35 "StartRoutine: %p StartContext: %p\n",
StartRoutine, StartContext);
104 SystemTime.
u.LowPart ^ SystemTime.
u.HighPart ^
118 DPRINT1(
"PS: Unhandled Kernel Mode Exception Pointers = 0x%p\n",
120 DPRINT1(
"Code %x Addr %p Info0 %p Info1 %p Info2 %p Info3 %p\n",
144 "StartRoutine: %p StartContext: %p\n",
StartRoutine, StartContext);
199 "ThreadContext: %p TargetProcess: %p ProcessHandle: %p\n",
379 if (
Process->ProcessDelete)
goto Quickie;
614 "ProcessHandle: %p StartRoutine: %p StartContext: %p\n",
658 FoundThread = CidEntry->
Object;
727 return Thread->ThreadsProcess;
915 if (Win32Thread !=
NULL)
953 "ProcessHandle: %p Context: %p\n",
ProcessHandle, ThreadContext);
979 SafeInitialTeb = *InitialTeb;
991 SafeInitialTeb = *InitialTeb;
#define KeQuerySystemTime(t)
NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
BOOLEAN CcPfEnablePrefetcher
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
BOOLEAN NTAPI SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN BOOLEAN SubjectContextLocked, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK PreviouslyGrantedAccess, OUT PPRIVILEGE_SET *Privileges, IN PGENERIC_MAPPING GenericMapping, IN KPROCESSOR_MODE AccessMode, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus)
FORCEINLINE VOID ExAcquirePushLockExclusive(PEX_PUSH_LOCK PushLock)
PVOID NTAPI PsSetThreadWin32Thread(_Inout_ PETHREAD Thread, _In_ PVOID Win32Thread, _In_ PVOID OldWin32Thread)
NTSTATUS NTAPI MmCreateTeb(IN PEPROCESS Process, IN PCLIENT_ID ClientId, IN PINITIAL_TEB InitialTeb, OUT PTEB *BaseTeb)
PVOID NTAPI PsGetThreadWin32Thread(IN PETHREAD Thread)
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE _In_opt_ PVOID ApcContext
_Inout_ PLIST_ENTRY _In_ PVOID _In_ PSTRING _In_ BOOLEAN _In_ BOOLEAN _In_ ULONG _In_ PFLT_CALLBACK_DATA _In_opt_ PCHECK_FOR_TRAVERSE_ACCESS _In_opt_ PSECURITY_SUBJECT_CONTEXT SubjectContext
#define THREAD_ALL_ACCESS
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
VOID NTAPI KeReadyThread(IN PKTHREAD Thread)
#define KeRaiseIrql(irql, oldIrql)
LIST_ENTRY ThreadListEntry
NTSTATUS NTAPI SeCreateAccessState(IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
NTSTATUS NTAPI PspCreateThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ProcessHandle, IN PEPROCESS TargetProcess, OUT PCLIENT_ID ClientId, IN PCONTEXT ThreadContext, IN PINITIAL_TEB InitialTeb, IN BOOLEAN CreateSuspended, IN PKSTART_ROUTINE StartRoutine OPTIONAL, IN PVOID StartContext OPTIONAL)
#define STATUS_INSUFFICIENT_RESOURCES
NTSTATUS NTAPI NtOpenThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId OPTIONAL)
#define KeLowerIrql(oldIrql)
#define PsGetCurrentThread()
const LUID SeDebugPrivilege
VOID NTAPI KeStartThread(IN OUT PKTHREAD Thread)
_In_ ULONG _In_opt_ POBJECT_ATTRIBUTES _In_opt_ HANDLE _Out_opt_ PCLIENT_ID _In_ PKSTART_ROUTINE StartRoutine
PEPROCESS NTAPI PsGetThreadProcess(IN PETHREAD Thread)
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK _Out_ PNTSTATUS AccessStatus
NTKERNELAPI VOID FASTCALL ExReleaseRundownProtection(_Inout_ PEX_RUNDOWN_REF RunRef)
_In_ USHORT _In_ ULONG _In_ PSOCKADDR _In_ PSOCKADDR _Reserved_ ULONG _In_opt_ PVOID _In_opt_ const WSK_CLIENT_CONNECTION_DISPATCH _In_opt_ PEPROCESS _In_opt_ PETHREAD _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor
#define STATUS_INVALID_PARAMETER
#define STATUS_THREAD_IS_TERMINATING
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
