#include <kphapi.h>

Data Structures
struct	_KPH_PARAMETERS

Typedefs
typedef struct _KPH_PARAMETERS	KPH_PARAMETERS

typedef struct _KPH_PARAMETERS *	PKPH_PARAMETERS

Functions
NTSTATUS NTAPI	KphConnect (_In_opt_ PWSTR DeviceName)

NTSTATUS NTAPI	KphConnect2 (_In_opt_ PWSTR DeviceName, _In_ PWSTR FileName)

NTSTATUS NTAPI	KphConnect2Ex (_In_opt_ PWSTR DeviceName, _In_ PWSTR FileName, _In_opt_ PKPH_PARAMETERS Parameters)

NTSTATUS NTAPI	KphDisconnect (VOID)

BOOLEAN NTAPI	KphIsConnected (VOID)

NTSTATUS NTAPI	KphSetParameters (_In_opt_ PWSTR DeviceName, _In_ PKPH_PARAMETERS Parameters)

NTSTATUS NTAPI	KphInstall (_In_opt_ PWSTR DeviceName, _In_ PWSTR FileName)

NTSTATUS NTAPI	KphInstallEx (_In_opt_ PWSTR DeviceName, _In_ PWSTR FileName, _In_opt_ PKPH_PARAMETERS Parameters)

NTSTATUS NTAPI	KphUninstall (_In_opt_ PWSTR DeviceName)

NTSTATUS NTAPI	KphGetFeatures (_Out_ PULONG Features)

NTSTATUS NTAPI	KphOpenProcess (_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ PCLIENT_ID ClientId)

NTSTATUS NTAPI	KphOpenProcessToken (_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _Out_ PHANDLE TokenHandle)

NTSTATUS NTAPI	KphOpenProcessJob (_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _Out_ PHANDLE JobHandle)

NTSTATUS NTAPI	KphSuspendProcess (_In_ HANDLE ProcessHandle)

NTSTATUS NTAPI	KphResumeProcess (_In_ HANDLE ProcessHandle)

NTSTATUS NTAPI	KphTerminateProcess (_In_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus)

NTSTATUS NTAPI	KphReadVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesRead)

NTSTATUS NTAPI	KphWriteVirtualMemory (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_reads_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesWritten)

NTSTATUS NTAPI	KphReadVirtualMemoryUnsafe (_In_opt_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesRead)

NTSTATUS NTAPI	KphQueryInformationProcess (_In_ HANDLE ProcessHandle, _In_ KPH_PROCESS_INFORMATION_CLASS ProcessInformationClass, _Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)

NTSTATUS NTAPI	KphSetInformationProcess (_In_ HANDLE ProcessHandle, _In_ KPH_PROCESS_INFORMATION_CLASS ProcessInformationClass, _In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)

NTSTATUS NTAPI	KphOpenThread (_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ PCLIENT_ID ClientId)

NTSTATUS NTAPI	KphOpenThreadProcess (_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _Out_ PHANDLE ProcessHandle)

NTSTATUS NTAPI	KphTerminateThread (_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)

NTSTATUS NTAPI	KphTerminateThreadUnsafe (_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)

NTSTATUS NTAPI	KphGetContextThread (_In_ HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext)

NTSTATUS NTAPI	KphSetContextThread (_In_ HANDLE ThreadHandle, _In_ PCONTEXT ThreadContext)

NTSTATUS NTAPI	KphCaptureStackBackTraceThread (_In_ HANDLE ThreadHandle, _In_ ULONG FramesToSkip, _In_ ULONG FramesToCapture, _Out_writes_(FramesToCapture) PVOID *BackTrace, _Out_opt_ PULONG CapturedFrames, _Out_opt_ PULONG BackTraceHash)

NTSTATUS NTAPI	KphQueryInformationThread (_In_ HANDLE ThreadHandle, _In_ KPH_THREAD_INFORMATION_CLASS ThreadInformationClass, _Out_writes_bytes_(ThreadInformationLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)

