obfuncs.h File Reference

#include <umtypes.h>
#include <pstypes.h>
#include <obtypes.h>

Include dependency graph for obfuncs.h:

Go to the source code of this file.

Functions
NTKERNELAPI NTSTATUS NTAPI	ObAssignSecurity (_In_ PACCESS_STATE AccessState, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ PVOID Object, _In_ POBJECT_TYPE Type)
NTKERNELAPI NTSTATUS NTAPI	ObCloseHandle (_In_ HANDLE Handle, _In_ KPROCESSOR_MODE AccessMode)
NTKERNELAPI NTSTATUS NTAPI	ObCreateObject (_In_opt_ KPROCESSOR_MODE ObjectAttributesAccessMode, _In_ POBJECT_TYPE ObjectType, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ KPROCESSOR_MODE AccessMode, _Inout_opt_ PVOID ParseContext, _In_ ULONG ObjectSize, _In_opt_ ULONG PagedPoolCharge, _In_opt_ ULONG NonPagedPoolCharge, _Out_ PVOID *Object)
NTKERNELAPI NTSTATUS NTAPI	ObCreateObjectType (_In_ PUNICODE_STRING TypeName, _In_ POBJECT_TYPE_INITIALIZER ObjectTypeInitializer, _Reserved_ PVOID Reserved, _Out_ POBJECT_TYPE *ObjectType)
NTKERNELAPI VOID NTAPI	ObDereferenceSecurityDescriptor (_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Count)
NTKERNELAPI ULONG NTAPI	ObGetObjectPointerCount (_In_ PVOID Object)
NTKERNELAPI NTSTATUS NTAPI	ObLogSecurityDescriptor (_In_ PSECURITY_DESCRIPTOR InputSecurityDescriptor, _Out_ PSECURITY_DESCRIPTOR *OutputSecurityDescriptor, _In_ ULONG RefBias)
NTKERNELAPI NTSTATUS NTAPI	ObOpenObjectByName (_In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ POBJECT_TYPE ObjectType, _In_ KPROCESSOR_MODE AccessMode, _In_opt_ PACCESS_STATE PassedAccessState, _In_ ACCESS_MASK DesiredAccess, _Inout_opt_ PVOID ParseContext, _Out_ PHANDLE Handle)
NTKERNELAPI NTSTATUS NTAPI	ObReferenceObjectByName (_In_ PUNICODE_STRING ObjectName, _In_ ULONG Attributes, _In_opt_ PACCESS_STATE PassedAccessState, _In_opt_ ACCESS_MASK DesiredAccess, _In_ POBJECT_TYPE ObjectType, _In_ KPROCESSOR_MODE AccessMode, _Inout_opt_ PVOID ParseContext, _Out_ PVOID *Object)
NTKERNELAPI VOID NTAPI	ObReferenceSecurityDescriptor (_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Count)
NTKERNELAPI NTSTATUS NTAPI	ObSetSecurityObjectByPointer (_In_ PVOID Object, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
NTKERNELAPI BOOLEAN NTAPI	ObFindHandleForObject (_In_ PEPROCESS Process, _In_ PVOID Object, _In_ POBJECT_TYPE ObjectType, _In_opt_ POBJECT_HANDLE_INFORMATION HandleInformation, _Out_opt_ PHANDLE Handle)
NTKERNELAPI VOID NTAPI	ObDereferenceObjectDeferDelete (_In_ PVOID Object)
NTSYSCALLAPI NTSTATUS NTAPI	NtClose (_In_ HANDLE Handle)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSCALLAPI NTSTATUS NTAPI	NtCreateDirectoryObject (_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtCreateSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PUNICODE_STRING Name)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSCALLAPI NTSTATUS NTAPI	NtDuplicateObject (_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle, _In_ HANDLE TargetProcessHandle, _Out_ PHANDLE TargetHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ ULONG Options)
NTSYSCALLAPI NTSTATUS NTAPI	NtMakePermanentObject (_In_ HANDLE Object)
