35 "StartRoutine: %p StartContext: %p\n",
StartRoutine, StartContext);
104 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart ^
118 DPRINT1(
"PS: Unhandled Kernel Mode Exception Pointers = 0x%p\n",
120 DPRINT1(
"Code %x Addr %p Info0 %p Info1 %p Info2 %p Info3 %p\n",
144 "StartRoutine: %p StartContext: %p\n",
StartRoutine, StartContext);
199 "ThreadContext: %p TargetProcess: %p ProcessHandle: %p\n",
379 if (
Process->ProcessDelete)
goto Quickie;
614 "ProcessHandle: %p StartRoutine: %p StartContext: %p\n",
658 FoundThread = CidEntry->
Object;
727 return Thread->ThreadsProcess;
915 if (Win32Thread !=
NULL)
953 "ProcessHandle: %p Context: %p\n",
ProcessHandle, ThreadContext);
979 SafeInitialTeb = *InitialTeb;
991 SafeInitialTeb = *InitialTeb;
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
BOOLEAN NTAPI SeAccessCheck(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, _In_ BOOLEAN SubjectContextLocked, _In_ ACCESS_MASK DesiredAccess, _In_ ACCESS_MASK PreviouslyGrantedAccess, _Out_ PPRIVILEGE_SET *Privileges, _In_ PGENERIC_MAPPING GenericMapping, _In_ KPROCESSOR_MODE AccessMode, _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus)
Determines whether security access rights can be given to an object depending on the security descrip...
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define STATUS_INVALID_HANDLE
#define STATUS_NOT_IMPLEMENTED
VOID NTAPI DbgkCreateThread(IN PETHREAD Thread, IN PVOID StartAddress)
#define NT_SUCCESS(StatCode)
#define InterlockedExchangePointer(Target, Value)
#define InsertTailList(ListHead, Entry)
#define PsGetCurrentThread()
#define KeRaiseIrql(irql, oldIrql)
#define KeLowerIrql(oldIrql)
#define KeQuerySystemTime(t)
#define InitializeListHead(ListHead)
#define KeInitializeSpinLock(sl)
#define ExReleaseRundownProtection
#define ExGetPreviousMode
#define ExInitializeRundownProtection
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
#define ExAcquireRundownProtection
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define PROCESS_CREATE_THREAD
#define THREAD_QUERY_INFORMATION
#define CT_DEAD_THREAD_BIT
#define CT_SYSTEM_THREAD_BIT
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedCompareExchangePointer
#define InterlockedCompareExchange
#define KeLeaveCriticalRegion()
#define KeEnterCriticalRegion()
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
#define KeGetPreviousMode()
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
_In_ HANDLE ProcessHandle
#define THREAD_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI NtCreateThread(OUT PHANDLE phThread, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE hProcess, OUT PCLIENT_ID pClientId, IN PCONTEXT pContext, OUT PSTACKINFO pStackInfo, IN BOOLEAN bSuspended)
#define THREAD_SET_INFORMATION
HANDLE NTAPI ExCreateHandle(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
#define KeGetExceptionFrame(Thread)
#define KeGetTrapFrame(Thread)
#define KeGetContextPc(Context)
#define KeGetContextReturnRegister(Context)
NTSTATUS NTAPI KeInitThread(IN OUT PKTHREAD Thread, IN PVOID KernelStack, IN PKSYSTEM_ROUTINE SystemRoutine, IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext, IN PCONTEXT Context, IN PVOID Teb, IN PKPROCESS Process)
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
VOID NTAPI KeUninitThread(IN PKTHREAD Thread)
ULONG NTAPI KeSuspendThread(PKTHREAD Thread)
ULONG NTAPI KeResumeThread(IN PKTHREAD Thread)
VOID NTAPI KiInitializeUserApc(IN PKEXCEPTION_FRAME Reserved, IN PKTRAP_FRAME TrapFrame, IN PKNORMAL_ROUTINE NormalRoutine, IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
VOID NTAPI KeStartThread(IN OUT PKTHREAD Thread)
VOID NTAPI KeReadyThread(IN PKTHREAD Thread)
ULONG NTAPI MmGetSessionId(IN PEPROCESS Process)
ULONG NTAPI MmGetSessionLocaleId(VOID)
NTSTATUS NTAPI MmCreateTeb(IN PEPROCESS Process, IN PCLIENT_ID ClientId, IN PINITIAL_TEB InitialTeb, OUT PTEB *BaseTeb)
VOID NTAPI MmDeleteTeb(struct _EPROCESS *Process, PTEB Teb)
const LUID SeDebugPrivilege
NTSTATUS NTAPI SeCreateAccessStateEx(_In_ PETHREAD Thread, _In_ PEPROCESS Process, _In_ OUT PACCESS_STATE AccessState, _In_ PAUX_ACCESS_DATA AuxData, _In_ ACCESS_MASK Access, _In_ PGENERIC_MAPPING GenericMapping)
POBJECT_TYPE PsProcessType
NTSTATUS NTAPI PsLookupProcessThreadByCid(IN PCLIENT_ID Cid, OUT PEPROCESS *Process OPTIONAL, OUT PETHREAD *Thread)
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
ULONG NTAPI PsGetThreadFreezeCount(IN PETHREAD Thread)
PEPROCESS NTAPI PsGetCurrentThreadProcess(VOID)