NTSTATUS NTAPI KeInitThread(IN OUT PKTHREAD Thread, IN PVOID KernelStack, IN PKSYSTEM_ROUTINE SystemRoutine, IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext, IN PCONTEXT Context, IN PVOID Teb, IN PKPROCESS Process)
NTSTATUS NTAPI PsLookupThreadByThreadId(IN HANDLE ThreadId, OUT PETHREAD *Thread)
KPROCESSOR_MODE NTAPI PsGetCurrentThreadPreviousMode(VOID)
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
ULONG NTAPI KeResumeThread(IN PKTHREAD Thread)
PVOID NTAPI PsGetCurrentThreadWin32Thread(VOID)
#define THREAD_SET_INFORMATION
#define KeGetPreviousMode()
EX_RUNDOWN_REF RundownProtect
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
#define CT_SYSTEM_THREAD_BIT
#define ExAcquireRundownProtection
BOOLEAN NTAPI PsIsSystemThread(IN PETHREAD Thread)
#define InterlockedCompareExchange
LIST_ENTRY ActiveTimerListHead
BOOLEAN NTAPI SeSinglePrivilegeCheck(IN LUID PrivilegeValue, IN KPROCESSOR_MODE PreviousMode)
KPROCESSOR_MODE NTAPI ExGetPreviousMode(VOID)
PHANDLE_TABLE PspCidTable
VOID NTAPI KiInitializeUserApc(IN PKEXCEPTION_FRAME Reserved, IN PKTRAP_FRAME TrapFrame, IN PKNORMAL_ROUTINE NormalRoutine, IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
#define STATUS_INVALID_PARAMETER_MIX
#define InsertTailList(ListHead, Entry)
NTSTATUS NTAPI ObOpenObjectByPointer(IN PVOID Object, IN ULONG HandleAttributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PHANDLE Handle)
NTKERNELAPI VOID FASTCALL ExInitializeRundownProtection(_Out_ PEX_RUNDOWN_REF RunRef)
VOID NTAPI MmDeleteTeb(struct _EPROCESS *Process, PTEB Teb)
VOID NTAPI PspUserThreadStartup(IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
#define STATUS_INVALID_HANDLE
#define PROCESS_CREATE_THREAD
VOID NTAPI DbgkCreateThread(IN PETHREAD Thread, IN PVOID StartAddress)
#define KeGetContextReturnRegister(Context)
BOOLEAN FASTCALL ObReferenceObjectSafe(IN PVOID Object)
PKSTART_ROUTINE StartAddress
HANDLE NTAPI ExCreateHandle(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
#define CT_DEAD_THREAD_BIT
ULONG NTAPI KeSuspendThread(PKTHREAD Thread)
return STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
KSTART_ROUTINE * PKSTART_ROUTINE
PEPROCESS PsInitialSystemProcess
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
ULONG NTAPI MmGetSessionLocaleId(VOID)
#define InterlockedCompareExchangePointer
LONG PspUnhandledExceptionInSystemThread(PEXCEPTION_POINTERS ExceptionPointers)
#define PsGetCurrentProcess
FORCEINLINE VOID ExReleasePushLockExclusive(PEX_PUSH_LOCK PushLock)
#define _SEH2_GetExceptionInformation()
#define EXCEPTION_EXECUTE_HANDLER
FORCEINLINE VOID KeInitializeSpinLock(_Out_ PKSPIN_LOCK SpinLock)
VOID NTAPI ObReleaseObjectSecurity(IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN BOOLEAN MemoryAllocated)
BOOLEAN NTAPI PsIsThreadImpersonating(IN PETHREAD Thread)
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
#define KeGetExceptionFrame(Thread)
#define KeGetContextPc(Context)
struct _LARGE_INTEGER::@2284 u
PVOID NTAPI PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion(_Out_ HANDLE *OutProcessId)
NTSTATUS NTAPI ObGetObjectSecurity(IN PVOID Object, OUT PSECURITY_DESCRIPTOR *SecurityDescriptor, OUT PBOOLEAN MemoryAllocated)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
ULONG NTAPI PsGetThreadSessionId(IN PETHREAD Thread)
PVOID NTAPI PsGetCurrentThreadStackBase(VOID)
_In_ KPROCESSOR_MODE PreviousMode
#define InterlockedExchangePointer(Target, Value)
ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]
_Out_ PCLIENT_ID ClientId
VOID NTAPI KeInitializeSemaphore(IN PKSEMAPHORE Semaphore, IN LONG Count, IN LONG Limit)