NTSYSCALLAPI NTSTATUS NTAPI	NtMakeTemporaryObject (_In_ HANDLE Handle)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenDirectoryObject (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenJobObject (_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtQueryDirectoryObject (_In_ HANDLE DirectoryHandle, _Out_ PVOID Buffer, _In_ ULONG BufferLength, _In_ BOOLEAN ReturnSingleEntry, _In_ BOOLEAN RestartScan, _Inout_ PULONG Context, _Out_opt_ PULONG ReturnLength)
	_IRQL_requires_max_ (PASSIVE_LEVEL) __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryObject(_In_opt_ HANDLE Handle
	Queries information details about a security descriptor. More...
_In_ OBJECT_INFORMATION_CLASS	_Out_writes_bytes_opt_ (ObjectInformationLength) PVOID ObjectInformation
_In_ SECURITY_INFORMATION	_Out_writes_bytes_opt_ (Length) PSECURITY_DESCRIPTOR SecurityDescriptor
NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySymbolicLinkObject (_In_ HANDLE SymLinkObjHandle, _Out_ PUNICODE_STRING LinkTarget, _Out_opt_ PULONG DataWritten)
NTSYSCALLAPI NTSTATUS NTAPI	NtSetInformationObject (_In_ HANDLE ObjectHandle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_ PVOID ObjectInformation, _In_ ULONG Length)
NTSYSCALLAPI NTSTATUS NTAPI	NtSetSecurityObject (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
NTSYSCALLAPI NTSTATUS NTAPI	NtSignalAndWaitForSingleObject (_In_ HANDLE SignalObject, _In_ HANDLE WaitObject, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)
NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForMultipleObjects (_In_ ULONG Count, _In_ HANDLE Object[], _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)
NTSTATUS NTAPI	NtWaitForMultipleObjects32 (_In_ ULONG ObjectCount, _In_ PLONG Handles, _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER TimeOut)
NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForSingleObject (_In_ HANDLE Object, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout)
NTSYSAPI NTSTATUS NTAPI	ZwClose (_In_ HANDLE Handle)
NTSYSAPI NTSTATUS NTAPI	ZwCloseObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSAPI NTSTATUS NTAPI	ZwCreateDirectoryObject (_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwCreateSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PUNICODE_STRING Name)
NTSYSAPI NTSTATUS NTAPI	ZwDeleteObjectAuditAlarm (_In_ PUNICODE_STRING SubsystemName, _In_ PVOID HandleId, _In_ BOOLEAN GenerateOnClose)
NTSYSAPI NTSTATUS NTAPI	ZwMakePermanentObject (_In_ HANDLE Object)
NTSYSAPI NTSTATUS NTAPI	ZwMakeTemporaryObject (_In_ HANDLE Handle)
NTSYSAPI NTSTATUS NTAPI	ZwOpenDirectoryObject (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwOpenJobObject (_Out_ PHANDLE JobHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwOpenSymbolicLinkObject (_Out_ PHANDLE SymbolicLinkHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwSetInformationObject (_In_ HANDLE ObjectHandle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_ PVOID ObjectInformation, _In_ ULONG Length)
NTSYSAPI NTSTATUS NTAPI	ZwSignalAndWaitForSingleObject (_In_ HANDLE SignalObject, _In_ HANDLE WaitObject, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Time)
NTSYSAPI NTSTATUS NTAPI	ZwWaitForMultipleObjects (_In_ ULONG Count, _In_ HANDLE Object[], _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER Time)