PTEB NTAPI PsGetThreadTeb(IN PETHREAD Thread)
PVOID NTAPI PsGetCurrentThreadStackLimit(VOID)
VOID NTAPI PspUserThreadStartup(IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
BOOLEAN NTAPI PsIsThreadImpersonating(IN PETHREAD Thread)
POBJECT_TYPE PsThreadType
PVOID NTAPI PsSetThreadWin32Thread(_Inout_ PETHREAD Thread, _In_ PVOID Win32Thread, _In_ PVOID OldWin32Thread)
PVOID NTAPI PsGetCurrentThreadStackBase(VOID)
NTSTATUS NTAPI NtOpenThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId OPTIONAL)
PVOID NTAPI PsGetCurrentThreadTeb(VOID)
NTSTATUS NTAPI PsCreateSystemThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, IN PCLIENT_ID ClientId, IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
VOID NTAPI PsSetThreadHardErrorsAreDisabled(IN PETHREAD Thread, IN BOOLEAN HardErrorsAreDisabled)
HANDLE NTAPI PsGetThreadId(IN PETHREAD Thread)
BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled(IN PETHREAD Thread)
NTSTATUS NTAPI PsLookupThreadByThreadId(IN HANDLE ThreadId, OUT PETHREAD *Thread)
NTSTATUS NTAPI PsWrapApcWow64Thread(IN OUT PVOID *ApcContext, IN OUT PVOID *ApcRoutine)
ULONG NTAPI PsGetThreadSessionId(IN PETHREAD Thread)
PVOID NTAPI PsGetThreadWin32Thread(IN PETHREAD Thread)
VOID NTAPI PspSystemThreadStartup(IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
PVOID NTAPI PsGetCurrentThreadWin32Thread(VOID)
HANDLE NTAPI PsGetThreadProcessId(IN PETHREAD Thread)
PEPROCESS NTAPI PsGetThreadProcess(IN PETHREAD Thread)
BOOLEAN NTAPI PsIsSystemThread(IN PETHREAD Thread)
PVOID NTAPI PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion(_Out_ HANDLE *OutProcessId)
HANDLE NTAPI PsGetCurrentThreadProcessId(VOID)
LONG PspUnhandledExceptionInSystemThread(PEXCEPTION_POINTERS ExceptionPointers)
NTSTATUS NTAPI PspCreateThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ProcessHandle, IN PEPROCESS TargetProcess, OUT PCLIENT_ID ClientId, IN PCONTEXT ThreadContext, IN PINITIAL_TEB InitialTeb, IN BOOLEAN CreateSuspended, IN PKSTART_ROUTINE StartRoutine OPTIONAL, IN PVOID StartContext OPTIONAL)
BOOLEAN CcPfEnablePrefetcher
KPROCESSOR_MODE NTAPI PsGetCurrentThreadPreviousMode(VOID)
BOOLEAN NTAPI PsIsThreadTerminating(IN PETHREAD Thread)
VOID NTAPI SeDeleteAccessState(_In_ PACCESS_STATE AccessState)
Deletes an allocated access state from the memory.
NTSTATUS NTAPI SeCreateAccessState(_Out_ PACCESS_STATE AccessState, _Out_ __drv_aliasesMem PAUX_ACCESS_DATA AuxData, _In_ ACCESS_MASK Access, _In_ PGENERIC_MAPPING GenericMapping)
Creates an access state.
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
#define STATUS_THREAD_IS_TERMINATING
#define STATUS_INVALID_PARAMETER_MIX
#define STATUS_PROCESS_IS_TERMINATING
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
NTSTATUS NTAPI ObGetObjectSecurity(IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
VOID NTAPI ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
PVOID PspSystemDllEntryPoint
#define PSTRACE(x, fmt,...)
PHANDLE_TABLE PspCidTable
NTSTATUS NTAPI PspTerminateThreadByPointer(IN PETHREAD Thread, IN NTSTATUS ExitStatus, IN BOOLEAN bSelf)
#define PspSetCrossThreadFlag(Thread, Flag)
FORCEINLINE VOID PspRunCreateThreadNotifyRoutines(IN PETHREAD CurrentThread, IN BOOLEAN Create)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_GetExceptionInformation()
#define _SEH2_YIELD(__stmt)
PEPROCESS PsInitialSystemProcess
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
#define ProbeForWriteHandle(Ptr)
VOID NTAPI KeInitializeSemaphore(IN PKSEMAPHORE Semaphore, IN LONG Count, IN LONG Limit)
PULONG MinorVersion OPTIONAL
PKSTART_ROUTINE StartAddress
EX_RUNDOWN_REF RundownProtect
LIST_ENTRY ActiveTimerListHead
KSPIN_LOCK ActiveTimerListLock
ULONG ActiveImpersonationInfo
ULONG HardErrorsAreDisabled
LIST_ENTRY ThreadListEntry
PEXCEPTION_RECORD ExceptionRecord
ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]
GENERIC_MAPPING GenericMapping
OBJECT_TYPE_INITIALIZER TypeInfo
#define RtlZeroMemory(Destination, Length)
#define STATUS_INVALID_PARAMETER
#define STATUS_INSUFFICIENT_RESOURCES
struct _LARGE_INTEGER::@2307 u
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
_Out_ PCLIENT_ID ClientId
KSTART_ROUTINE * PKSTART_ROUTINE
#define ObDereferenceObject
#define ObReferenceObject
#define PsGetCurrentProcess
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE StartRoutine
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK _Out_ PNTSTATUS AccessStatus
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState