obfuncs.h File Reference

#include <umtypes.h>
#include <pstypes.h>
#include <obtypes.h>

Include dependency graph for obfuncs.h:

Go to the source code of this file.

Functions
NTKERNELAPI NTSTATUS NTAPI	ObAssignSecurity (_In_ PACCESS_STATE AccessState, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PVOID Object, _In_ POBJECT_TYPE Type)
NTKERNELAPI NTSTATUS NTAPI	ObCloseHandle (_In_ HANDLE Handle, _In_ KPROCESSOR_MODE AccessMode)
NTKERNELAPI NTSTATUS NTAPI	ObCreateObject (_In_opt_ KPROCESSOR_MODE ObjectAttributesAccessMode, _In_ POBJECT_TYPE ObjectType, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ KPROCESSOR_MODE AccessMode, _Inout_opt_ PVOID ParseContext, _In_ ULONG ObjectSize, _In_opt_ ULONG PagedPoolCharge, _In_opt_ ULONG NonPagedPoolCharge, _Out_ PVOID *Object)
NTKERNELAPI NTSTATUS NTAPI	ObCreateObjectType (_In_ PUNICODE_STRING TypeName, _In_ POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, _Reserved_ PVOID Reserved, _Out_ POBJECT_TYPE *ObjectType)
NTKERNELAPI VOID NTAPI	ObDereferenceObjectDeferDelete (_In_ PVOID Object)
NTKERNELAPI VOID NTAPI	ObDereferenceSecurityDescriptor (_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Count)
NTKERNELAPI BOOLEAN NTAPI	ObFindHandleForObject (_In_ PEPROCESS Process, _In_ PVOID Object, _In_ POBJECT_TYPE ObjectType, _In_opt_ POBJECT_HANDLE_INFORMATION HandleInformation, _Out_opt_ PHANDLE Handle)
NTKERNELAPI ULONG NTAPI	ObGetObjectPointerCount (_In_ PVOID Object)
NTKERNELAPI NTSTATUS NTAPI	ObLogSecurityDescriptor (_In_ PSECURITY_DESCRIPTOR InputSecurityDescriptor, _Out_ PSECURITY_DESCRIPTOR *OutputSecurityDescriptor, _In_ ULONG RefBias)
NTKERNELAPI NTSTATUS NTAPI	ObOpenObjectByName (_In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ POBJECT_TYPE ObjectType, _In_ KPROCESSOR_MODE AccessMode, _In_opt_ PACCESS_STATE PassedAccessState, _In_ ACCESS_MASK DesiredAccess, _Inout_opt_ PVOID ParseContext, _Out_ PHANDLE Handle)
NTKERNELAPI NTSTATUS NTAPI	ObReferenceObjectByName (_In_ PUNICODE_STRING ObjectName, _In_ ULONG Attributes, _In_opt_ PACCESS_STATE PassedAccessState, _In_opt_ ACCESS_MASK DesiredAccess, _In_ POBJECT_TYPE ObjectType, _In_ KPROCESSOR_MODE AccessMode, _Inout_opt_ PVOID ParseContext, _Out_ PVOID *Object)
NTKERNELAPI VOID NTAPI	ObReferenceSecurityDescriptor (_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Count)
NTKERNELAPI NTSTATUS NTAPI	ObSetHandleAttributes (_In_ HANDLE Handle, _In_ POBJECT_HANDLE_FLAG_INFORMATION HandleFlags, _In_ KPROCESSOR_MODE PreviousMode)
	Sets the attributes (inheritable and protect-from-close) of an existing object handle.
NTKERNELAPI NTSTATUS NTAPI	ObSetSecurityObjectByPointer (_In_ PVOID Object, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
NTKERNELAPI POBJECT_TYPE FASTCALL	ObGetObjectType (_In_ PVOID Object)
NTSYSCALLAPI NTSTATUS NTAPI	NtClose (_In_ HANDLE Handle)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSCALLAPI NTSTATUS NTAPI	NtCreateDirectoryObject (_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtCreateSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PUNICODE_STRING Name)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSCALLAPI NTSTATUS NTAPI	NtDuplicateObject (_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle, _In_ HANDLE TargetProcessHandle, _Out_ PHANDLE TargetHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ ULONG Options)
NTSYSCALLAPI NTSTATUS NTAPI	NtMakePermanentObject (_In_ HANDLE Object)
NTSYSCALLAPI NTSTATUS NTAPI	NtMakeTemporaryObject (_In_ HANDLE Handle)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenDirectoryObject (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenJobObject (_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtQueryDirectoryObject (_In_ HANDLE DirectoryHandle, _Out_ PVOID Buffer, _In_ ULONG BufferLength, _In_ BOOLEAN ReturnSingleEntry, _In_ BOOLEAN RestartScan, _Inout_ PULONG Context, _Out_opt_ PULONG ReturnLength)
	_IRQL_requires_max_ (PASSIVE_LEVEL) __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryObject(_In_opt_ HANDLE Handle
	Queries information details about a security descriptor.
_In_ OBJECT_INFORMATION_CLASS	_Out_writes_bytes_opt_ (ObjectInformationLength) PVOID ObjectInformation
_In_ SECURITY_INFORMATION	_Out_writes_bytes_opt_ (Length) PSECURITY_DESCRIPTOR SecurityDescriptor
NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySymbolicLinkObject (_In_ HANDLE SymLinkObjHandle, _Out_ PUNICODE_STRING LinkTarget, _Out_opt_ PULONG DataWritten)
NTSYSCALLAPI NTSTATUS NTAPI	NtSetInformationObject (_In_ HANDLE ObjectHandle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_reads_bytes_(Length) PVOID ObjectInformation, _In_ ULONG Length)
	Sets information for an object or for a handle to an object.
NTSYSCALLAPI NTSTATUS NTAPI	NtSetSecurityObject (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
NTSYSCALLAPI NTSTATUS NTAPI	NtSignalAndWaitForSingleObject (_In_ HANDLE SignalObject, _In_ HANDLE WaitObject, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)
NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForMultipleObjects (_In_ ULONG Count, _In_ HANDLE Object[], _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)
NTSTATUS NTAPI	NtWaitForMultipleObjects32 (_In_ ULONG ObjectCount, _In_ PLONG Handles, _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER TimeOut)
NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForSingleObject (_In_ HANDLE Object, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout)
NTSYSAPI NTSTATUS NTAPI	ZwClose (_In_ HANDLE Handle)
NTSYSAPI NTSTATUS NTAPI	ZwCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSAPI NTSTATUS NTAPI	ZwCreateDirectoryObject (_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwCreateSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PUNICODE_STRING Name)
NTSYSAPI NTSTATUS NTAPI	ZwDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSAPI NTSTATUS NTAPI	ZwMakePermanentObject (_In_ HANDLE Object)
NTSYSAPI NTSTATUS NTAPI	ZwMakeTemporaryObject (_In_ HANDLE Handle)
NTSYSAPI NTSTATUS NTAPI	ZwOpenDirectoryObject (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwOpenJobObject (_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwOpenSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwSetInformationObject (_In_ HANDLE ObjectHandle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_ PVOID ObjectInformation, _In_ ULONG Length)
NTSYSAPI NTSTATUS NTAPI	ZwSignalAndWaitForSingleObject (_In_ HANDLE SignalObject, _In_ HANDLE WaitObject, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Time)
NTSYSAPI NTSTATUS NTAPI	ZwWaitForMultipleObjects (_In_ ULONG Count, _In_ HANDLE Object[], _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)