Variables
_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass
_In_ OBJECT_INFORMATION_CLASS _In_ ULONG	ObjectInformationLength
_In_ OBJECT_INFORMATION_CLASS _In_ ULONG _Out_opt_ PULONG	ReturnLength
_In_ SECURITY_INFORMATION	SecurityInformation
_In_ SECURITY_INFORMATION _In_ ULONG	Length
_In_ SECURITY_INFORMATION _In_ ULONG _Out_ PULONG	LengthNeeded
_In_ HANDLE	SourceHandle
_In_ HANDLE _In_opt_ HANDLE	TargetProcessHandle
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE	TargetHandle
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK	DesiredAccess
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG	HandleAttributes
_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG _In_ ULONG	Options
_Out_ PVOID	Buffer
_Out_ PVOID _In_ ULONG	BufferLength
_Out_ PVOID _In_ ULONG _In_ BOOLEAN	ReturnSingleEntry
_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN	RestartScan
_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG	Context

Function Documentation

_IRQL_requires_max_()

_IRQL_requires_max_

(

PASSIVE_LEVEL

)

Queries information details about a security descriptor.

Computes the quota size of a security descriptor.

Assigns a security descriptor for a new object.

An extended function that assigns a security descriptor for a new object.

Frees a security descriptor.

An extended function that sets new information data to a security descriptor.

Modifies some information data about a security descriptor.

Parameters

[in]	SecurityInformation	Security information details to be queried from a security descriptor.
[out]	SecurityDescriptor	The returned security descriptor with security information data.
[in,out]	Length	The returned length of a security descriptor.
[in,out]	ObjectsSecurityDescriptor	The returned object security descriptor.

Returns

Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns

See SeSetSecurityDescriptorInfoEx.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	AutoInheritFlags	Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns

Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.

Parameters

[in]

SecurityDescriptor

A security descriptor to be freed from memory.

Returns

Returns STATUS_SUCCESS.

Parameters

[in]	_ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	_ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	ObjectType	The type of the new object.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	AutoInheritFlags	Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns

Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.

Parameters

[in]	ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns

See SeAssignSecurityEx.

Parameters

[in]	SecurityDescriptor	A security descriptor.
[out]	QuotaInfoSize	The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.

Returns

Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.

Definition at line 64 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;

    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }

    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));

        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);

        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;

        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);

            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;

            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }

    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }

    return Status;
}

_Out_writes_bytes_opt_() [1/2]

_In_ OBJECT_INFORMATION_CLASS _Out_writes_bytes_opt_

(

ObjectInformationLength

)

_Out_writes_bytes_opt_() [2/2]

_In_ SECURITY_INFORMATION _Out_writes_bytes_opt_

(

Length

)

NtClose()

NTSYSCALLAPI NTSTATUS NTAPI NtClose

(

_In_ HANDLE

Handle

)

NtCloseObjectAuditAlarm()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

NtCreateDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtCreateDirectoryObject	(	_Out_ PHANDLE	DirectoryHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtCreateSymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PUNICODE_STRING	Name
	)

NtDeleteObjectAuditAlarm()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_opt_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

NtDuplicateObject()

NTSYSCALLAPI NTSTATUS NTAPI NtDuplicateObject	(	_In_ HANDLE	SourceProcessHandle,
		_In_ HANDLE	SourceHandle,
		_In_ HANDLE	TargetProcessHandle,
		_Out_ PHANDLE	TargetHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ ULONG	HandleAttributes,
		_In_ ULONG	Options
	)

NtMakePermanentObject()

NTSYSCALLAPI NTSTATUS NTAPI NtMakePermanentObject

(

_In_ HANDLE

Object

)

NtMakeTemporaryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtMakeTemporaryObject

(

_In_ HANDLE

Handle

)

NtOpenDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenDirectoryObject	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtOpenJobObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenJobObject	(	_Out_ PHANDLE	JobHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtOpenSymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtQueryDirectoryObject()

NTSYSCALLAPI NTSTATUS NTAPI NtQueryDirectoryObject	(	_In_ HANDLE	DirectoryHandle,
		_Out_ PVOID	Buffer,
		_In_ ULONG	BufferLength,
		_In_ BOOLEAN	ReturnSingleEntry,
		_In_ BOOLEAN	RestartScan,
		_Inout_ PULONG	Context,
		_Out_opt_ PULONG	ReturnLength
	)

NtQuerySymbolicLinkObject()

NTSYSCALLAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject	(	_In_ HANDLE	SymLinkObjHandle,
		_Out_ PUNICODE_STRING	LinkTarget,
		_Out_opt_ PULONG	DataWritten
	)

NtSetInformationObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationObject	(	_In_ HANDLE	ObjectHandle,
		_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_ PVOID	ObjectInformation,
		_In_ ULONG	Length
	)

NtSetSecurityObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSetSecurityObject	(	_In_ HANDLE	Handle,
		_In_ SECURITY_INFORMATION	SecurityInformation,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

NtSignalAndWaitForSingleObject()

NTSYSCALLAPI NTSTATUS NTAPI NtSignalAndWaitForSingleObject	(	_In_ HANDLE	SignalObject,
		_In_ HANDLE	WaitObject,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

NtWaitForMultipleObjects()

NTSYSCALLAPI NTSTATUS NTAPI NtWaitForMultipleObjects	(	_In_ ULONG	Count,
		_In_ HANDLE	Object[],
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

