Process Hacker
Data Structures | Macros | Typedefs | Enumerations | Functions | Variables
ph.h File Reference
#include <phbase.h>
#include <stdarg.h>
#include <phnatinl.h>

Go to the source code of this file.

Data Structures

struct  _PH_ENVIRONMENT_VARIABLE
 
struct  _PH_PROCESS_WS_COUNTERS
 
struct  _PH_ENUM_PROCESS_MODULES_PARAMETERS
 
struct  _PH_MODULE_INFO
 
struct  _PH_MAPPED_IMAGE
 
struct  _PH_REMOTE_MAPPED_IMAGE
 
struct  _PH_MAPPED_IMAGE_EXPORTS
 
struct  _PH_MAPPED_IMAGE_EXPORT_ENTRY
 
struct  _PH_MAPPED_IMAGE_EXPORT_FUNCTION
 
struct  _PH_MAPPED_IMAGE_IMPORTS
 
struct  _PH_MAPPED_IMAGE_IMPORT_DLL
 
struct  _PH_MAPPED_IMAGE_IMPORT_ENTRY
 
struct  _PH_MAPPED_ARCHIVE_MEMBER
 
struct  _PH_MAPPED_ARCHIVE
 
struct  _PH_MAPPED_ARCHIVE_IMPORT_ENTRY
 
struct  _PH_FILE_STREAM
 
struct  _PH_PROVIDER_REGISTRATION
 
struct  _PH_PROVIDER_THREAD
 
struct  _PH_INTEGER_PAIR
 
struct  _PH_RECTANGLE
 
union  _GUID_EX
 
struct  _PH_IMAGE_VERSION_INFO
 
struct  _PH_CREATE_PROCESS_INFO
 
struct  _PH_CREATE_PROCESS_AS_USER_INFO
 
struct  _PH_FLAG_MAPPING
 
struct  _PH_FILETYPE_FILTER
 
struct  _PH_HASH_CONTEXT
 
struct  _PH_COMMAND_LINE_OPTION
 

Macros

#define SYSTEM_IDLE_PROCESS_ID   ((HANDLE)0)
 The PID of the idle process.
 
#define SYSTEM_PROCESS_ID   ((HANDLE)4)
 The PID of the system process.
 
#define SYSTEM_IDLE_PROCESS_NAME   (L"System Idle Process")
 
#define PH_PROCESS_DEP_ENABLED   0x1
 
#define PH_PROCESS_DEP_ATL_THUNK_EMULATION_DISABLED   0x2
 
#define PH_PROCESS_DEP_PERMANENT   0x4
 
#define PH_GET_PROCESS_ENVIRONMENT_WOW64   0x1
 
#define PH_ENUM_PROCESS_MODULES_LIMIT   0x800
 
#define PH_ENUM_PROCESS_MODULES_DONT_RESOLVE_WOW64_FS   0x1
 
#define PH_ENUM_PROCESS_MODULES_TRY_MAPPED_FILE_NAME   0x2
 
#define PH_FIRST_PROCESS(Processes)   ((PSYSTEM_PROCESS_INFORMATION)(Processes))
 Gets a pointer to the first process information structure in a buffer returned by PhEnumProcesses().
 
#define PH_NEXT_PROCESS(Process)
 Gets a pointer to the process information structure after a given structure.
 
#define PH_FIRST_PAGEFILE(Pagefiles)
 
#define PH_NEXT_PAGEFILE(Pagefile)
 
#define PH_CLR_USE_SECTION_CHECK   0x1
 
#define PH_CLR_NO_WOW64_CHECK   0x2
 
#define PH_CLR_KNOWN_IS_WOW64   0x4
 
#define PH_CLR_VERSION_1_0   0x1
 
#define PH_CLR_VERSION_1_1   0x2
 
#define PH_CLR_VERSION_2_0   0x4
 
#define PH_CLR_VERSION_4_ABOVE   0x8
 
#define PH_CLR_VERSION_MASK   0xf
 
#define PH_CLR_MSCORLIB_PRESENT   0x10000
 
#define PH_CLR_PROCESS_IS_WOW64   0x100000
 
#define PH_FIRST_STREAM(Streams)   ((PFILE_STREAM_INFORMATION)(Streams))
 