Variables
_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass
_In_ OBJECT_INFORMATION_CLASS _In_ ULONG	ObjectInformationLength
_In_ OBJECT_INFORMATION_CLASS _In_ ULONG _Out_opt_ PULONG	ReturnLength
_In_ SECURITY_INFORMATION	SecurityInformation
_In_ SECURITY_INFORMATION _In_ ULONG	Length
_In_ SECURITY_INFORMATION _In_ ULONG _Out_ PULONG	LengthNeeded
_In_ HANDLE	SourceHandle
_In_ HANDLE _In_opt_ HANDLE	TargetProcessHandle
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE	TargetHandle
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK	DesiredAccess
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG	HandleAttributes
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG _In_ ULONG	Options
_Out_ PVOID	Buffer
_Out_ PVOID _In_ ULONG	BufferLength
_Out_ PVOID _In_ ULONG _In_ BOOLEAN	ReturnSingleEntry
_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN	RestartScan
_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG	Context

Function Documentation

_IRQL_requires_max_()

_IRQL_requires_max_

(

PASSIVE_LEVEL

)

Queries information details about a security descriptor.

Computes the quota size of a security descriptor.

Assigns a security descriptor for a new object.

An extended function that assigns a security descriptor for a new object.

Frees a security descriptor.

An extended function that sets new information data to a security descriptor.

Modifies some information data about a security descriptor.

Parameters

[in]	SecurityInformation	Security information details to be queried from a security descriptor.
[out]	SecurityDescriptor	The returned security descriptor with security information data.
[in,out]	Length	The returned length of a security descriptor.
[in,out]	ObjectsSecurityDescriptor	The returned object security descriptor.

Returns

Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns

See SeSetSecurityDescriptorInfoEx.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	AutoInheritFlags	Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns

Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.

Parameters

[in]

SecurityDescriptor

A security descriptor to be freed from memory.

Returns

Returns STATUS_SUCCESS.

Parameters

[in]	_ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	_ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	ObjectType	The type of the new object.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	AutoInheritFlags	Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns

Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.

Parameters

[in]	ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns

See SeAssignSecurityEx.

Parameters

[in]	SecurityDescriptor	A security descriptor.
[out]	QuotaInfoSize	The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.

Returns

Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.

Definition at line 923 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;
 
    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));
 
        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);
 
        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;
 
        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);
 
            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;
 
            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }
 
    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }
 
    return Status;
}

_Out_writes_bytes_opt_() [1/2]

_In_ SECURITY_INFORMATION _Out_writes_bytes_opt_

(

Length

)

_Out_writes_bytes_opt_() [2/2]

_In_ OBJECT_INFORMATION_CLASS _Out_writes_bytes_opt_

(

ObjectInformationLength

)

NtClose()

NTSYSCALLAPI NTSTATUS NTAPI NtClose

(

_In_ HANDLE

Handle

)

NtCloseObjectAuditAlarm()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

NtCreateDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtCreateDirectoryObject	(	_Out_ PHANDLE	DirectoryHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtCreateSymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PUNICODE_STRING	Name
	)

NtDeleteObjectAuditAlarm()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

NtDuplicateObject()

NTSYSCALLAPI NTSTATUS NTAPI NtDuplicateObject	(	_In_ HANDLE	SourceProcessHandle,
		_In_ HANDLE	SourceHandle,
		_In_ HANDLE	TargetProcessHandle,
		_Out_ PHANDLE	TargetHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ ULONG	HandleAttributes,
		_In_ ULONG	Options
	)

NtMakePermanentObject()

NTSYSCALLAPI NTSTATUS NTAPI NtMakePermanentObject

(

_In_ HANDLE

Object

)

NtMakeTemporaryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtMakeTemporaryObject

(

_In_ HANDLE

Handle

)

NtOpenDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenDirectoryObject	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtOpenJobObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenJobObject	(	_Out_ PHANDLE	JobHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Opens a handle to an existing job object.

Parameters

JobHandle	A pointer to a handle that will receive the handle of the created job object.
DesiredAccess	Specifies the desired access rights for the job object.
ObjectAttributes	Pointer to the OBJECT_ATTRIBUTES structure specifying the object name and attributes.

Returns

STATUS_SUCCESS if the job object is successfully created. An appropriate NTSTATUS error code otherwise.

Definition at line 1862 of file job.c.