NtWaitForMultipleObjects32()

NTSTATUS NTAPI NtWaitForMultipleObjects32	(	_In_ ULONG	ObjectCount,
		_In_ PLONG	Handles,
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	TimeOut
	)

NtWaitForSingleObject()

NTSYSCALLAPI NTSTATUS NTAPI NtWaitForSingleObject	(	_In_ HANDLE	Object,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Timeout
	)

ObAssignSecurity()

NTKERNELAPI NTSTATUS NTAPI ObAssignSecurity	(	_In_ PACCESS_STATE	AccessState,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ PVOID	Object,
		_In_ POBJECT_TYPE	Type
	)

ObCloseHandle()

NTKERNELAPI NTSTATUS NTAPI ObCloseHandle	(	_In_ HANDLE	Handle,
		_In_ KPROCESSOR_MODE	AccessMode
	)

ObCreateObject()

NTKERNELAPI NTSTATUS NTAPI ObCreateObject	(	_In_opt_ KPROCESSOR_MODE	ObjectAttributesAccessMode,
		_In_ POBJECT_TYPE	ObjectType,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Inout_opt_ PVOID	ParseContext,
		_In_ ULONG	ObjectSize,
		_In_opt_ ULONG	PagedPoolCharge,
		_In_opt_ ULONG	NonPagedPoolCharge,
		_Out_ PVOID *	Object
	)

ObCreateObjectType()

NTKERNELAPI NTSTATUS NTAPI ObCreateObjectType	(	_In_ PUNICODE_STRING	TypeName,
		_In_ POBJECT_TYPE_INITIALIZER	ObjectTypeInitializer,
		_Reserved_ PVOID	Reserved,
		_Out_ POBJECT_TYPE *	ObjectType
	)

ObDereferenceObjectDeferDelete()

NTKERNELAPI VOID NTAPI ObDereferenceObjectDeferDelete

(

_In_ PVOID

Object

)

ObDereferenceSecurityDescriptor()

NTKERNELAPI VOID NTAPI ObDereferenceSecurityDescriptor	(	_Inout_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ULONG	Count
	)

ObFindHandleForObject()

NTKERNELAPI BOOLEAN NTAPI ObFindHandleForObject	(	_In_ PEPROCESS	Process,
		_In_ PVOID	Object,
		_In_ POBJECT_TYPE	ObjectType,
		_In_opt_ POBJECT_HANDLE_INFORMATION	HandleInformation,
		_Out_opt_ PHANDLE	Handle
	)

ObGetObjectPointerCount()

NTKERNELAPI ULONG NTAPI ObGetObjectPointerCount

(

_In_ PVOID

Object

)

ObLogSecurityDescriptor()

NTKERNELAPI NTSTATUS NTAPI ObLogSecurityDescriptor	(	_In_ PSECURITY_DESCRIPTOR	InputSecurityDescriptor,
		_Out_ PSECURITY_DESCRIPTOR *	OutputSecurityDescriptor,
		_In_ ULONG	RefBias
	)

ObOpenObjectByName()

NTKERNELAPI NTSTATUS NTAPI ObOpenObjectByName	(	_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ POBJECT_TYPE	ObjectType,
		_In_ KPROCESSOR_MODE	AccessMode,
		_In_opt_ PACCESS_STATE	PassedAccessState,
		_In_ ACCESS_MASK	DesiredAccess,
		_Inout_opt_ PVOID	ParseContext,
		_Out_ PHANDLE	Handle
	)

ObReferenceObjectByName()

NTKERNELAPI NTSTATUS NTAPI ObReferenceObjectByName	(	_In_ PUNICODE_STRING	ObjectName,
		_In_ ULONG	Attributes,
		_In_opt_ PACCESS_STATE	PassedAccessState,
		_In_opt_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_TYPE	ObjectType,
		_In_ KPROCESSOR_MODE	AccessMode,
		_Inout_opt_ PVOID	ParseContext,
		_Out_ PVOID *	Object
	)

ObReferenceSecurityDescriptor()

NTKERNELAPI VOID NTAPI ObReferenceSecurityDescriptor	(	_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor,
		_In_ ULONG	Count
	)

ObSetSecurityObjectByPointer()