#define PH_NEXT_STREAM(Stream)
 
#define PH_MODULE_TYPE_MODULE   1
 
#define PH_MODULE_TYPE_MAPPED_FILE   2
 
#define PH_MODULE_TYPE_WOW64_MODULE   3
 
#define PH_MODULE_TYPE_KERNEL_MODULE   4
 
#define PH_MODULE_TYPE_MAPPED_IMAGE   5
 
#define PH_ENUM_GENERIC_MAPPED_FILES   0x1
 
#define PH_ENUM_GENERIC_MAPPED_IMAGES   0x2
 
#define PH_KEY_PREDEFINE(Number)   ((HANDLE)(LONG_PTR)(-3 - (Number) * 2))
 
#define PH_KEY_IS_PREDEFINED(Predefine)   (((LONG_PTR)(Predefine) < 0) && ((LONG_PTR)(Predefine) & 0x1))
 
#define PH_KEY_PREDEFINE_TO_NUMBER(Predefine)   (ULONG)(((-(LONG_PTR)(Predefine) - 3) >> 1))
 
#define PH_KEY_LOCAL_MACHINE   PH_KEY_PREDEFINE(0)
 
#define PH_KEY_USERS   PH_KEY_PREDEFINE(1)
 
#define PH_KEY_CLASSES_ROOT   PH_KEY_PREDEFINE(2)
 
#define PH_KEY_CURRENT_USER   PH_KEY_PREDEFINE(3)
 
#define PH_KEY_CURRENT_USER_NUMBER   3
 
#define PH_KEY_MAXIMUM_PREDEFINE   4
 
#define MAX_OBJECT_TYPE_NUMBER   257
 
#define PH_FIRST_OBJECT_TYPE(ObjectTypes)   (POBJECT_TYPE_INFORMATION)((PCHAR)(ObjectTypes) + ALIGN_UP(sizeof(OBJECT_TYPES_INFORMATION), ULONG_PTR))
 
#define PH_NEXT_OBJECT_TYPE(ObjectType)
 
#define PH_MAPPED_IMAGE_DELAY_IMPORTS   0x1
 
#define PH_FILE_STREAM_HANDLE_UNOWNED   0x1
 Indicates that the file stream object should not close the file handle upon deletion.
 
#define PH_FILE_STREAM_UNBUFFERED   0x2
 Indicates that the file stream object should not buffer I/O operations.
 
#define PH_FILE_STREAM_ASYNCHRONOUS   0x4
 Indicates that the file handle supports asynchronous operations.
 
#define PH_FILE_STREAM_OWN_POSITION   0x8
 Indicates that the file stream object should maintain the file position and not use the file object's own file position.
 
#define PH_FILE_STREAM_APPEND   0x00010000
 
#define PH_FILE_STREAM_WRITTEN   0x80000000
 Indicates that at least one write has been issued to the file handle.
 
#define PH_MAX_MESSAGE_SIZE   800
 
#define PhShowError(hWnd, Format,...)   PhShowMessage(hWnd, MB_OK | MB_ICONERROR, Format, __VA_ARGS__)
 
#define PhShowWarning(hWnd, Format,...)   PhShowMessage(hWnd, MB_OK | MB_ICONWARNING, Format, __VA_ARGS__)
 
#define PhShowInformation(hWnd, Format,...)   PhShowMessage(hWnd, MB_OK | MB_ICONINFORMATION, Format, __VA_ARGS__)
 
#define GUID_VERSION_MAC   1
 
#define GUID_VERSION_DCE   2
 
#define GUID_VERSION_MD5   3
 
#define GUID_VERSION_RANDOM   4
 
#define GUID_VERSION_SHA1   5
 
#define GUID_VARIANT_NCS_MASK   0x80
 
#define GUID_VARIANT_NCS   0x00
 
#define GUID_VARIANT_STANDARD_MASK   0xc0
 
#define GUID_VARIANT_STANDARD   0x80
 
#define GUID_VARIANT_MICROSOFT_MASK   0xe0
 
#define GUID_VARIANT_MICROSOFT   0xc0
 
#define GUID_VARIANT_RESERVED_MASK   0xe0
 
#define GUID_VARIANT_RESERVED   0xe0
 
#define PhaFormatDateTime(DateTime)   ((PPH_STRING)PhAutoDereferenceObject(PhFormatDateTime(DateTime)))
 