{
    KPROCESSOR_MODE PreviousMode;
    HANDLE Handle;
    NTSTATUS Status;
 
    PAGED_CODE();
 
    PreviousMode = ExGetPreviousMode();
 
    /* Check for valid buffers */
    if (PreviousMode != KernelMode)
    {
        _SEH2_TRY
        {
            ProbeForWriteHandle(JobHandle);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
 
    Status = ObOpenObjectByName(ObjectAttributes,
                                PsJobType,
                                PreviousMode,
                                NULL,
                                DesiredAccess,
                                NULL,
                                &Handle);
    if (NT_SUCCESS(Status))
    {
        _SEH2_TRY
        {
            *JobHandle = Handle;
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            Status = _SEH2_GetExceptionCode();
        }
        _SEH2_END;
    }
 
    return Status;
}

NtOpenSymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtQueryDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtQueryDirectoryObject	(	_In_ HANDLE	DirectoryHandle,
		_Out_ PVOID	Buffer,
		_In_ ULONG	BufferLength,
		_In_ BOOLEAN	ReturnSingleEntry,
		_In_ BOOLEAN	RestartScan,
		_Inout_ PULONG	Context,
		_Out_opt_ PULONG	ReturnLength
	)

NtQuerySymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject	(	_In_ HANDLE	SymLinkObjHandle,
		_Out_ PUNICODE_STRING	LinkTarget,
		_Out_opt_ PULONG	DataWritten
	)

NtSetInformationObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationObject	(	_In_ HANDLE	ObjectHandle,
		_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_reads_bytes_(Length) PVOID	ObjectInformation,
		_In_ ULONG	Length
	)

Sets information for an object or for a handle to an object.

Parameters

[in]	ObjectHandle	Handle to the target object. For the ObjectHandleFlagInformation class, this is the handle whose attributes are to be modified. For the ObjectSessionInformation class, this must be a handle to a directory object.
[in]	ObjectInformationClass	Specifies the type of information to set. The only supported classes are: ObjectHandleFlagInformation and ObjectSessionInformation. (Windows 10 RS2 added support for ObjectSessionObjectInformation. Windows 11 25H2 added support for ObjectSetRefTraceInformation.)
[in]	ObjectInformation	Pointer to a caller-supplied buffer containing the information to set. For the ObjectHandleFlagInformation class, this buffer must point to an OBJECT_HANDLE_FLAG_INFORMATION structure describing the desired handle attributes (inherit and protect-from-close). For the ObjectSessionInformation class, this parameter is ignored.
[in]	Length	The size in bytes, of the buffer pointed to by ObjectInformation. For the ObjectHandleFlagInformation class, this must be sizeof(OBJECT_HANDLE_FLAG_INFORMATION). For the ObjectSessionInformation class, this parameter is ignored.

Returns

STATUS_SUCCESS or an appropriate error value.

Remarks

This routine only supports the following classes:

• ObjectHandleFlagInformation, to set the OBJ_INHERIT and OBJ_PROTECT_CLOSE attributes of a handle.
• ObjectSessionInformation, to associate a directory object with the caller's current session identifier; this requires the SeTcbPrivilege.

ObjectHandleFlagInformation operates on per-handle state rather than on the underlying object itself.

Definition at line 1854 of file oblife.c.

{
    NTSTATUS Status;
    KPROCESSOR_MODE PreviousMode;
 
    PAGED_CODE();
 
    /* Validate the information class */
    switch (ObjectInformationClass)
    {
        case ObjectHandleFlagInformation:
        {
            OBJECT_HANDLE_FLAG_INFORMATION HandleFlags;
 
            /* Validate the length */
            if (Length != sizeof(HandleFlags))
                return STATUS_INFO_LENGTH_MISMATCH;
 
            /* Save the previous mode */
            PreviousMode = ExGetPreviousMode();
 
            /* If we were called from user mode, probe and capture the
             * attribute buffer, otherwise just copy it directly. */
            if (PreviousMode != KernelMode)
            {
                _SEH2_TRY
                {
                    ProbeForRead(ObjectInformation, sizeof(HandleFlags), sizeof(BOOLEAN));
                    HandleFlags = *(POBJECT_HANDLE_FLAG_INFORMATION)ObjectInformation;
                }
                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                    /* Return the exception code */
                    _SEH2_YIELD(return _SEH2_GetExceptionCode());
                }
                _SEH2_END;
            }
            else
            {
                HandleFlags = *(POBJECT_HANDLE_FLAG_INFORMATION)ObjectInformation;
            }
 