NTSTATUS NTAPI	KphSetInformationThread (_In_ HANDLE ThreadHandle, _In_ KPH_THREAD_INFORMATION_CLASS ThreadInformationClass, _In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength)

NTSTATUS NTAPI	KphEnumerateProcessHandles (_In_ HANDLE ProcessHandle, _Out_writes_bytes_(BufferLength) PVOID Buffer, _In_opt_ ULONG BufferLength, _Out_opt_ PULONG ReturnLength)

NTSTATUS NTAPI	KphEnumerateProcessHandles2 (_In_ HANDLE ProcessHandle, _Out_ PKPH_PROCESS_HANDLE_INFORMATION *Handles)

NTSTATUS NTAPI	KphQueryInformationObject (_In_ HANDLE ProcessHandle, _In_ HANDLE Handle, _In_ KPH_OBJECT_INFORMATION_CLASS ObjectInformationClass, _Out_writes_bytes_(ObjectInformationLength) PVOID ObjectInformation, _In_ ULONG ObjectInformationLength, _Out_opt_ PULONG ReturnLength)

NTSTATUS NTAPI	KphSetInformationObject (_In_ HANDLE ProcessHandle, _In_ HANDLE Handle, _In_ KPH_OBJECT_INFORMATION_CLASS ObjectInformationClass, _In_reads_bytes_(ObjectInformationLength) PVOID ObjectInformation, _In_ ULONG ObjectInformationLength)

NTSTATUS NTAPI	KphDuplicateObject (_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle, _In_opt_ HANDLE TargetProcessHandle, _Out_opt_ PHANDLE TargetHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ ULONG Options)

NTSTATUS NTAPI	KphOpenDriver (_Out_ PHANDLE DriverHandle, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSTATUS NTAPI	KphQueryInformationDriver (_In_ HANDLE DriverHandle, _In_ DRIVER_INFORMATION_CLASS DriverInformationClass, _Out_writes_bytes_(DriverInformationLength) PVOID DriverInformation, _In_ ULONG DriverInformationLength, _Out_opt_ PULONG ReturnLength)

NTSTATUS NTAPI	KphInitializeDynamicPackage (_Out_ PKPH_DYN_PACKAGE Package)

Typedef Documentation

typedef struct _KPH_PARAMETERS KPH_PARAMETERS

typedef struct _KPH_PARAMETERS * PKPH_PARAMETERS

Function Documentation

NTSTATUS NTAPI KphCaptureStackBackTraceThread	(	_In_ HANDLE	ThreadHandle,
		_In_ ULONG	FramesToSkip,
		_In_ ULONG	FramesToCapture,
		_Out_writes_(FramesToCapture) PVOID *	BackTrace,
		_Out_opt_ PULONG	CapturedFrames,
		_Out_opt_ PULONG	BackTraceHash
	)

Definition at line 843 of file kph.c.

NTSTATUS NTAPI KphConnect ( _In_opt_ PWSTR DeviceName )

Definition at line 34 of file kph.c.

NTSTATUS NTAPI KphConnect2	(	_In_opt_ PWSTR	DeviceName,
		_In_ PWSTR	FileName
	)

Definition at line 90 of file kph.c.

NTSTATUS NTAPI KphConnect2Ex	(	_In_opt_ PWSTR	DeviceName,
		_In_ PWSTR	FileName,
		_In_opt_ PKPH_PARAMETERS	Parameters
	)

Definition at line 98 of file kph.c.

NTSTATUS NTAPI KphDisconnect ( VOID )

Definition at line 228 of file kph.c.

NTSTATUS NTAPI KphDuplicateObject	(	_In_ HANDLE	SourceProcessHandle,
		_In_ HANDLE	SourceHandle,
		_In_opt_ HANDLE	TargetProcessHandle,
		_Out_opt_ PHANDLE	TargetHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ ULONG	HandleAttributes,
		_In_ ULONG	Options
	)

Definition at line 1029 of file kph.c.