NTKERNELAPI NTSTATUS NTAPI ObSetSecurityObjectByPointer	(	_In_ PVOID	Object,
		_In_ SECURITY_INFORMATION	SecurityInformation,
		_In_ PSECURITY_DESCRIPTOR	SecurityDescriptor
	)

ZwClose()

NTSYSAPI NTSTATUS NTAPI ZwClose

(

_In_ HANDLE

Handle

)

Referenced by __drv_maxIRQL(), _Function_class_(), _IRQL_requires_max_(), _Success_(), acpi_create_registry_table(), acpi_create_volatile_registry_tables(), ACPIDispatchDeviceControl(), AcpiOsExecute(), AdvancedErrorChecks(), AfdCloseSocket(), allow_degraded_mount(), ApphelpCacheRead(), ApphelpCacheWrite(), BasicBehaviorChecks(), BehaviorChecks(), BroadcastOpen(), BuildWindowStationNameList(), CheckForDeviceDesc(), ClasspIsMediaChangeDisabledDueToHardwareLimitation(), ClasspIsMediaChangeDisabledForClass(), ClasspMediaChangeDeviceInstanceOverride(), ClassPnp(), ClasspScanForSpecialInRegistry(), Close(), CloseKey(), ClosePin(), CloseRemoteDatabase(), CmBattAddDevice(), CmBattCreateFdo(), CmLoadKey(), CmpCloseHiveFiles(), CmpCreateEvent(), CmpInitHiveFromFile(), CmpInitializeHiveList(), CmpInitializeMachineDependentConfiguration(), CmpLinkHiveToMaster(), CmpLinkKeyToHive(), CmpOpenHiveFiles(), CompBattGetDeviceObjectPointer(), CreateClientPort(), CreateDeviceFromRegistry(), CreateGreenFdo(), CreateMixerPinAndSetFormat(), CreatePinCallback(), CreateRemoteDatabaseWorker(), FxSystemThread::CreateThread(), DiskAddDevice(), DiskCreateFdo(), DiskRemoveDevice(), DriverEntry(), EngLoadModuleEx(), EngpUpdateGraphicsDeviceList(), EnumDeviceKeys(), EnumerateDevices(), EnumerateSoundDevices(), EnumerateSubkey(), ExCreateCallback(), ExpGetCurrentUserUILanguage(), ExpSetCurrentUserUILanguage(), ExpUuidLoadSequenceNumber(), ExpUuidSaveSequenceNumber(), Ext2StartReaper(), ExtractFont(), FatGetCompatibilityModeValue(), FatIsFujitsuFMR(), FdoCreateRawParallelPdo(), FdoRemoveAdapter(), FileSectionViewPermissionCheck(), FindDeviceDescForAdapter(), FindProductName(), FinishThread(), FreeGlobalData(), fs_ignored(), FsRecRegisterFs(), FsRtlDeregisterUncProvider(), FsRtlGetTunnelParameterValue(), FsRtlInitializeWorkerThread(), FsRtlpIsDfsEnabled(), FsRtlRegisterUncProvider(), FsRtlTest_StartTest(), get_registry_value(), GetFilterAltitude(), GetObjectType(), GetProcessorInformation(), HalpDmaAllocateChildAdapter(), HalpGetChipHacks(), HalpGetNMICrashFlag(), HalpMarkAcpiHal(), HalpMarkChipsetDecode(), HalpQueryPciRegistryInfo(), HalpReportSerialNumber(), i8042StoreSMBiosTables(), InitDisplayDriver(), InitializeProvider(), InitMetrics(), InitUserImpl(), InitVideo(), IntGdiAddFontResourceEx(), IntGetFullFileName(), IntLoadFontsInRegistry(), IntLoadFontSubstList(), IntLoadSystemFonts(), IntVideoPortMapPhysicalMemory(), IoCreateDriver(), IoCreateSymbolicLink(), IoCreateUnprotectedSymbolicLink(), IoDeleteSymbolicLink(), IoGetDeviceInterfaces(), IoOpenDeviceInterfaceRegistryKey(), IoOpenDeviceRegistryKey(), IopBootLog(), IopCreateDeviceKeyPath(), IopCreateEvent(), IopCreateFile(), IopCreateLogFile(), IopCreateRegistryKeyEx(), IopEnumerateDetectedDevices(), IopGetDeviceObjectPointer(), IopGetParentIdPrefix(), IopInitializeBuiltinDriver(), IopInitializeDriverModule(), IopInitializePlugPlayServices(), IopInstallCriticalDevice(), IopIsFirmwareMapperDisabled(), IopLoadUnloadDriverWorker(), IopLogWorker(), IopOpenInterfaceKey(), IopQueryBusDescription(), IopQueryDeviceCapabilities(), IopQueryDeviceDescription(), IopSaveBootLogToFile(), IopSetDeviceInstanceData(), IopSetServiceEnumData(), IopStartRamdisk(), IopUpdateControlKeyWithResources(), IopUpdateResourceMap(), IopUpdateRootKey(), IopWriteLogFile(), IoQueryDeviceDescription(), IoRegisterDeviceInterface(), IoReportDetectedDevice(), IoReportHalResourceUsage(), IoSetDeviceInterfaceState(), IoSetSystemPartition(), KdbpCliInit(), KdpDebugLogInit(), KeI386VdmInitialize(), KsCacheMedium(), KsFilterFactoryUpdateCacheData(), KsMapModuleName(), KspEnumerateBusRegistryKeys(), KspInstallInterface(), KspReadMediaCategory(), KspScanBus(), KsRegisterFilterWithNoKSPins(), LogMessage(), LsaDeregisterLogonProcess(), LsaRegisterLogonProcess(), main(), MiCreateMemoryEvent(), MiShutdownSystem(), MmCheckSystemImage(), MmInitBsmThread(), MmLoadSystemImage(), MountMgrMountedDeviceArrival(), MountMgrQuerySymbolicLink(), MountMgrValidateBackPointer(), MupCloseUncProvider(), MupGetProviderInformation(), MuppIsDfsEnabled(), Mx::MxClose(), ndisBindMiniportsToProtocol(), NdisCloseConfiguration(), NdisCloseFile(), NdisIPnPStartDevice(), NdisOpenConfiguration(), NdisOpenConfigurationKeyByIndex(), NdisOpenConfigurationKeyByName(), NdisOpenProtocolConfiguration(), nfs41_CreateConnection(), nfs41_DeleteConnection(), NtCreatePagingFile(), ObtClose(), ObtCreateObjectTypes(), OnlineMountedVolumes(), OpenDevice(), OpenRegistryHandlesFromSymbolicLink(), OpenSubkey(), PageFileBehaviorChecks(), PciAcpiFindRsdt(), PciAddDevice(), PciGetBiosConfig(), PciGetIrqRoutingTableFromRegistry(), PciGetRegistryValue(), PciSaveBiosConfig(), PcNewRegistryKey(), Phase1InitializationDiscard(), PiAttachFilterDriversCallback(), PiCallDriverAddDevice(), PICE_close(), PiGetDeviceRegistryProperty(), PiInitCacheGroupInformation(), PiInitializeDevNode(), Pin_fnClose(), PiStartDeviceFinal(), PnpDeviceObjectToDeviceInstance(), PopAddRemoveSysCapsCallback(), PopFlushVolumes(), PopFlushVolumeWorker(), PopReadShutdownPolicy(), ProcessorSetFriendlyName(), PsLocateSystemDll(), QueryVolumeName(), read_group_mappings(), read_mappings(), read_registry(), ReadIpConfiguration(), ReconcileThisDatabaseWithMasterWorker(), registry_load_volume_options(), registry_mark_volume_mounted(), registry_mark_volume_unmounted_path(), RegistryInitAdapterKey(), RegistryInitLunKey(), RtlAcquirePrivilege(), RtlAdjustPrivilege(), RtlCheckRegistryKey(), RtlCreateBootStatusDataFile(), RtlCreateSystemVolumeInformationFolder(), RtlCreateUserProcess(), RtlFormatCurrentUserKeyPath(), RtlGetNtProductType(), RtlImpersonateSelf(), RtlpCloseRegistryHandle(), RtlpMapFile(), RtlpSysVolTakeOwnership(), RtlQueryRegistryValues(), RtlReleasePrivilege(), RtlUnlockBootStatusData(), RxGetRegistryParameters(), RxInitializeDispatcher(), RxReadRegistryParameters(), RxSpinUpWorkerThread(), ScsiPortInitialize(), SearchForLegacyDrivers(), SeGetLogonIdDeviceMap(), SepCleanupLUIDDeviceMapDirectory(), SepInitializationPhase1(), SepRegQueryHelper(), SerenumDetectLegacyDevice(), SerenumDetectPnpDevice(), SerialPnpStartDevice(), SermouseDetectLegacyDevice(), SharedMemoryFree(), SimpleErrorChecks(), SpiCreatePortConfig(), SpiInitOpenKeys(), START_TEST(), sys_shutdown(), SysAudio_Shutdown(), SystemProcessTest(), SystemProcessWorker(), TdiCloseDevice(), TdiOpenDevice(), TestCreateEvent(), TestEventConcurrent(), TestPhysicalMemorySection(), TestSymlinks(), TestTcpConnect(), UDFDismountDevice(), uninit(), USBAudioInitComponentId(), USBAudioRegCreateMediaCategoriesKey(), USBD_GetPdoRegistryParameter(), USBH_SetPdoRegistryParameter(), USBH_WriteFailReasonID(), USBPORT_GetRegistryKeyValueFullInfo(), USBPORT_SetRegistryKeyValue(), UserChangeDisplaySettings(), UserEnumDisplayDevices(), UserEnumRegistryDisplaySettings(), UserGetLanguageID(), UserLoadImage(), UserLoadKbdFile(), UserProcessDestroy(), VdmpInitialize(), VfatSetRenameInformation(), VfdCloseImage(), VfdCreateDevice(), VfdDeleteDevice(), VfdOpenImage(), ViCreateDriveLetter(), ViMountImage(), WdfDeleteKmdfVersionFromRegistry(), WdfWriteKmdfVersionToRegistry(), WdmAudCleanup(), WdmAudIoctlClose(), WdmAudOpenSysAudioDevices(), WorkerThread(), xHalIoAssignDriveLetters(), and CRegistryKey::~CRegistryKey().

