93 if (
Process->BreakOnTermination)
196 NextEntry = NextEntry->
Next;
200 }
while ((NextEntry !=
NULL) && (NextEntry != (
PVOID)1));
211 PspCheckProcessList(
VOID)
232 HeaderLocation =
Info;
236 HeaderLocation =
Info;
240 HeaderLocation =
Info;
244 HeaderLocation =
Info;
265 if (
Process->ActiveProcessLinks.Flink)
276 if (
Process->SeAuditProcessCreationInfo.ImageFileName)
281 Process->SeAuditProcessCreationInfo.ImageFileName =
NULL;
456 PVOID DeallocationStack;
540 LastThreadExitStatus;
551 CurrentEntry = FirstEntry->
Flink;
552 while (FirstEntry != CurrentEntry)
560 if ((OtherThread !=
Thread) &&
579 PreviousThread = OtherThread;
585 CurrentEntry = CurrentEntry->
Flink;
648 TerminationMsg.
h.u2.ZeroInit = 0;
650 TerminationMsg.
h.u1.s1.TotalLength =
sizeof(TerminationMsg);
651 TerminationMsg.
h.u1.s1.DataLength =
sizeof(TerminationMsg) -
680 NextPort = TerminationPort->
Next;
686 TerminationPort = NextPort;
687 }
while (TerminationPort);
712 TerminationMsg.
h.u2.ZeroInit = 0;
714 TerminationMsg.
h.u1.s1.TotalLength =
sizeof(TerminationMsg);
715 TerminationMsg.
h.u1.s1.DataLength =
sizeof(TerminationMsg) -
780 if (Teb->FreeStackOnTermination)
870 CurrentEntry = FirstEntry;
877 CurrentEntry = CurrentEntry->
Flink;
880 if (Apc->RundownRoutine)
883 Apc->RundownRoutine(Apc);
891 while (CurrentEntry != FirstEntry);
933 if (Apc->SystemArgument2)
1004 Thread->ThreadsProcess->ImageFileName);
1116 if (
Process->SetTimerResolution)
1175 KillByHandle =
TRUE;
1180 KillByHandle =
FALSE;
1194 if (
Process->BreakOnTermination)
1225 if (
Thread != CurrentThread)
1260 ((
Process->DebugPort) && (KillByHandle)))
1286 "ThreadHandle: %p ExitStatus: %d\n", ThreadHandle,
ExitStatus);
1320 if (
Thread != CurrentThread)
1345 PVOID TerminationLpcPort;
1355 &TerminationLpcPort,
1367 TerminationPort->
Port = TerminationLpcPort;
#define KeQuerySystemTime(t)
VOID NTAPI ObKillProcess(IN PEPROCESS Process)
#define KeGetCurrentIrql()
VOID NTAPI KeInitializeApc(IN PKAPC Apc, IN PKTHREAD Thread, IN KAPC_ENVIRONMENT TargetEnvironment, IN PKKERNEL_ROUTINE KernelRoutine, IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL, IN PKNORMAL_ROUTINE NormalRoutine, IN KPROCESSOR_MODE Mode, IN PVOID Context)
PLIST_ENTRY NTAPI KeFlushQueueApc(IN PKTHREAD Thread, IN KPROCESSOR_MODE PreviousMode)
BOOLEAN KdDebuggerEnabled
VOID NTAPI KeRundownThread(VOID)
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
LIST_ENTRY ThreadListEntry
NTSTATUS NTAPI NtTerminateThread(IN HANDLE ThreadHandle, IN NTSTATUS ExitStatus)
#define DBG_TERMINATE_PROCESS
#define STATUS_INSUFFICIENT_RESOURCES
#define KeLowerIrql(oldIrql)
VOID NTAPI PspDeleteVdmObjects(PEPROCESS Process)
BOOLEAN NTAPI ExDestroyHandle(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle, IN PHANDLE_TABLE_ENTRY HandleTableEntry OPTIONAL)
VOID NTAPI IoCancelThreadIo(IN PETHREAD Thread)
#define PsGetCurrentThread()
VOID NTAPI ExTimerRundown(VOID)
VOID FASTCALL KeAcquireGuardedMutex(IN PKGUARDED_MUTEX GuardedMutex)
NTSYSAPI ULONG NTAPI DbgPrompt(_In_z_ PCCH Prompt, _Out_writes_bytes_(MaximumResponseLength) PCH Response, _In_ ULONG MaximumResponseLength)
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
#define OBJECT_HEADER_TO_HANDLE_INFO(h)
#define STATUS_INVALID_PARAMETER
#define STATUS_THREAD_IS_TERMINATING
#define ASSERT_IRQL_EQUAL(x)