NTSTATUS NTAPI KphEnumerateProcessHandles	(	_In_ HANDLE	ProcessHandle,
		_Out_writes_bytes_(BufferLength) PVOID	Buffer,
		_In_opt_ ULONG	BufferLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 915 of file kph.c.

NTSTATUS NTAPI KphEnumerateProcessHandles2	(	_In_ HANDLE	ProcessHandle,
		_Out_ PKPH_PROCESS_HANDLE_INFORMATION *	Handles
	)

Definition at line 937 of file kph.c.

NTSTATUS NTAPI KphGetContextThread	(	_In_ HANDLE	ThreadHandle,
		_Inout_ PCONTEXT	ThreadContext
	)

Definition at line 807 of file kph.c.

NTSTATUS NTAPI KphGetFeatures ( _Out_ PULONG Features )

Definition at line 469 of file kph.c.

NTSTATUS NTAPI KphInitializeDynamicPackage ( _Out_ PKPH_DYN_PACKAGE Package )

Definition at line 167 of file kphdata.c.

NTSTATUS NTAPI KphInstall	(	_In_opt_ PWSTR	DeviceName,
		_In_ PWSTR	FileName
	)

Definition at line 336 of file kph.c.

NTSTATUS NTAPI KphInstallEx	(	_In_opt_ PWSTR	DeviceName,
		_In_ PWSTR	FileName,
		_In_opt_ PKPH_PARAMETERS	Parameters
	)

Definition at line 344 of file kph.c.

BOOLEAN NTAPI KphIsConnected ( VOID )

Definition at line 256 of file kph.c.

NTSTATUS NTAPI KphOpenDriver	(	_Out_ PHANDLE	DriverHandle,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Definition at line 1067 of file kph.c.

NTSTATUS NTAPI KphOpenProcess	(	_Out_ PHANDLE	ProcessHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ PCLIENT_ID	ClientId
	)

Definition at line 485 of file kph.c.

NTSTATUS NTAPI KphOpenProcessJob	(	_In_ HANDLE	ProcessHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_Out_ PHANDLE	JobHandle
	)

Definition at line 525 of file kph.c.

NTSTATUS NTAPI KphOpenProcessToken	(	_In_ HANDLE	ProcessHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_Out_ PHANDLE	TokenHandle
	)

Definition at line 505 of file kph.c.

NTSTATUS NTAPI KphOpenThread	(	_Out_ PHANDLE	ThreadHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ PCLIENT_ID	ClientId
	)

Definition at line 723 of file kph.c.

NTSTATUS NTAPI KphOpenThreadProcess	(	_In_ HANDLE	ThreadHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_Out_ PHANDLE	ProcessHandle
	)

Definition at line 743 of file kph.c.

NTSTATUS NTAPI KphQueryInformationDriver	(	_In_ HANDLE	DriverHandle,
		_In_ DRIVER_INFORMATION_CLASS	DriverInformationClass,
		_Out_writes_bytes_(DriverInformationLength) PVOID	DriverInformation,
		_In_ ULONG	DriverInformationLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 1085 of file kph.c.

NTSTATUS NTAPI KphQueryInformationObject	(	_In_ HANDLE	ProcessHandle,
		_In_ HANDLE	Handle,
		_In_ KPH_OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_Out_writes_bytes_(ObjectInformationLength) PVOID	ObjectInformation,
		_In_ ULONG	ObjectInformationLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 979 of file kph.c.

NTSTATUS NTAPI KphQueryInformationProcess	(	_In_ HANDLE	ProcessHandle,
		_In_ KPH_PROCESS_INFORMATION_CLASS	ProcessInformationClass,
		_Out_writes_bytes_(ProcessInformationLength) PVOID	ProcessInformation,
		_In_ ULONG	ProcessInformationLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 677 of file kph.c.

