3 Copyright (c) Alex Ionescu. All rights reserved.
11 Function definitions for the Process Manager
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
32 #ifndef NTOS_MODE_USER
35 // Win32K Process/Thread Functions
40 PsGetCurrentThreadWin32Thread(
47 PsGetCurrentProcessWin32Process(
54 PsGetProcessWin32Process(
55 _In_ PEPROCESS Process
61 PsSetProcessWin32Process(
62 _Inout_ PEPROCESS Process
,
63 _In_opt_ PVOID Win32Process
,
64 _In_opt_ PVOID OldWin32Process
70 PsSetThreadWin32Thread(
71 _Inout_ PETHREAD Thread
,
72 _In_opt_ PVOID Win32Thread
,
73 _In_opt_ PVOID OldWin32Thread
79 PsGetThreadWin32Thread(
86 PsGetProcessWin32WindowStation(
87 _In_ PEPROCESS Process
93 PsSetProcessWindowStation(
94 _Inout_ PEPROCESS Process
,
95 _In_opt_ PVOID WindowStation
122 PsGetThreadHardErrorsAreDisabled(
129 PsSetThreadHardErrorsAreDisabled(
130 _Inout_ PETHREAD Thread
,
131 _In_ BOOLEAN Disabled
137 PsEstablishWin32Callouts(
138 _In_ PWIN32_CALLOUTS_FPNS CalloutData
144 PsReturnProcessNonPagedPoolQuota(
145 _In_ PEPROCESS Process
,
152 PsGetCurrentProcessSessionId(
157 // Process Impersonation Functions
162 PsIsThreadImpersonating(
169 PsRevertThreadToSelf(
170 _Inout_ PETHREAD Thread
179 PsLookupProcessThreadByCid(
181 _Out_opt_ PEPROCESS
*Process
,
182 _Out_ PETHREAD
*Thread
187 PsIsProtectedProcess(
188 _In_ PEPROCESS Process
195 _In_ PEPROCESS Process
200 PsSetProcessPriorityByClass(
201 _In_ PEPROCESS Process
,
202 _In_ PSPROCESSPRIORITYMODE Type
207 PsGetProcessInheritedFromUniqueProcessId(
208 _In_ PEPROCESS Process
214 PsGetProcessExitStatus(
215 _In_ PEPROCESS Process
221 PsGetProcessSessionId(
222 _In_ PEPROCESS Process
228 PsGetProcessExitProcessCalled(
229 _In_ PEPROCESS Process
239 _In_ PEPROCESS Process
,
240 _In_ POOL_TYPE PoolType
,
247 PsChargeProcessNonPagedPoolQuota(
248 _In_ PEPROCESS Process
,
255 PsChargeProcessPagedPoolQuota(
256 _In_ PEPROCESS Process
,
263 PsChargeProcessPoolQuota(
264 _In_ PEPROCESS Process
,
265 _In_ POOL_TYPE PoolType
,
273 _In_ PEPROCESS Process
,
274 _In_ POOL_TYPE PoolType
,
281 PsReturnProcessNonPagedPoolQuota(
282 _In_ PEPROCESS Process
,
289 PsReturnProcessPagedPoolQuota(
290 _In_ PEPROCESS Process
,
297 PsGetProcessSecurityPort(
298 _In_ PEPROCESS Process
304 PsSetProcessSecurityPort(
305 _Inout_ PEPROCESS Process
,
306 _In_ PVOID SecurityPort
312 PsGetCurrentThreadProcessId(
325 _In_ HANDLE ThreadHandle
,
326 _Out_opt_ PULONG SuspendCount
329 typedef ULONG APPHELPCACHESERVICECLASS
;
333 NtApphelpCacheControl(
334 _In_ APPHELPCACHESERVICECLASS Service
,
335 _In_ PVOID ServiceData
342 _In_ HANDLE ThreadHandle
348 NtAssignProcessToJobObject(
349 _In_ HANDLE JobHandle
,
350 _In_ HANDLE ProcessHandle
357 _Out_ PHANDLE JobHandle
,
358 _In_ ACCESS_MASK DesiredAccess
,
359 _In_ POBJECT_ATTRIBUTES ObjectAttributes
366 _In_ PJOB_SET_ARRAY UserJobSet
,
374 _Out_ PHANDLE ProcessHandle
,
375 _In_ ACCESS_MASK DesiredAccess
,
376 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
,
377 _In_ HANDLE ParentProcess
,
378 _In_ BOOLEAN InheritObjectTable
,
379 _In_opt_ HANDLE SectionHandle
,
380 _In_opt_ HANDLE DebugPort
,
381 _In_opt_ HANDLE ExceptionPort
388 _Out_ PHANDLE ProcessHandle
,
389 _In_ ACCESS_MASK DesiredAccess
,
390 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
,
391 _In_ HANDLE ParentProcess
,
393 _In_opt_ HANDLE SectionHandle
,
394 _In_opt_ HANDLE DebugPort
,
395 _In_opt_ HANDLE ExceptionPort