            Status = ObSetHandleAttributes(ObjectHandle, &HandleFlags, PreviousMode);
            break;
        }
 
        case ObjectSessionInformation:
        {
            POBJECT_DIRECTORY Directory;
 
            UNREFERENCED_PARAMETER(ObjectInformation);
            UNREFERENCED_PARAMETER(Length);
 
            /* Only a system process can do this */
            PreviousMode = ExGetPreviousMode();
            if (!SeSinglePrivilegeCheck(SeTcbPrivilege, PreviousMode))
            {
                DPRINT1("Privilege not held\n");
                return STATUS_PRIVILEGE_NOT_HELD;
            }
 
            /* Get the object directory */
            Status = ObReferenceObjectByHandle(ObjectHandle,
                                               0,
                                               ObpDirectoryObjectType,
                                               PreviousMode,
                                               (PVOID*)&Directory,
                                               NULL);
            if (NT_SUCCESS(Status))
            {
                /* Setup a lookup context */
                OBP_LOOKUP_CONTEXT LookupContext;
                ObpInitializeLookupContext(&LookupContext);
 
                /* Set the directory session ID */
                ObpAcquireDirectoryLockExclusive(Directory, &LookupContext);
                Directory->SessionId = PsGetCurrentProcessSessionId();
                ObpReleaseDirectoryLock(Directory, &LookupContext);
 
                /* We're done, release the context and dereference the directory */
                ObpReleaseLookupContext(&LookupContext);
                ObDereferenceObject(Directory);
            }
            break;
        }
 
        default:
            /* Unsupported class */
            Status = STATUS_INVALID_INFO_CLASS;
            break;
    }
 
    return Status;
}

Referenced by BaseInitializeStaticServerData(), ProtectHandle(), SetHandleInformation(), SockCreateOrReferenceAsyncThread(), SockGetAsyncSelectHelperAfdHandle(), and UnProtectHandle().

NtSetSecurityObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSetSecurityObject	(	_In_ HANDLE	Handle,
		_In_ SECURITY_INFORMATION	SecurityInformation,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

NtSignalAndWaitForSingleObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSignalAndWaitForSingleObject	(	_In_ HANDLE	SignalObject,
		_In_ HANDLE	WaitObject,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

NtWaitForMultipleObjects()

NTSYSCALLAPI NTSTATUS NTAPI NtWaitForMultipleObjects	(	_In_ ULONG	Count,
		_In_ HANDLE	Object[],
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

NtWaitForMultipleObjects32()

NTSTATUS NTAPI NtWaitForMultipleObjects32	(	_In_ ULONG	ObjectCount,
		_In_ PLONG	Handles,
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	TimeOut
	)

NtWaitForSingleObject()

NTSYSCALLAPI NTSTATUS NTAPI NtWaitForSingleObject	(	_In_ HANDLE	Object,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Timeout
	)

ObAssignSecurity()

NTKERNELAPI NTSTATUS NTAPI ObAssignSecurity	(	_In_ PACCESS_STATE	AccessState,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PVOID	Object,
		_In_ POBJECT_TYPE	Type
	)

ObCloseHandle()

NTKERNELAPI NTSTATUS NTAPI ObCloseHandle	(	_In_ HANDLE	Handle,
		_In_ KPROCESSOR_MODE	AccessMode
	)

ObCreateObject()

NTKERNELAPI NTSTATUS NTAPI ObCreateObject	(	_In_opt_ KPROCESSOR_MODE	ObjectAttributesAccessMode,
		_In_ POBJECT_TYPE	ObjectType,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Inout_opt_ PVOID	ParseContext,
		_In_ ULONG	ObjectSize,
		_In_opt_ ULONG	PagedPoolCharge,
		_In_opt_ ULONG	NonPagedPoolCharge,
		_Out_ PVOID *	Object
	)

ObCreateObjectType()