#define _SEH2_YIELD(STMT_)
VOID NTAPI PsSetThreadHardErrorsAreDisabled(IN PETHREAD Thread, IN BOOLEAN HardErrorsAreDisabled)
#define NT_SUCCESS(StatCode)
PEPROCESS NTAPI PsGetCurrentThreadProcess(VOID)
HANDLE NTAPI PsGetThreadProcessId(IN PETHREAD Thread)
PVOID NTAPI PsGetCurrentThreadTeb(VOID)
#define STATUS_PROCESS_IS_TERMINATING
#define ObDereferenceObject
#define ProbeForWriteHandle(Ptr)
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
ULONG ActiveImpersonationInfo
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
NTSTATUS NTAPI PsLookupProcessThreadByCid(IN PCLIENT_ID Cid, OUT PEPROCESS *Process OPTIONAL, OUT PETHREAD *Thread)
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
POBJECT_TYPE PsThreadType
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
#define PspSetCrossThreadFlag(Thread, Flag)
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
HANDLE NTAPI PsGetCurrentThreadProcessId(VOID)
#define KeEnterCriticalRegion()
BOOLEAN NTAPI PsGetThreadHardErrorsAreDisabled(IN PETHREAD Thread)
HANDLE NTAPI PsGetThreadId(IN PETHREAD Thread)
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
OBJECT_TYPE_INITIALIZER TypeInfo
FORCEINLINE ULONG ObpValidateAttributes(IN ULONG Attributes, IN KPROCESSOR_MODE PreviousMode)
PVOID NTAPI PsGetCurrentThreadStackLimit(VOID)
FORCEINLINE VOID PspRunCreateThreadNotifyRoutines(IN PETHREAD CurrentThread, IN BOOLEAN Create)
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
#define KeLeaveCriticalRegion()
GENERIC_MAPPING GenericMapping
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
ULONG NTAPI PsGetThreadFreezeCount(IN PETHREAD Thread)
#define InitializeListHead(ListHead)
NTSTATUS NTAPI PsCreateSystemThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, IN PCLIENT_ID ClientId, IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
VOID NTAPI PspSystemThreadStartup(IN PKSTART_ROUTINE StartRoutine, IN PVOID StartContext)
NTSTATUS NTAPI PsWrapApcWow64Thread(IN OUT PVOID *ApcContext, IN OUT PVOID *ApcRoutine)
VOID NTAPI SeDeleteAccessState(IN PACCESS_STATE AccessState)
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
NTSTATUS NTAPI NtCreateThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ProcessHandle, OUT PCLIENT_ID ClientId, IN PCONTEXT ThreadContext, IN PINITIAL_TEB InitialTeb, IN BOOLEAN CreateSuspended)
HANDLE NTAPI PsGetCurrentThreadId(VOID)
VOID FASTCALL ObFastDereferenceObject(IN PEX_FAST_REF FastRef, IN PVOID Object)
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define ObReferenceObject
ULONG NTAPI KeForceResumeThread(IN PKTHREAD Thread)
#define THREAD_QUERY_INFORMATION
PVOID PspSystemDllEntryPoint
#define RtlZeroMemory(Destination, Length)
ULONG NTAPI MmGetSessionId(IN PEPROCESS Process)
PEXCEPTION_RECORD ExceptionRecord
#define PSTRACE(x, fmt,...)
#define _SEH2_EXCEPT(...)
NTSTATUS NTAPI PspTerminateThreadByPointer(IN PETHREAD Thread, IN NTSTATUS ExitStatus, IN BOOLEAN bSelf)
PTEB NTAPI PsGetThreadTeb(IN PETHREAD Thread)
#define _SEH2_GetExceptionCode()
NTSTATUS NTAPI SeCreateAccessStateEx(IN PETHREAD Thread, IN PEPROCESS Process, IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
ULONG HardErrorsAreDisabled
BOOLEAN NTAPI PsIsThreadTerminating(IN PETHREAD Thread)
_In_ HANDLE ProcessHandle
#define KeGetTrapFrame(Thread)
POBJECT_TYPE PsProcessType
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
PULONG MinorVersion OPTIONAL
VOID NTAPI KeUninitThread(IN PKTHREAD Thread)
KSPIN_LOCK ActiveTimerListLock