,
403 _Out_ PHANDLE ThreadHandle
,
404 _In_ ACCESS_MASK DesiredAccess
,
405 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
,
406 _In_ HANDLE ProcessHandle
,
407 _Out_ PCLIENT_ID ClientId
,
408 _In_ PCONTEXT ThreadContext
,
409 _In_ PINITIAL_TEB UserStack
,
410 _In_ BOOLEAN CreateSuspended
414 #ifndef NTOS_MODE_USER
415 FORCEINLINE
struct _TEB
* NtCurrentTeb(VOID
)
418 return (PTEB
)__readfsdword(0x18);
419 #elif defined (_M_AMD64)
420 return (struct _TEB
*)__readgsqword(FIELD_OFFSET(NT_TIB
, Self
));
424 struct _TEB
* NtCurrentTeb(void);
432 _In_ HANDLE ThreadHandle
,
433 _In_ HANDLE ThreadToImpersonate
,
434 _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
441 _In_ HANDLE ProcessHandle
,
442 _In_opt_ HANDLE JobHandle
450 _Out_ PHANDLE ProcessHandle
,
451 _In_ ACCESS_MASK DesiredAccess
,
452 _In_ POBJECT_ATTRIBUTES ObjectAttributes
,
453 _In_opt_ PCLIENT_ID ClientId
456 _Must_inspect_result_
462 _In_ HANDLE ProcessHandle
,
463 _In_ ACCESS_MASK DesiredAccess
,
464 _Out_ PHANDLE TokenHandle
471 _Out_ PHANDLE ThreadHandle
,
472 _In_ ACCESS_MASK DesiredAccess
,
473 _In_ POBJECT_ATTRIBUTES ObjectAttributes
,
474 _In_ PCLIENT_ID ClientId
481 _In_ HANDLE ThreadHandle
,
482 _In_ ACCESS_MASK DesiredAccess
,
483 _In_ BOOLEAN OpenAsSelf
,
484 _Out_ PHANDLE TokenHandle
491 _In_ HANDLE ThreadHandle
,
492 _In_ ACCESS_MASK DesiredAccess
,
493 _In_ BOOLEAN OpenAsSelf
,
494 _In_ ULONG HandleAttributes
,
495 _Out_ PHANDLE TokenHandle
501 NtQueryInformationJobObject(
502 _In_ HANDLE JobHandle
,
503 _In_ JOBOBJECTINFOCLASS JobInformationClass
,
504 _Out_bytecap_(JobInformationLength
) PVOID JobInformation
,
505 _In_ ULONG JobInformationLength
,
506 _Out_ PULONG ReturnLength
514 NtQueryInformationProcess(
515 _In_ HANDLE ProcessHandle
,
516 _In_ PROCESSINFOCLASS ProcessInformationClass
,
517 _Out_ PVOID ProcessInformation
,
518 _In_ ULONG ProcessInformationLength
,
519 _Out_opt_ PULONG ReturnLength
526 NtQueryInformationThread(
527 _In_ HANDLE ThreadHandle
,
528 _In_ THREADINFOCLASS ThreadInformationClass
,
529 _Out_ PVOID ThreadInformation
,
530 _In_ ULONG ThreadInformationLength
,
531 _Out_opt_ PULONG ReturnLength
537 NtRegisterThreadTerminatePort(
538 _In_ HANDLE TerminationPort
545 _In_ HANDLE ThreadHandle
,
546 _Out_opt_ PULONG SuspendCount
553 _In_ HANDLE ProcessHandle
559 NtSetInformationJobObject(
560 _In_ HANDLE JobHandle
,
561 _In_ JOBOBJECTINFOCLASS JobInformationClass
,
562 _In_bytecount_(JobInformationLength
) PVOID JobInformation
,
563 _In_ ULONG JobInformationLength
569 NtSetInformationProcess(
570 _In_ HANDLE ProcessHandle
,
571 _In_ PROCESSINFOCLASS ProcessInformationClass
,
572 _In_ PVOID ProcessInformation
,
573 _In_ ULONG ProcessInformationLength
580 NtSetInformationThread(
581 _In_ HANDLE ThreadHandle
,
582 _In_ THREADINFOCLASS ThreadInformationClass
,
583 _In_reads_bytes_(ThreadInformationLength
) PVOID ThreadInformation
,
584 _In_ ULONG ThreadInformationLength
591 _In_ HANDLE ProcessHandle
598 _In_ HANDLE ThreadHandle
,
599 _In_ PULONG PreviousSuspendCount
606 _In_ HANDLE ProcessHandle
,
607 _In_ NTSTATUS ExitStatus
614 _In_ HANDLE ThreadHandle
,
615 _In_ NTSTATUS ExitStatus
621 NtTerminateJobObject(
622 _In_ HANDLE JobHandle
,
623 _In_ NTSTATUS ExitStatus
630 _In_ HANDLE ThreadHandle
,
631 _Out_opt_ PULONG SuspendCount
638 _In_ HANDLE ThreadHandle
644 ZwAssignProcessToJobObject(
645 _In_ HANDLE JobHandle