#define PhaFormatUInt64(Value, GroupDigits)   ((PPH_STRING)PhAutoDereferenceObject(PhFormatUInt64((Value), (GroupDigits))))
 
#define PhaFormatDecimal(Value, FractionalDigits, GroupDigits)   ((PPH_STRING)PhAutoDereferenceObject(PhFormatDecimal((Value), (FractionalDigits), (GroupDigits))))
 
#define PhaFormatSize(Size, MaxSizeUnit)   ((PPH_STRING)PhAutoDereferenceObject(PhFormatSize((Size), (MaxSizeUnit))))
 
#define PH_CREATE_PROCESS_INHERIT_HANDLES   0x1
 
#define PH_CREATE_PROCESS_UNICODE_ENVIRONMENT   0x2
 
#define PH_CREATE_PROCESS_SUSPENDED   0x4
 
#define PH_CREATE_PROCESS_BREAKAWAY_FROM_JOB   0x8
 
#define PH_CREATE_PROCESS_NEW_CONSOLE   0x10
 
#define PH_CREATE_PROCESS_USE_PROCESS_TOKEN   0x1000
 
#define PH_CREATE_PROCESS_USE_SESSION_TOKEN   0x2000
 
#define PH_CREATE_PROCESS_USE_LINKED_TOKEN   0x10000
 
#define PH_CREATE_PROCESS_SET_SESSION_ID   0x20000
 
#define PH_CREATE_PROCESS_WITH_PROFILE   0x40000
 
#define PH_SHELL_EXECUTE_ADMIN   0x1
 
#define PH_SHELL_EXECUTE_PUMP_MESSAGES   0x2
 
#define PH_FILEDIALOG_CREATEPROMPT   0x1
 
#define PH_FILEDIALOG_PATHMUSTEXIST   0x2
 
#define PH_FILEDIALOG_FILEMUSTEXIST   0x4
 
#define PH_FILEDIALOG_SHOWHIDDEN   0x8
 
#define PH_FILEDIALOG_NODEREFERENCELINKS   0x10
 
#define PH_FILEDIALOG_OVERWRITEPROMPT   0x20
 
#define PH_FILEDIALOG_DEFAULTEXPANDED   0x40
 
#define PH_FILEDIALOG_STRICTFILETYPES   0x80
 
#define PH_FILEDIALOG_PICKFOLDERS   0x100
 
#define PH_COMMAND_LINE_IGNORE_UNKNOWN_OPTIONS   0x1
 
#define PH_COMMAND_LINE_IGNORE_FIRST_PART   0x2
 

Typedefs

typedef NTSTATUS(NTAPI * PPH_OPEN_OBJECT )(_Out_ PHANDLE Handle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PVOID Context)
 
typedef NTSTATUS(NTAPI * PPH_GET_OBJECT_SECURITY )(_Out_ PSECURITY_DESCRIPTOR *SecurityDescriptor, _In_ SECURITY_INFORMATION SecurityInformation, _In_opt_ PVOID Context)
 
typedef NTSTATUS(NTAPI * PPH_SET_OBJECT_SECURITY )(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ SECURITY_INFORMATION SecurityInformation, _In_opt_ PVOID Context)
 
typedef enum _PH_PEB_OFFSET PH_PEB_OFFSET
 Specifies a PEB string.
 
typedef struct
_PH_ENVIRONMENT_VARIABLE 		PH_ENVIRONMENT_VARIABLE
 
typedef struct
_PH_ENVIRONMENT_VARIABLE * 		PPH_ENVIRONMENT_VARIABLE
 
typedef struct
_PH_PROCESS_WS_COUNTERS 		PH_PROCESS_WS_COUNTERS
 
typedef struct
_PH_PROCESS_WS_COUNTERS * 		PPH_PROCESS_WS_COUNTERS
 
typedef BOOLEAN(NTAPI * PPH_ENUM_PROCESS_MODULES_CALLBACK )(_In_ PLDR_DATA_TABLE_ENTRY Module, _In_opt_ PVOID Context)
 A callback function passed to PhEnumProcessModules() and called for each process module.
 
