mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
2825382ebd
* fixed some other minor things git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3343 21ef857c-d57f-4fe0-8362-d861dc6d29cd
725 lines
17 KiB
C
725 lines
17 KiB
C
#ifndef NTPSAPI_H
|
|
#define NTPSAPI_H
|
|
|
|
// MS has decided to leave this one access right out
|
|
// of the headers...
|
|
#ifndef THREAD_ALERT
|
|
#define THREAD_ALERT 0x0004
|
|
#endif
|
|
|
|
#define GDI_HANDLE_BUFFER_SIZE32 34
|
|
#define GDI_HANDLE_BUFFER_SIZE64 60
|
|
|
|
#ifndef WIN64
|
|
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
|
|
#else
|
|
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64
|
|
#endif
|
|
|
|
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
|
|
|
|
#define FLS_MAXIMUM_AVAILABLE 128
|
|
#define TLS_MINIMUM_AVAILABLE 64
|
|
#define TLS_EXPANSION_SLOTS 1024
|
|
|
|
// symbols
|
|
typedef struct _PEB_LDR_DATA
|
|
{
|
|
ULONG Length;
|
|
BOOLEAN Initialized;
|
|
HANDLE SsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
PVOID EntryInProgress;
|
|
BOOLEAN ShutdownInProgress;
|
|
HANDLE ShutdownThreadId;
|
|
} PEB_LDR_DATA, *PPEB_LDR_DATA;
|
|
|
|
typedef struct _INITIAL_TEB
|
|
{
|
|
struct
|
|
{
|
|
PVOID OldStackBase;
|
|
PVOID OldStackLimit;
|
|
} OldInitialTeb;
|
|
PVOID StackBase;
|
|
PVOID StackLimit;
|
|
PVOID StackAllocationBase;
|
|
} INITIAL_TEB, *PINITIAL_TEB;
|
|
|
|
typedef struct _WOW64_PROCESS
|
|
{
|
|
PVOID Wow64;
|
|
} WOW64_PROCESS, *PWOW64_PROCESS;
|
|
|
|
#include <ntpebteb.h>
|
|
|
|
// source:http://www.microsoft.com/whdc/system/Sysinternals/MoreThan64proc.mspx
|
|
|
|
typedef enum _PROCESS_INFORMATION_CLASS
|
|
{
|
|
ProcessBasicInformation, // 0
|
|
ProcessQuotaLimits,
|
|
ProcessIoCounters,
|
|
ProcessVmCounters,
|
|
ProcessTimes,
|
|
ProcessBasePriority,
|
|
ProcessRaisePriority,
|
|
ProcessDebugPort,
|
|
ProcessExceptionPort,
|
|
ProcessAccessToken,
|
|
ProcessLdtInformation, // 10
|
|
ProcessLdtSize,
|
|
ProcessDefaultHardErrorMode,
|
|
ProcessIoPortHandlers,
|
|
ProcessPooledUsageAndLimits,
|
|
ProcessWorkingSetWatch,
|
|
ProcessUserModeIOPL,
|
|
ProcessEnableAlignmentFaultFixup,
|
|
ProcessPriorityClass,
|
|
ProcessWx86Information,
|
|
ProcessHandleCount, // 20
|
|
ProcessAffinityMask,
|
|
ProcessPriorityBoost,
|
|
ProcessDeviceMap,
|
|
ProcessSessionInformation,
|
|
ProcessForegroundInformation,
|
|
ProcessWow64Information,
|
|
ProcessImageFileName,
|
|
ProcessLUIDDeviceMapsEnabled,
|
|
ProcessBreakOnTermination,
|
|
ProcessDebugObjectHandle, // 30
|
|
ProcessDebugFlags,
|
|
ProcessHandleTracing,
|
|
ProcessIoPriority,
|
|
ProcessExecuteFlags,
|
|
ProcessResourceManagement,
|
|
ProcessCookie,
|
|
ProcessImageInformation,
|
|
ProcessCycleTime,
|
|
ProcessPagePriority,
|
|
ProcessInstrumentationCallback, // 40
|
|
ProcessThreadStackAllocation,
|
|
ProcessWorkingSetWatchEx,
|
|
ProcessImageFileNameWin32,
|
|
ProcessImageFileMapping,
|
|
ProcessAffinityUpdateMode,
|
|
ProcessMemoryAllocationMode,
|
|
ProcessGroupInformation, // array of USHORTs, list of groups assigned to process
|
|
ProcessTokenVirtualizationEnabled,
|
|
ProcessConsoleHostProcess,
|
|
ProcessWindowInformation, // 50
|
|
MaxProcessInfoClass
|
|
} PROCESS_INFORMATION_CLASS;
|
|
|
|
typedef enum _THREAD_INFORMATION_CLASS
|
|
{
|
|
ThreadBasicInformation,
|
|
ThreadTimes,
|
|
ThreadPriority,
|
|
ThreadBasePriority,
|
|
ThreadAffinityMask,
|
|
ThreadImpersonationToken,
|
|
ThreadDescriptorTableEntry,
|