NTSTATUS NTAPI KphQueryInformationThread	(	_In_ HANDLE	ThreadHandle,
		_In_ KPH_THREAD_INFORMATION_CLASS	ThreadInformationClass,
		_Out_writes_bytes_(ThreadInformationLength) PVOID	ThreadInformation,
		_In_ ULONG	ThreadInformationLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 869 of file kph.c.

NTSTATUS NTAPI KphReadVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_Out_writes_bytes_(BufferSize) PVOID	Buffer,
		_In_ SIZE_T	BufferSize,
		_Out_opt_ PSIZE_T	NumberOfBytesRead
	)

Definition at line 605 of file kph.c.

NTSTATUS NTAPI KphReadVirtualMemoryUnsafe	(	_In_opt_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_Out_writes_bytes_(BufferSize) PVOID	Buffer,
		_In_ SIZE_T	BufferSize,
		_Out_opt_ PSIZE_T	NumberOfBytesRead
	)

Definition at line 653 of file kph.c.

NTSTATUS NTAPI KphResumeProcess ( _In_ HANDLE ProcessHandle )

Definition at line 561 of file kph.c.

NTSTATUS NTAPI KphSetContextThread	(	_In_ HANDLE	ThreadHandle,
		_In_ PCONTEXT	ThreadContext
	)

Definition at line 825 of file kph.c.

NTSTATUS NTAPI KphSetInformationObject	(	_In_ HANDLE	ProcessHandle,
		_In_ HANDLE	Handle,
		_In_ KPH_OBJECT_INFORMATION_CLASS	ObjectInformationClass,
		_In_reads_bytes_(ObjectInformationLength) PVOID	ObjectInformation,
		_In_ ULONG	ObjectInformationLength
	)

Definition at line 1005 of file kph.c.

NTSTATUS NTAPI KphSetInformationProcess	(	_In_ HANDLE	ProcessHandle,
		_In_ KPH_PROCESS_INFORMATION_CLASS	ProcessInformationClass,
		_In_reads_bytes_(ProcessInformationLength) PVOID	ProcessInformation,
		_In_ ULONG	ProcessInformationLength
	)

Definition at line 701 of file kph.c.

NTSTATUS NTAPI KphSetInformationThread	(	_In_ HANDLE	ThreadHandle,
		_In_ KPH_THREAD_INFORMATION_CLASS	ThreadInformationClass,
		_In_reads_bytes_(ThreadInformationLength) PVOID	ThreadInformation,
		_In_ ULONG	ThreadInformationLength
	)

Definition at line 893 of file kph.c.

NTSTATUS NTAPI KphSetParameters	(	_In_opt_ PWSTR	DeviceName,
		_In_ PKPH_PARAMETERS	Parameters
	)

Definition at line 263 of file kph.c.

NTSTATUS NTAPI KphSuspendProcess ( _In_ HANDLE ProcessHandle )

Definition at line 545 of file kph.c.

NTSTATUS NTAPI KphTerminateProcess	(	_In_ HANDLE	ProcessHandle,
		_In_ NTSTATUS	ExitStatus
	)

Definition at line 577 of file kph.c.

NTSTATUS NTAPI KphTerminateThread	(	_In_ HANDLE	ThreadHandle,
		_In_ NTSTATUS	ExitStatus
	)

Definition at line 763 of file kph.c.

NTSTATUS NTAPI KphTerminateThreadUnsafe	(	_In_ HANDLE	ThreadHandle,
		_In_ NTSTATUS	ExitStatus
	)

Definition at line 789 of file kph.c.

NTSTATUS NTAPI KphUninstall ( _In_opt_ PWSTR DeviceName )

Definition at line 408 of file kph.c.

NTSTATUS NTAPI KphWriteVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_opt_ PVOID	BaseAddress,
		_In_reads_bytes_(BufferSize) PVOID	Buffer,
		_In_ SIZE_T	BufferSize,
		_Out_opt_ PSIZE_T	NumberOfBytesWritten
	)

Definition at line 629 of file kph.c.

Data Structures

Typedefs

Functions

Typedef Documentation

Function Documentation