NTKERNELAPI NTSTATUS NTAPI ObCreateObjectType	(	_In_ PUNICODE_STRING	TypeName,
		_In_ POBJECT_TYPE_INITIALIZER	ObjectTypeInitializer,
		_Reserved_ PVOID	Reserved,
		_Out_ POBJECT_TYPE *	ObjectType
	)

ObDereferenceObjectDeferDelete()

NTKERNELAPI VOID NTAPI ObDereferenceObjectDeferDelete

(

_In_ PVOID

Object

)

ObDereferenceSecurityDescriptor()

NTKERNELAPI VOID NTAPI ObDereferenceSecurityDescriptor	(	_Inout_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ULONG	Count
	)

ObFindHandleForObject()

NTKERNELAPI BOOLEAN NTAPI ObFindHandleForObject	(	_In_ PEPROCESS	Process,
		_In_ PVOID	Object,
		_In_ POBJECT_TYPE	ObjectType,
		_In_opt_ POBJECT_HANDLE_INFORMATION	HandleInformation,
		_Out_opt_ PHANDLE	Handle
	)

ObGetObjectPointerCount()

NTKERNELAPI ULONG NTAPI ObGetObjectPointerCount

(

_In_ PVOID

Object

)

ObGetObjectType()

NTKERNELAPI POBJECT_TYPE FASTCALL ObGetObjectType

(

_In_ PVOID

Object

)

Definition at line 1040 of file oblife.c.

{
    UNIMPLEMENTED;
    return NULL;
}

ObLogSecurityDescriptor()

NTKERNELAPI NTSTATUS NTAPI ObLogSecurityDescriptor	(	_In_ PSECURITY_DESCRIPTOR	InputSecurityDescriptor,
		_Out_ PSECURITY_DESCRIPTOR *	OutputSecurityDescriptor,
		_In_ ULONG	RefBias
	)

ObOpenObjectByName()

NTKERNELAPI NTSTATUS NTAPI ObOpenObjectByName	(	_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ POBJECT_TYPE	ObjectType,
		_In_ KPROCESSOR_MODE	AccessMode,
		_In_opt_ PACCESS_STATE	PassedAccessState,
		_In_ ACCESS_MASK	DesiredAccess,
		_Inout_opt_ PVOID	ParseContext,
		_Out_ PHANDLE	Handle
	)

ObReferenceObjectByName()

NTKERNELAPI NTSTATUS NTAPI ObReferenceObjectByName	(	_In_ PUNICODE_STRING	ObjectName,
		_In_ ULONG	Attributes,
		_In_opt_ PACCESS_STATE	PassedAccessState,
		_In_opt_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_TYPE	ObjectType,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Inout_opt_ PVOID	ParseContext,
		_Out_ PVOID *	Object
	)

ObReferenceSecurityDescriptor()

NTKERNELAPI VOID NTAPI ObReferenceSecurityDescriptor	(	_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ULONG	Count
	)

ObSetHandleAttributes()

NTKERNELAPI NTSTATUS NTAPI ObSetHandleAttributes	(	_In_ HANDLE	Handle,
		_In_ POBJECT_HANDLE_FLAG_INFORMATION	HandleFlags,
		_In_ KPROCESSOR_MODE	PreviousMode
	)

Sets the attributes (inheritable and protect-from-close) of an existing object handle.

Parameters

[in]	Handle	Handle whose attributes are to be modified.
[in]	HandleFlags	Pointer to an OBJECT_HANDLE_FLAG_INFORMATION structure specifying the new values for the handle's inherit and protect-from-close attributes.
[in]	PreviousMode	Processor mode of the original caller. This is used to determine whether Handle may refer to a kernel handle.

Returns

STATUS_SUCCESS on success, or STATUS_ACCESS_DENIED if the handle could not be located or its attributes could not be changed.

Remarks

This routine operates on per-handle state rather than on the underlying object itself. Requests to make a handle inheritable fail if the target object type does not permit the OBJ_INHERIT attribute.

Definition at line 3341 of file obhandle.c.