|
ThreadEnableAlignmentFaultFixup,
|
|
ThreadEventPair,
|
|
ThreadQuerySetWin32StartAddress,
|
|
ThreadZeroTlsCell, // 10
|
|
ThreadPerformanceCount,
|
|
ThreadAmILastThread,
|
|
ThreadIdealProcessor,
|
|
ThreadPriorityBoost,
|
|
ThreadSetTlsArrayAddress,
|
|
ThreadIsIoPending,
|
|
ThreadHideFromDebugger,
|
|
ThreadBreakOnTermination,
|
|
ThreadSwitchLegacyState,
|
|
ThreadIsTerminated, // 20
|
|
ThreadLastSystemCall,
|
|
ThreadIoPriority,
|
|
ThreadCycleTime,
|
|
ThreadPagePriority,
|
|
ThreadActualBasePriority,
|
|
ThreadTebInformation,
|
|
ThreadCSwitchMon,
|
|
ThreadCSwitchPmu,
|
|
ThreadWow64Context, // WOW64_CONTEXT
|
|
ThreadGroupInformation, // 30, GROUP_AFFINITY
|
|
ThreadUmsInformation,
|
|
ThreadCounterProfiling,
|
|
ThreadIdealProcessorEx,
|
|
MaxThreadInfoClass
|
|
} THREAD_INFORMATION_CLASS;
|
|
|
|
// Use with both ProcessPagePriority and ThreadPagePriority
|
|
// ntddk
|
|
typedef struct _PAGE_PRIORITY_INFORMATION
|
|
{
|
|
ULONG PagePriority;
|
|
} PAGE_PRIORITY_INFORMATION, *PPAGE_PRIORITY_INFORMATION;
|
|
|
|
// Process information structures
|
|
|
|
typedef struct _PROCESS_BASIC_INFORMATION
|
|
{
|
|
NTSTATUS ExitStatus;
|
|
PPEB PebBaseAddress;
|
|
ULONG_PTR AffinityMask;
|
|
KPRIORITY BasePriority;
|
|
HANDLE UniqueProcessId;
|
|
HANDLE InheritedFromUniqueProcessId;
|
|
} PROCESS_BASIC_INFORMATION;
|
|
typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;
|
|
|
|
// ntddk
|
|
typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION
|
|
{
|
|
SIZE_T Size; // set to sizeof structure on input
|
|
PROCESS_BASIC_INFORMATION BasicInfo;
|
|
union
|
|
{
|
|
ULONG Flags;
|
|
struct
|
|
{
|
|
ULONG IsProtectedProcess : 1;
|
|
ULONG IsWow64Process : 1;
|
|
ULONG IsProcessDeleting : 1;
|
|
ULONG IsCrossSessionCreate : 1;
|
|
ULONG SpareBits : 28;
|
|
};
|
|
};
|
|
} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;
|
|
|
|
typedef struct _VM_COUNTERS
|
|
{
|
|
SIZE_T PeakVirtualSize;
|
|
SIZE_T VirtualSize;
|
|
ULONG PageFaultCount;
|
|
SIZE_T PeakWorkingSetSize;
|
|
SIZE_T WorkingSetSize;
|
|
SIZE_T QuotaPeakPagedPoolUsage;
|
|
SIZE_T QuotaPagedPoolUsage;
|
|
SIZE_T QuotaPeakNonPagedPoolUsage;
|
|
SIZE_T QuotaNonPagedPoolUsage;
|
|
SIZE_T PagefileUsage;
|
|
SIZE_T PeakPagefileUsage;
|
|
} VM_COUNTERS, *PVM_COUNTERS;
|
|
|
|
typedef struct _VM_COUNTERS_EX
|
|
{
|
|
SIZE_T PeakVirtualSize;
|
|
SIZE_T VirtualSize;
|
|
ULONG PageFaultCount;
|
|
SIZE_T PeakWorkingSetSize;
|
|
SIZE_T WorkingSetSize;
|
|
SIZE_T QuotaPeakPagedPoolUsage;
|
|
SIZE_T QuotaPagedPoolUsage;
|
|
SIZE_T QuotaPeakNonPagedPoolUsage;
|
|
SIZE_T QuotaNonPagedPoolUsage;
|
|
SIZE_T PagefileUsage;
|
|
SIZE_T PeakPagefileUsage;
|
|
SIZE_T PrivateUsage;
|
|
} VM_COUNTERS_EX, *PVM_COUNTERS_EX;
|
|
|
|
typedef struct _KERNEL_USER_TIMES
|
|
{
|
|
LARGE_INTEGER CreateTime;
|
|
LARGE_INTEGER ExitTime;
|
|
LARGE_INTEGER KernelTime;
|
|
LARGE_INTEGER UserTime;
|
|
} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
|
|
|
|
typedef struct _POOLED_USAGE_AND_LIMITS
|
|
{
|
|
SIZE_T PeakPagedPoolUsage;
|
|
SIZE_T PagedPoolUsage;
|
|
SIZE_T PagedPoolLimit;
|
|
SIZE_T PeakNonPagedPoolUsage;
|
|
SIZE_T NonPagedPoolUsage;
|
|
SIZE_T NonPagedPoolLimit;
|
|
SIZE_T PeakPagefileUsage;
|
|
SIZE_T PagefileUsage;
|
|
SIZE_T PagefileLimit;
|
|
} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
|
|
|
|
typedef struct _PROCESS_WS_WATCH_INFORMATION
|
|
{
|
|
PVOID FaultingPc;
|
|
PVOID FaultingVa;
|
|
} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
|
|
|
|
typedef struct _PROCESS_SESSION_INFORMATION
|
|
{
|
|
ULONG SessionId;
|
|
} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
|
|
|
|
typedef struct _PROCESS_HANDLE_TRACING_ENABLE
|
|
{
|
|
ULONG Flags; // 0 to disable, 1 to enable
|
|
} PROCESS_HANDLE_TRACING_ENABLE, *PPROCESS_HANDLE_TRACING_ENABLE;
|
|
|
|
typedef struct _PROCESS_HANDLE_TRACING_ENABLE_EX
|
|
{
|
|
ULONG Flags; // 0 to disable, 1 to enable
|
|
ULONG TotalSlots;
|
|
} PROCESS_HANDLE_TRACING_ENABLE_EX, *PPROCESS_HANDLE_TRACING_ENABLE_EX;
|
|
|
|
#define PROCESS_HANDLE_TRACING_MAX_STACKS 16
|
|
#define HANDLE_TRACE_DB_OPEN 1
|
|
#define HANDLE_TRACE_DB_CLOSE 2
|
|
#define HANDLE_TRACE_DB_BADREF 3
|
|
|
|
typedef struct _PROCESS_HANDLE_TRACING_ENTRY
|
|
{
|
|
HANDLE Handle;
|
|
CLIENT_ID ClientId;
|
|
ULONG Type;
|
|
PVOID Stacks[PROCESS_HANDLE_TRACING_MAX_STACKS];
|
|
} PROCESS_HANDLE_TRACING_ENTRY, *PPROCESS_HANDLE_TRACING_ENTRY;
|
|
|
|
typedef struct _PROCESS_HANDLE_TRACING_QUERY
|
|
{
|
|
HANDLE Handle;
|
|
ULONG TotalTraces;
|
|
PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1];
|
|
} PROCESS_HANDLE_TRACING_QUERY, *PPROCESS_HANDLE_TRACING_QUERY;
|
|
|
|
// begin_rev
|
|
|
|
#ifndef PROCESS_AFFINITY_ENABLE_AUTO_UPDATE
|
|
#define PROCESS_AFFINITY_ENABLE_AUTO_UPDATE 0x1
|
|
#endif
|
|
#define PROCESS_AFFINITY_PERMANENT 0x2
|
|
|
|
typedef struct _PROCESS_AFFINITY_UPDATE_MODE_INFORMATION
|
|
{
|
|
ULONG AffinityUpdateMode;
|
|
} PROCESS_AFFINITY_UPDATE_MODE_INFORMATION, *PPROCESS_AFFINITY_UPDATE_MODE_INFORMATION;
|
|
|
|
// end_rev
|
|
|
|
// begin_rev
|
|
|
|
#define PROCESS_MEMORY_VM_TOP_DOWN 0x1
|
|
|
|
typedef struct _PROCESS_MEMORY_ALLOCATION_MODE_INFORMATION
|
|
{
|
|
ULONG MemoryAllocationMode;
|
|
} PROCESS_MEMORY_ALLOCATION_MODE_INFORMATION, *PPROCESS_MEMORY_ALLOCATION_MODE_INFORMATION;
|
|
|
|
// end_rev
|
|
|
|
// rev
|
|
typedef struct _PROCESS_CONSOLE_HOST_PROCESS_INFORMATION
|
|
{
|
|
ULONG_PTR ConsoleHostProcess;
|
|
} PROCESS_CONSOLE_HOST_PROCESS_INFORMATION, *PPROCESS_CONSOLE_HOST_PROCESS_INFORMATION;
|
|
|
|
// rev
|
|
typedef struct _PROCESS_CYCLE_TIME_INFORMATION
|
|
{
|
|
ULARGE_INTEGER AccumulatedCycles;
|
|
ULARGE_INTEGER CurrentCycleCount;
|
|
} PROCESS_CYCLE_TIME_INFORMATION, *PPROCESS_CYCLE_TIME_INFORMATION;
|
|
|
|
// Thread information structures
|
|
|
|
typedef struct _THREAD_BASIC_INFORMATION
|
|
{
|
|
NTSTATUS ExitStatus;
|
|
PTEB TebBaseAddress;
|
|
CLIENT_ID ClientId;
|
|
ULONG_PTR AffinityMask;
|
|
KPRIORITY Priority;
|
|
LONG BasePriority;
|
|
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
|
|
|
|
// rev
|
|
typedef struct _THREAD_CYCLE_TIME_INFORMATION
|
|
{
|
|
ULARGE_INTEGER AccumulatedCycles;
|
|
ULARGE_INTEGER CurrentCycleCount;
|
|
} THREAD_CYCLE_TIME_INFORMATION, *PTHREAD_CYCLE_TIME_INFORMATION;
|
|
|
|
// System calls
|
|
|
|
// Processes
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateProcess(
|
|
__out PHANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ParentProcess,
|
|
__in BOOLEAN InheritObjectTable,
|
|
__in_opt HANDLE SectionHandle,
|
|
__in_opt HANDLE DebugPort,
|
|
__in_opt HANDLE ExceptionPort
|
|
);
|
|
|
|
#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
|
|
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
|
|
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
|
|
#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
|
|
#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateProcessEx(