,
646 _In_ HANDLE ProcessHandle
653 _Out_ PHANDLE JobHandle
,
654 _In_ ACCESS_MASK DesiredAccess
,
655 _In_ POBJECT_ATTRIBUTES ObjectAttributes
662 _Out_ PHANDLE ProcessHandle
,
663 _In_ ACCESS_MASK DesiredAccess
,
664 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
,
665 _In_ HANDLE ParentProcess
,
666 _In_ BOOLEAN InheritObjectTable
,
667 _In_opt_ HANDLE SectionHandle
,
668 _In_opt_ HANDLE DebugPort
,
669 _In_opt_ HANDLE ExceptionPort
676 _Out_ PHANDLE ThreadHandle
,
677 _In_ ACCESS_MASK DesiredAccess
,
678 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
,
679 _In_ HANDLE ProcessHandle
,
680 _Out_ PCLIENT_ID ClientId
,
681 _In_ PCONTEXT ThreadContext
,
682 _In_ PINITIAL_TEB UserStack
,
683 _In_ BOOLEAN CreateSuspended
690 _In_ HANDLE ThreadHandle
,
691 _In_ HANDLE ThreadToImpersonate
,
692 _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
699 _In_ HANDLE ProcessHandle
,
700 _In_opt_ HANDLE JobHandle
703 _IRQL_requires_max_(PASSIVE_LEVEL
)
707 ZwOpenProcessTokenEx(
708 _In_ HANDLE ProcessHandle
,
709 _In_ ACCESS_MASK DesiredAccess
,
710 _In_ ULONG HandleAttributes
,
711 _Out_ PHANDLE TokenHandle
718 _Out_ PHANDLE ThreadHandle
,
719 _In_ ACCESS_MASK DesiredAccess
,
720 _In_ POBJECT_ATTRIBUTES ObjectAttributes
,
721 _In_ PCLIENT_ID ClientId
728 _In_ HANDLE ThreadHandle
,
729 _In_ ACCESS_MASK DesiredAccess
,
730 _In_ BOOLEAN OpenAsSelf
,
731 _Out_ PHANDLE TokenHandle
738 _In_ HANDLE ThreadHandle
,
739 _In_ ACCESS_MASK DesiredAccess
,
740 _In_ BOOLEAN OpenAsSelf
,
741 _In_ ULONG HandleAttributes
,
742 _Out_ PHANDLE TokenHandle
748 ZwQueryInformationJobObject(
749 _In_ HANDLE JobHandle
,
750 _In_ JOBOBJECTINFOCLASS JobInformationClass
,
751 _Out_bytecap_(JobInformationLength
) PVOID JobInformation
,
752 _In_ ULONG JobInformationLength
,
753 _Out_ PULONG ReturnLength
760 ZwQueryInformationProcess(
761 _In_ HANDLE ProcessHandle
,
762 _In_ PROCESSINFOCLASS ProcessInformationClass
,
763 _Out_ PVOID ProcessInformation
,
764 _In_ ULONG ProcessInformationLength
,
765 _Out_opt_ PULONG ReturnLength
772 ZwQueryInformationThread(
773 _In_ HANDLE ThreadHandle
,
774 _In_ THREADINFOCLASS ThreadInformationClass
,
775 _Out_ PVOID ThreadInformation
,
776 _In_ ULONG ThreadInformationLength
,
777 _Out_opt_ PULONG ReturnLength
783 ZwRegisterThreadTerminatePort(
784 _In_ HANDLE TerminationPort
791 _In_ HANDLE ThreadHandle
,
792 _Out_opt_ PULONG SuspendCount
799 _In_ HANDLE ProcessHandle
805 ZwSetInformationJobObject(
806 _In_ HANDLE JobHandle
,
807 _In_ JOBOBJECTINFOCLASS JobInformationClass
,
808 _In_ PVOID JobInformation
,
809 _In_ ULONG JobInformationLength
815 ZwSetInformationProcess(
816 _In_ HANDLE ProcessHandle
,
817 _In_ PROCESSINFOCLASS ProcessInformationClass
,
818 _In_ PVOID ProcessInformation
,
819 _In_ ULONG ProcessInformationLength
822 _IRQL_requires_max_(PASSIVE_LEVEL
)
826 ZwSetInformationThread(
827 _In_ HANDLE ThreadHandle
,
828 _In_ THREADINFOCLASS ThreadInformationClass
,
829 _In_reads_bytes_(ThreadInformationLength
) PVOID ThreadInformation
,
830 _In_ ULONG ThreadInformationLength
837 _In_ HANDLE ProcessHandle
844 _In_ HANDLE ThreadHandle
,
845 _In_ PULONG PreviousSuspendCount
848 _IRQL_requires_max_(PASSIVE_LEVEL
)
853 _In_opt_ HANDLE ProcessHandle
,
854 _In_ NTSTATUS ExitStatus
861 _In_ HANDLE ThreadHandle
,
862 _In_ NTSTATUS ExitStatus
868 ZwTerminateJobObject(
869 _In_ HANDLE JobHandle
,
870 _In_ NTSTATUS ExitStatus