ZwCloseObjectAuditAlarm()

NTSYSAPI NTSTATUS NTAPI ZwCloseObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

ZwCreateDirectoryObject()

NTSYSAPI NTSTATUS NTAPI ZwCreateDirectoryObject	(	_Out_ PHANDLE	DirectoryHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by DiskCreateFdo(), ObtCreateDirectory(), SeGetLogonIdDeviceMap(), SepInitializationPhase1(), START_TEST(), and UserCreateWinstaDirectory().

ZwCreateSymbolicLinkObject()

NTSYSAPI NTSTATUS NTAPI ZwCreateSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PUNICODE_STRING	Name
	)

Referenced by IoCreateSymbolicLink(), IoCreateUnprotectedSymbolicLink(), SeGetLogonIdDeviceMap(), and START_TEST().

ZwDeleteObjectAuditAlarm()

NTSYSAPI NTSTATUS NTAPI ZwDeleteObjectAuditAlarm	(	_In_ PUNICODE_STRING	SubsystemName,
		_In_ PVOID	HandleId,
		_In_ BOOLEAN	GenerateOnClose
	)

ZwMakePermanentObject()

NTSYSAPI NTSTATUS NTAPI ZwMakePermanentObject

(

_In_ HANDLE

Object

)

ZwMakeTemporaryObject()

NTSYSAPI NTSTATUS NTAPI ZwMakeTemporaryObject

(

_In_ HANDLE

Handle

)

Referenced by DiskCreateFdo(), DiskRemoveDevice(), IoDeleteSymbolicLink(), ObtClose(), SepCleanupLUIDDeviceMapDirectory(), and TestReference().

ZwOpenDirectoryObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenDirectoryObject	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by BuildWindowStationNameList(), CheckDirectorySecurity__(), LdrpInitializeProcess(), SepCleanupLUIDDeviceMapDirectory(), and TestObRootSecurity().

ZwOpenJobObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenJobObject	(	_Out_ PHANDLE	JobHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

ZwOpenSymbolicLinkObject()

NTSYSAPI NTSTATUS NTAPI ZwOpenSymbolicLinkObject	(	_Out_ PHANDLE	SymbolicLinkHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by ExtractFont(), get_system_root(), IoDeleteSymbolicLink(), IopStoreSystemPartitionInformation(), MountMgrMountedDeviceArrival(), MountMgrQuerySymbolicLink(), NotificationCallback(), SepCleanupLUIDDeviceMapDirectory(), START_TEST(), TestRelativeNames(), and ViCreateDriveLetter().