|
|
__out PHANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ParentProcess,
|
|
__in ULONG Flags,
|
|
__in_opt HANDLE SectionHandle,
|
|
__in_opt HANDLE DebugPort,
|
|
__in_opt HANDLE ExceptionPort,
|
|
__in ULONG JobMemberLevel
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenProcess(
|
|
__out PHANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PCLIENT_ID ClientId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtTerminateProcess(
|
|
__in_opt HANDLE ProcessHandle,
|
|
__in NTSTATUS ExitStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSuspendProcess(
|
|
__in HANDLE ProcessHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtResumeProcess(
|
|
__in HANDLE ProcessHandle
|
|
);
|
|
|
|
#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
|
|
#define ZwCurrentProcess() NtCurrentProcess()
|
|
#define NtCurrentThread() ((HANDLE)(LONG_PTR)-2)
|
|
#define ZwCurrentThread() NtCurrentThread()
|
|
#define NtCurrentPeb() (NtCurrentTeb()->ProcessEnvironmentBlock)
|
|
|
|
#define NtCurrentProcessId() (NtCurrentTeb()->ClientId.UniqueProcess)
|
|
#define NtCurrentThreadId() (NtCurrentTeb()->ClientId.UniqueThread)
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryInformationProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in PROCESS_INFORMATION_CLASS ProcessInformationClass,
|
|
__out_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
|
__in ULONG ProcessInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
#if (PHNT_VERSION >= PHNT_WS03)
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtGetNextProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Flags,
|
|
__out PHANDLE NewProcessHandle
|
|
);
|
|
#else
|
|
typedef NTSTATUS (NTAPI *_NtGetNextProcess)(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Flags,
|
|
__out PHANDLE NewProcessHandle
|
|
);
|
|
#endif
|
|
|
|
#if (PHNT_VERSION >= PHNT_WS03)
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtGetNextThread(
|
|
__in HANDLE ProcessHandle,
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Flags,
|
|
__out PHANDLE NewThreadHandle
|
|
);
|
|
#else
|
|
typedef NTSTATUS (NTAPI *_NtGetNextThread)(
|
|
__in HANDLE ProcessHandle,
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Flags,
|
|
__out PHANDLE NewThreadHandle
|
|
);
|
|
#endif
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetInformationProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in PROCESS_INFORMATION_CLASS ProcessInformationClass,
|
|
__in_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
|
__in ULONG ProcessInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryPortInformationProcess();
|
|
|
|
// Threads
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateThread(
|
|
__out PHANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ProcessHandle,
|
|
__out PCLIENT_ID ClientId,
|
|
__in PCONTEXT ThreadContext,
|
|
__in PINITIAL_TEB InitialTeb,
|
|
__in BOOLEAN CreateSuspended
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenThread(
|
|
__out PHANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PCLIENT_ID ClientId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtTerminateThread(
|
|
__in_opt HANDLE ThreadHandle,
|
|
__in NTSTATUS ExitStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSuspendThread(
|
|
__in HANDLE ThreadHandle,
|
|
__out_opt PULONG PreviousSuspendCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtResumeThread(
|
|