typedef struct
_PH_ENUM_PROCESS_MODULES_PARAMETERS 		PH_ENUM_PROCESS_MODULES_PARAMETERS
 
typedef struct
_PH_ENUM_PROCESS_MODULES_PARAMETERS * 		PPH_ENUM_PROCESS_MODULES_PARAMETERS
 
typedef BOOLEAN(NTAPI * PPH_ENUM_DIRECTORY_OBJECTS )(_In_ PPH_STRINGREF Name, _In_ PPH_STRINGREF TypeName, _In_opt_ PVOID Context)
 A callback function passed to PhEnumDirectoryObjects() and called for each directory object.
 
typedef BOOLEAN(NTAPI * PPH_ENUM_DIRECTORY_FILE )(_In_ PFILE_DIRECTORY_INFORMATION Information, _In_opt_ PVOID Context)
 
typedef struct _PH_MODULE_INFO PH_MODULE_INFO
 
typedef struct _PH_MODULE_INFO * PPH_MODULE_INFO
 
typedef BOOLEAN(NTAPI * PPH_ENUM_GENERIC_MODULES_CALLBACK )(_In_ PPH_MODULE_INFO Module, _In_opt_ PVOID Context)
 A callback function passed to PhEnumGenericModules() and called for each process module.
 
typedef PPH_STRING(NTAPI * PPH_GET_CLIENT_ID_NAME )(_In_ PCLIENT_ID ClientId)
 
