(IN PEPROCESS Process)
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
LIST_ENTRY PsActiveProcessHead
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
KGUARDED_MUTEX PspActiveProcessMutex
VOID NTAPI PspDeleteThreadSecurity(IN PETHREAD Thread)
FORCEINLINE VOID PspRunLegoRoutine(IN PKTHREAD Thread)
#define PspSetCrossThreadFlag(Thread, Flag)
FORCEINLINE VOID PspRunCreateThreadNotifyRoutines(IN PETHREAD CurrentThread, IN BOOLEAN Create)
FORCEINLINE VOID PspRunCreateProcessNotifyRoutines(IN PEPROCESS CurrentProcess, IN BOOLEAN Create)
#define PspSetProcessFlag(Process, Flag)
VOID NTAPI PspDeleteLdt(PEPROCESS Process)
VOID NTAPI PspDeleteVdmObjects(PEPROCESS Process)
PEPROCESS PsInitialSystemProcess
VOID NTAPI PsReturnProcessNonPagedPoolQuota(_In_ PEPROCESS Process, _In_ SIZE_T Amount)
Returns the non paged quota pool that the process was taking up.
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
PULONG MinorVersion OPTIONAL
base of all file and directory entries
LIST_ENTRY ThreadListHead
NTSTATUS LastThreadExitStatus
EX_RUNDOWN_REF RundownProtect
struct _TERMINATION_PORT * TerminationPort
LIST_ENTRY ThreadListEntry
struct _LIST_ENTRY * Flink
struct _SINGLE_LIST_ENTRY * Next
struct _TERMINATION_PORT * Next
#define TAG_TERMINATE_APC
VOID NTAPI KeTerminateThread(IN KPRIORITY Increment)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_UNSUCCESSFUL
#define STATUS_INSUFFICIENT_RESOURCES
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
_In_ WDFIOTARGET _In_ _Strict_type_match_ WDF_IO_TARGET_SENT_IO_ACTION Action
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
#define ObDereferenceObject
#define PsGetCurrentProcess
#define NtCurrentThread()