VOID NTAPI MmDeleteKernelStack(PVOID Stack, BOOLEAN GuiStack)
NTSTATUS NTAPI NtTerminateProcess(IN HANDLE ProcessHandle OPTIONAL, IN NTSTATUS ExitStatus)
#define KeGetPreviousMode()
EX_RUNDOWN_REF RundownProtect
struct _EPROCESS * PEPROCESS
#define NtCurrentThread()
#define ExAcquireRundownProtection
PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout
VOID NTAPI PspCatchCriticalBreak(IN PCHAR Message, IN PVOID ProcessOrThread, IN PCHAR ImageName)
#define OBJECT_HEADER_TO_NAME_INFO(h)
VOID NTAPI PspExitProcess(IN BOOLEAN LastThread, IN PEPROCESS Process)
#define PSF_PROCESS_EXITING_BIT
PHANDLE_TABLE PspCidTable
VOID NTAPI SeAuditProcessExit(IN PEPROCESS Process)
LIST_ENTRY PsActiveProcessHead
struct _TERMINATION_PORT * Next
VOID NTAPI MmDeleteTeb(struct _EPROCESS *Process, PTEB Teb)
BOOLEAN NTAPI PspIsProcessExiting(IN PEPROCESS Process)
NTSTATUS NTAPI KeWaitForSingleObject(IN PVOID Object, IN KWAIT_REASON WaitReason, IN KPROCESSOR_MODE WaitMode, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL)
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
#define OBJECT_TO_OBJECT_HEADER(o)
ULONG NTAPI KeSetProcess(struct _KPROCESS *Process, KPRIORITY Increment, BOOLEAN InWait)
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
BOOLEAN KdDebuggerNotPresent
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
PEPROCESS PsInitialSystemProcess
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
PKWIN32_THREAD_CALLOUT PspW32ThreadCallout
VOID NTAPI PspDeleteThread(IN PVOID ObjectBody)
#define InterlockedCompareExchangePointer
NTSTATUS NTAPI KeDelayExecutionThread(IN KPROCESSOR_MODE WaitMode, IN BOOLEAN Alertable, IN PLARGE_INTEGER Interval OPTIONAL)
BOOLEAN NTAPI KeIsAttachedProcess(VOID)
BOOLEAN NTAPI KeReadStateThread(IN PKTHREAD Thread)
#define PsGetCurrentProcess
VOID NTAPI PspExitProcessFromJob(IN PEJOB Job, IN PEPROCESS Process)
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
NTKERNELAPI VOID FASTCALL ExWaitForRundownProtectionRelease(_Inout_ PEX_RUNDOWN_REF RunRef)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
struct _TERMINATION_PORT * TerminationPort
#define STATUS_NOTHING_TO_TERMINATE
VOID NTAPI PspShutdownProcessManager(VOID)
#define NtCurrentProcess()
VOID NTAPI KeTerminateThread(IN KPRIORITY Increment)
NTSTATUS NTAPI LpcRequestPort(IN PVOID PortObject, IN PPORT_MESSAGE LpcMessage)
POBJECT_TYPE LpcPortObjectType
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
struct _LIST_ENTRY * Flink
VOID NTAPI MmCleanProcessAddressSpace(IN PEPROCESS Process)
NTSYSAPI NTSTATUS NTAPI ZwSetTimerResolution(_In_ ULONG RequestedResolution, _In_ BOOLEAN SetOrUnset, _Out_ PULONG ActualResolution)
#define CT_TERMINATED_BIT
#define OBJECT_HEADER_TO_QUOTA_INFO(h)
#define InterlockedExchangePointer(Target, Value)
_Must_inspect_result_ _In_ ULONG Flags
#define NT_SUCCESS(StatCode)
WORK_QUEUE_ITEM PspReaperWorkItem
#define STATUS_PROCESS_IS_TERMINATING
#define ObDereferenceObject
FORCEINLINE VOID PspRunCreateProcessNotifyRoutines(IN PEPROCESS CurrentProcess, IN BOOLEAN Create)
#define PSF_PROCESS_DELETE_BIT
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
#define STATUS_ACCESS_DENIED
VOID NTAPI PspDeleteLdt(PEPROCESS Process)
NTSTATUS NTAPI PspTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
#define STATUS_UNSUCCESSFUL
#define ExAllocatePoolWithTag(hernya, size, tag)