__in HANDLE ThreadHandle,
|
|
__out_opt PULONG PreviousSuspendCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
ULONG
|
|
NTAPI
|
|
NtGetCurrentProcessorNumber();
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtGetContextThread(
|
|
__in HANDLE ThreadHandle,
|
|
__inout PCONTEXT ThreadContext
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetContextThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in PCONTEXT ThreadContext
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryInformationThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in THREAD_INFORMATION_CLASS ThreadInformationClass,
|
|
__out_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
|
__in ULONG ThreadInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetInformationThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in THREAD_INFORMATION_CLASS ThreadInformationClass,
|
|
__in_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
|
__in ULONG ThreadInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAlertThread(
|
|
__in HANDLE ThreadHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAlertResumeThread(
|
|
__in HANDLE ThreadHandle,
|
|
__out_opt PULONG PreviousSuspendCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtTestAlert();
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtImpersonateThread(
|
|
__in HANDLE ServerThreadHandle,
|
|
__in HANDLE ClientThreadHandle,
|
|
__in PSECURITY_QUALITY_OF_SERVICE SecurityQos
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtRegisterThreadTerminatePort(
|
|
__in HANDLE PortHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetLdtEntries(
|
|
__in ULONG Selector0,
|
|
__in ULONG Entry0Low,
|
|
__in ULONG Entry0Hi,
|
|
__in ULONG Selector1,
|
|
__in ULONG Entry1Low,
|
|
__in ULONG Entry1Hi
|
|
);
|
|
|
|
typedef VOID (*PPS_APC_ROUTINE)(
|
|
__in_opt PVOID ApcArgument1,
|
|
__in_opt PVOID ApcArgument2,
|
|
__in_opt PVOID ApcArgument3
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueueApcThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in PPS_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcArgument1,
|
|
__in_opt PVOID ApcArgument2,
|
|
__in_opt PVOID ApcArgument3
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateJobObject(
|
|
__out PHANDLE JobHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenJobObject(
|
|
__out PHANDLE JobHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAssignProcessToJobObject(
|
|
__in HANDLE JobHandle,
|
|
__in HANDLE ProcessHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtTerminateJobObject(
|
|
__in HANDLE JobHandle,
|
|
__in NTSTATUS ExitStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtIsProcessInJob(
|
|
__in HANDLE ProcessHandle,
|
|
__in_opt HANDLE JobHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryInformationJobObject(
|
|
__in_opt HANDLE JobHandle,
|
|
__in JOBOBJECTINFOCLASS JobObjectInformationClass,
|
|
__out_bcount(JobObjectInformationLength) PVOID JobObjectInformation,
|
|
__in ULONG JobObjectInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetInformationJobObject(
|
|
__in HANDLE JobHandle,
|
|
__in JOBOBJECTINFOCLASS JobObjectInformationClass,
|
|
__in_bcount(JobObjectInformationLength) PVOID JobObjectInformation,
|
|
__in ULONG JobObjectInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateJobSet(
|
|
__in ULONG NumJob,
|
|
__in_ecount(NumJob) PJOB_SET_ARRAY UserJobSet,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
#endif
|