{
    OBP_SET_HANDLE_ATTRIBUTES_CONTEXT SetHandleAttributesContext;
    BOOLEAN Result, AttachedToProcess = FALSE;
    PHANDLE_TABLE HandleTable;
    KAPC_STATE ApcState;
 
    PAGED_CODE();
 
    /* Check if this is a kernel handle */
    if (ObpIsKernelHandle(Handle, PreviousMode))
    {
        /* Use the kernel table and convert the handle */
        HandleTable = ObpKernelHandleTable;
        Handle = ObKernelHandleToHandle(Handle);
 
        /* Check if we're not in the system process */
        if (PsGetCurrentProcess() != PsInitialSystemProcess)
        {
            /* Attach to the system process */
            KeStackAttachProcess(&PsInitialSystemProcess->Pcb, &ApcState);
            AttachedToProcess = TRUE;
        }
    }
    else
    {
        /* Get the current process' handle table */
        HandleTable = PsGetCurrentProcess()->ObjectTable;
    }
 
    /* Initialize the handle attribute context */
    SetHandleAttributesContext.PreviousMode = PreviousMode;
    SetHandleAttributesContext.Information = *HandleFlags;
 
    /* Invoke the ObpSetHandleAttributes callback */
    Result = ExChangeHandle(HandleTable,
                            Handle,
                            ObpSetHandleAttributes,
                            (ULONG_PTR)&SetHandleAttributesContext);
 
    /* Detach from the system process if needed */
    if (AttachedToProcess)
        KeUnstackDetachProcess(&ApcState);
 
    /* Return the result as an NTSTATUS value */
    return (Result ? STATUS_SUCCESS : STATUS_ACCESS_DENIED);
}

Referenced by NtSetInformationObject().

ObSetSecurityObjectByPointer()

NTKERNELAPI NTSTATUS NTAPI ObSetSecurityObjectByPointer	(	_In_ PVOID	Object,
		_In_ SECURITY_INFORMATION	SecurityInformation,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

ZwClose()

NTSYSAPI NTSTATUS NTAPI ZwClose

(

_In_ HANDLE

Handle

)

ZwCloseObjectAuditAlarm()

NTSYSAPI NTSTATUS NTAPI ZwCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

ZwCreateDirectoryObject()

NTSYSAPI NTSTATUS NTAPI ZwCreateDirectoryObject	(	_Out_ PHANDLE	DirectoryHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by AtaCreateIdeDirectory(), DiskCreateFdo(), ObtCreateDirectory(), PciIdeXCreateIdeDirectory(), SeGetLogonIdDeviceMap(), SepInitializationPhase1(), START_TEST(), and UserCreateWinstaDirectory().

ZwCreateSymbolicLinkObject()

NTSYSAPI NTSTATUS NTAPI ZwCreateSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PUNICODE_STRING	Name
	)

Referenced by IoCreateSymbolicLink(), IoCreateUnprotectedSymbolicLink(), SeGetLogonIdDeviceMap(), and START_TEST().

ZwDeleteObjectAuditAlarm()

NTSYSAPI NTSTATUS NTAPI ZwDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

ZwMakePermanentObject()

NTSYSAPI NTSTATUS NTAPI ZwMakePermanentObject

(

_In_ HANDLE

Object

)

ZwMakeTemporaryObject()

NTSYSAPI NTSTATUS NTAPI ZwMakeTemporaryObject

(

_In_ HANDLE

Handle

)

Referenced by DiskCreateFdo(), DiskRemoveDevice(), IoDeleteSymbolicLink(), ObtClose(), SepCleanupLUIDDeviceMapDirectory(), and TestReference().

ZwOpenDirectoryObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenDirectoryObject	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by BuildWindowStationNameList(), CheckDirectorySecurity__(), IntCreateDesktopSwitchEvent(), LdrpInitializeProcess(), ObjectBasicInformationTests(), SepCleanupLUIDDeviceMapDirectory(), and TestObRootSecurity().

ZwOpenJobObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenJobObject	(	_Out_ PHANDLE	JobHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

ZwOpenSymbolicLinkObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by get_system_root(), IoDeleteSymbolicLink(), IopStoreSystemPartitionInformation(), MountMgrMountedDeviceArrival(), MountMgrQuerySymbolicLink(), NotificationCallback(), SepCleanupLUIDDeviceMapDirectory(), START_TEST(), TestRelativeNames(), and ViCreateDriveLetter().

ZwSetInformationObject()

NTSYSAPI NTSTATUS NTAPI ZwSetInformationObject	(	_In_ HANDLE	ObjectHandle,
		_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_ PVOID	ObjectInformation,
		_In_ ULONG	Length
	)

ZwSignalAndWaitForSingleObject()

NTSYSAPI NTSTATUS NTAPI ZwSignalAndWaitForSingleObject	(	_In_ HANDLE	SignalObject,
		_In_ HANDLE	WaitObject,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Time
	)

ZwWaitForMultipleObjects()

NTSYSAPI NTSTATUS NTAPI ZwWaitForMultipleObjects	(	_In_ ULONG	Count,
		_In_ HANDLE	Object[],
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

Referenced by KernelModeTest().

Variable Documentation

Buffer

_Out_ PVOID Buffer

Definition at line 502 of file obfuncs.h.

BufferLength

_Out_ PVOID _In_ ULONG BufferLength

Definition at line 503 of file obfuncs.h.

Context

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG Context

Definition at line 506 of file obfuncs.h.

DesiredAccess

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK DesiredAccess

Definition at line 450 of file obfuncs.h.

HandleAttributes

_In_ ACCESS_MASK _In_ BOOLEAN _In_ ULONG HandleAttributes

Definition at line 451 of file obfuncs.h.

Referenced by NtDuplicateObject(), NtGetNextProcess(), NtGetNextThread(), NtOpenProcessTokenEx(), NtOpenThreadTokenEx(), ObDuplicateObject(), ObOpenObjectByPointer(), ObpCreateHandle(), ObpCreateUnnamedHandle(), ObpEnumFindHandleProcedure(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), SepOpenThreadToken(), START_TEST(), UserOpenInputDesktop(), and WmipOpenGuidObject().

Length

_In_ SECURITY_INFORMATION _In_ ULONG Length

Definition at line 325 of file obfuncs.h.

LengthNeeded

_In_ SECURITY_INFORMATION _In_ ULONG _Out_ PULONG LengthNeeded

Definition at line 326 of file obfuncs.h.

ObjectInformationClass

_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass

Definition at line 310 of file obfuncs.h.

ObjectInformationLength

_In_ OBJECT_INFORMATION_CLASS _In_ ULONG ObjectInformationLength

Definition at line 312 of file obfuncs.h.

Options

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG _In_ ULONG Options

Definition at line 452 of file obfuncs.h.

RestartScan

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN RestartScan

Definition at line 505 of file obfuncs.h.

ReturnLength

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG _Out_opt_ PULONG ReturnLength

Definition at line 313 of file obfuncs.h.

ReturnSingleEntry

_Out_ PVOID _In_ ULONG _In_ BOOLEAN ReturnSingleEntry

Definition at line 504 of file obfuncs.h.

SecurityInformation

_In_ SECURITY_INFORMATION SecurityInformation

Definition at line 323 of file obfuncs.h.

SourceHandle

_In_ HANDLE SourceHandle

Definition at line 447 of file obfuncs.h.

Referenced by CmpConvertHandleToKernelHandle(), CON_API(), MoveFileWithProgressW(), NtDuplicateObject(), ObDuplicateObject(), PrivMoveFileIdentityW(), and SetupMoveFile().

TargetHandle

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE TargetHandle

Definition at line 449 of file obfuncs.h.

Referenced by AcpiEvaluateObjectTyped(), AcpiNsHandleToName(), AcpiNsHandleToPathname(), IopOpenLinkOrRenameTarget(), KernelModeTest(), NtDuplicateObject(), NtSetInformationFile(), ObDuplicateObject(), and VfatSetRenameInformation().

TargetProcessHandle

_In_ HANDLE _In_opt_ HANDLE TargetProcessHandle

Definition at line 448 of file obfuncs.h.

Referenced by NtDuplicateObject().