PETHREAD NTAPI PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
VOID NTAPI PopCleanupPowerState(IN PPOWER_STATE PowerState)
VOID NTAPI DbgkExitProcess(IN NTSTATUS ExitStatus)
struct _SINGLE_LIST_ENTRY * Next
static const char * ImageName
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
POBJECT_TYPE PsThreadType
VOID NTAPI PspExitThread(IN NTSTATUS ExitStatus)
VOID NTAPI PspExitApcRundown(IN PKAPC Apc)
NTSTATUS NTAPI DbgkClearProcessDebugObject(IN PEPROCESS Process, IN PDEBUG_OBJECT SourceDebugObject OPTIONAL)
#define PspSetCrossThreadFlag(Thread, Flag)
#define KeEnterCriticalRegion()
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
VOID NTAPI ObDereferenceDeviceMap(IN PEPROCESS Process)
VOID NTAPI PspDeleteProcessSecurity(IN PEPROCESS Process)
#define InterlockedExchange
VOID NTAPI PsReturnProcessNonPagedPoolQuota(IN PEPROCESS Process, IN SIZE_T Amount)
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
VOID NTAPI PspDeleteThreadSecurity(IN PETHREAD Thread)
VOID NTAPI PspRemoveProcessFromJob(IN PEPROCESS Process, IN PEJOB Job)
#define STATUS_CANT_TERMINATE_SELF
VOID NTAPI ObClearProcessHandleTable(IN PEPROCESS Process)
NTSTATUS NTAPI MmDeleteProcessAddressSpace(IN PEPROCESS Process)
FORCEINLINE VOID PspRunCreateThreadNotifyRoutines(IN PETHREAD CurrentThread, IN BOOLEAN Create)
VOID NTAPI PspExitNormalApc(IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
#define KeLeaveCriticalRegion()
#define PROCESS_TERMINATE
#define TAG_TERMINATE_APC
VOID NTAPI PspDestroyQuotaBlock(IN PEPROCESS Process)
_In_ WDFIOTARGET _In_ _Strict_type_match_ WDF_IO_TARGET_SENT_IO_ACTION Action
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
#define OBJECT_HEADER_TO_CREATOR_INFO(h)
KGUARDED_MUTEX PspActiveProcessMutex
NTSTATUS NTAPI PsTerminateSystemThread(IN NTSTATUS ExitStatus)
LIST_ENTRY PspReaperListHead
_Out_ PKAPC_STATE ApcState
NTSTATUS NTAPI PsTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
FORCEINLINE VOID PspRunLegoRoutine(IN PKTHREAD Thread)
VOID FASTCALL KeReleaseGuardedMutex(IN OUT PKGUARDED_MUTEX GuardedMutex)
BOOLEAN NTAPI KeInsertQueueApc(IN PKAPC Apc, IN PVOID SystemArgument1, IN PVOID SystemArgument2, IN KPRIORITY PriorityBoost)
VOID NTAPI PspDeleteProcess(IN PVOID ObjectBody)
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define PspSetProcessFlag(Process, Flag)
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
#define PSTRACE(x, fmt,...)
struct _ETHREAD * PETHREAD
VOID NTAPI LpcExitThread(IN PETHREAD Thread)
#define ExFreePoolWithTag(_P, _T)
NTSTATUS NTAPI NtRegisterThreadTerminatePort(IN HANDLE PortHandle)
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
BOOLEAN NTAPI SeDetailedAuditingWithToken(IN PTOKEN Token)
VOID NTAPI PspReapRoutine(IN PVOID Context)
VOID NTAPI ExpCheckPoolAllocation(PVOID P, POOL_TYPE PoolType, ULONG Tag)
_In_ HANDLE ProcessHandle
VOID NTAPI PsExitSpecialApc(IN PKAPC Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine, IN OUT PVOID *NormalContext, IN OUT PVOID *SystemArgument1, IN OUT PVOID *SystemArgument2)
POBJECT_TYPE PsProcessType
NTSTATUS NTAPI PspTerminateThreadByPointer(IN PETHREAD Thread, IN NTSTATUS ExitStatus, IN BOOLEAN bSelf)
base of all file and directory entries
VOID NTAPI DbgkExitThread(IN NTSTATUS ExitStatus)
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
#define STATUS_SYSTEM_SHUTDOWN
PULONG MinorVersion OPTIONAL