ZwSetInformationObject()

NTSYSAPI NTSTATUS NTAPI ZwSetInformationObject	(	_In_ HANDLE	ObjectHandle,
		_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_ PVOID	ObjectInformation,
		_In_ ULONG	Length
	)

ZwSignalAndWaitForSingleObject()

NTSYSAPI NTSTATUS NTAPI ZwSignalAndWaitForSingleObject	(	_In_ HANDLE	SignalObject,
		_In_ HANDLE	WaitObject,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Time
	)

ZwWaitForMultipleObjects()

NTSYSAPI NTSTATUS NTAPI ZwWaitForMultipleObjects	(	_In_ ULONG	Count,
		_In_ HANDLE	Object[],
		_In_ WAIT_TYPE	WaitType,
		_In_ BOOLEAN	Alertable,
		_In_ PLARGE_INTEGER	Time
	)

Referenced by KernelModeTest().

Variable Documentation

Buffer

_Out_ PVOID Buffer

Definition at line 484 of file obfuncs.h.

BufferLength

_Out_ PVOID _In_ ULONG BufferLength

Definition at line 484 of file obfuncs.h.

Context

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG Context

Definition at line 484 of file obfuncs.h.

DesiredAccess

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK DesiredAccess

Definition at line 429 of file obfuncs.h.

HandleAttributes

_In_ ACCESS_MASK _In_ BOOLEAN _In_ ULONG HandleAttributes

Definition at line 429 of file obfuncs.h.

Referenced by NtDuplicateObject(), NtOpenProcessTokenEx(), NtOpenThreadTokenEx(), ObDuplicateObject(), ObOpenObjectByPointer(), ObpCreateHandle(), ObpCreateUnnamedHandle(), ObpEnumFindHandleProcedure(), ObpIncrementHandleCount(), ObpIncrementUnnamedHandleCount(), START_TEST(), UserOpenInputDesktop(), and WmipOpenGuidObject().

Length

_In_ SECURITY_INFORMATION _In_ ULONG Length

Definition at line 307 of file obfuncs.h.

LengthNeeded

_In_ SECURITY_INFORMATION _In_ ULONG _Out_ PULONG LengthNeeded

Definition at line 307 of file obfuncs.h.

ObjectInformationClass

_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass

Definition at line 292 of file obfuncs.h.

ObjectInformationLength

_In_ OBJECT_INFORMATION_CLASS _In_ ULONG ObjectInformationLength

Definition at line 294 of file obfuncs.h.

Options

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE _In_ ACCESS_MASK _In_ ULONG _In_ ULONG Options

Definition at line 429 of file obfuncs.h.

RestartScan

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN RestartScan

Definition at line 484 of file obfuncs.h.

ReturnLength

_Out_ PVOID _In_ ULONG _In_ BOOLEAN _In_ BOOLEAN _Inout_ PULONG _Out_opt_ PULONG ReturnLength

Definition at line 294 of file obfuncs.h.

ReturnSingleEntry

_Out_ PVOID _In_ ULONG _In_ BOOLEAN ReturnSingleEntry

Definition at line 484 of file obfuncs.h.

SecurityInformation

_In_ SECURITY_INFORMATION SecurityInformation

Definition at line 305 of file obfuncs.h.

SourceHandle

_In_ HANDLE SourceHandle

Definition at line 429 of file obfuncs.h.

Referenced by CmpConvertHandleToKernelHandle(), CON_API(), MoveFileWithProgressW(), NtDuplicateObject(), ObDuplicateObject(), PrivMoveFileIdentityW(), and SetupMoveFile().

TargetHandle

_In_ HANDLE _In_opt_ HANDLE _Out_opt_ PHANDLE TargetHandle

Definition at line 429 of file obfuncs.h.

Referenced by AcpiEvaluateObjectTyped(), AcpiNsHandleToName(), AcpiNsHandleToPathname(), IopOpenLinkOrRenameTarget(), KernelModeTest(), NtDuplicateObject(), NtSetInformationFile(), ObDuplicateObject(), and VfatSetRenameInformation().

TargetProcessHandle

_In_ HANDLE _In_opt_ HANDLE TargetProcessHandle

Definition at line 429 of file obfuncs.h.

Referenced by NtDuplicateObject().