typedef struct _PH_MAPPED_IMAGE PH_MAPPED_IMAGE
 
typedef struct _PH_MAPPED_IMAGE * PPH_MAPPED_IMAGE
 
typedef struct
_PH_REMOTE_MAPPED_IMAGE 		PH_REMOTE_MAPPED_IMAGE
 
typedef struct
_PH_REMOTE_MAPPED_IMAGE * 		PPH_REMOTE_MAPPED_IMAGE
 
typedef struct
_PH_MAPPED_IMAGE_EXPORTS 		PH_MAPPED_IMAGE_EXPORTS
 
typedef struct
_PH_MAPPED_IMAGE_EXPORTS * 		PPH_MAPPED_IMAGE_EXPORTS
 
typedef struct
_PH_MAPPED_IMAGE_EXPORT_ENTRY 		PH_MAPPED_IMAGE_EXPORT_ENTRY
 
typedef struct
_PH_MAPPED_IMAGE_EXPORT_ENTRY * 		PPH_MAPPED_IMAGE_EXPORT_ENTRY
 
typedef struct
_PH_MAPPED_IMAGE_EXPORT_FUNCTION 		PH_MAPPED_IMAGE_EXPORT_FUNCTION
 
typedef struct
_PH_MAPPED_IMAGE_EXPORT_FUNCTION * 		PPH_MAPPED_IMAGE_EXPORT_FUNCTION
 
typedef struct
_PH_MAPPED_IMAGE_IMPORTS 		PH_MAPPED_IMAGE_IMPORTS
 
typedef struct
_PH_MAPPED_IMAGE_IMPORTS * 		PPH_MAPPED_IMAGE_IMPORTS
 
typedef struct
_PH_MAPPED_IMAGE_IMPORT_DLL 		PH_MAPPED_IMAGE_IMPORT_DLL
 
typedef struct
_PH_MAPPED_IMAGE_IMPORT_DLL * 		PPH_MAPPED_IMAGE_IMPORT_DLL
 
typedef struct
_PH_MAPPED_IMAGE_IMPORT_ENTRY 		PH_MAPPED_IMAGE_IMPORT_ENTRY
 
typedef struct
_PH_MAPPED_IMAGE_IMPORT_ENTRY * 		PPH_MAPPED_IMAGE_IMPORT_ENTRY
 
typedef struct _PH_MAPPED_ARCHIVE * PPH_MAPPED_ARCHIVE
 
typedef enum
_PH_MAPPED_ARCHIVE_MEMBER_TYPE 		PH_MAPPED_ARCHIVE_MEMBER_TYPE
 
typedef struct
_PH_MAPPED_ARCHIVE_MEMBER 		PH_MAPPED_ARCHIVE_MEMBER
 
typedef struct
_PH_MAPPED_ARCHIVE_MEMBER * 		PPH_MAPPED_ARCHIVE_MEMBER
 
typedef struct _PH_MAPPED_ARCHIVE PH_MAPPED_ARCHIVE
 
typedef struct
_PH_MAPPED_ARCHIVE_IMPORT_ENTRY 		PH_MAPPED_ARCHIVE_IMPORT_ENTRY
 
typedef struct
_PH_MAPPED_ARCHIVE_IMPORT_ENTRY * 		PPH_MAPPED_ARCHIVE_IMPORT_ENTRY
 
typedef enum _PH_SEEK_ORIGIN PH_SEEK_ORIGIN
 
typedef struct _PH_FILE_STREAM PH_FILE_STREAM
 
typedef struct _PH_FILE_STREAM * PPH_FILE_STREAM
 
typedef enum
_PH_PROVIDER_THREAD_STATE 		PH_PROVIDER_THREAD_STATE
 
typedef VOID(NTAPI * PPH_PROVIDER_FUNCTION )(_In_ PVOID Object)
 
typedef struct
_PH_PROVIDER_THREAD * 		PPH_PROVIDER_THREAD
 
typedef struct
_PH_PROVIDER_REGISTRATION 		PH_PROVIDER_REGISTRATION
 
typedef struct
_PH_PROVIDER_REGISTRATION * 		PPH_PROVIDER_REGISTRATION
 
typedef struct _PH_PROVIDER_THREAD PH_PROVIDER_THREAD
 
typedef struct _PH_INTEGER_PAIR PH_INTEGER_PAIR
 
typedef struct _PH_INTEGER_PAIR * PPH_INTEGER_PAIR
 
typedef struct _PH_RECTANGLE PH_RECTANGLE
 
typedef struct _PH_RECTANGLE * PPH_RECTANGLE
 
typedef union _GUID_EX GUID_EX
 
typedef union _GUID_EX * PGUID_EX
 
typedef struct
_PH_IMAGE_VERSION_INFO 		PH_IMAGE_VERSION_INFO
 
typedef struct
_PH_IMAGE_VERSION_INFO * 		PPH_IMAGE_VERSION_INFO
 
typedef struct
_PH_CREATE_PROCESS_INFO 		PH_CREATE_PROCESS_INFO
 
typedef struct
_PH_CREATE_PROCESS_INFO * 		PPH_CREATE_PROCESS_INFO
 
typedef struct
_PH_CREATE_PROCESS_AS_USER_INFO 		PH_CREATE_PROCESS_AS_USER_INFO
 
typedef struct
_PH_CREATE_PROCESS_AS_USER_INFO * 		PPH_CREATE_PROCESS_AS_USER_INFO
 
typedef struct _PH_FLAG_MAPPING PH_FLAG_MAPPING
 
typedef struct _PH_FLAG_MAPPING * PPH_FLAG_MAPPING
 
typedef struct _PH_FILETYPE_FILTER PH_FILETYPE_FILTER
 
typedef struct
_PH_FILETYPE_FILTER * 		PPH_FILETYPE_FILTER
 
typedef enum _PH_HASH_ALGORITHM PH_HASH_ALGORITHM
 
typedef struct _PH_HASH_CONTEXT PH_HASH_CONTEXT
 
typedef struct _PH_HASH_CONTEXT * PPH_HASH_CONTEXT
 
typedef enum
_PH_COMMAND_LINE_OPTION_TYPE 		PH_COMMAND_LINE_OPTION_TYPE
 
typedef enum
_PH_COMMAND_LINE_OPTION_TYPE * 		PPH_COMMAND_LINE_OPTION_TYPE
 
typedef struct
_PH_COMMAND_LINE_OPTION 		PH_COMMAND_LINE_OPTION
 
typedef struct
_PH_COMMAND_LINE_OPTION * 		PPH_COMMAND_LINE_OPTION
 
typedef BOOLEAN(NTAPI * PPH_COMMAND_LINE_CALLBACK )(_In_opt_ PPH_COMMAND_LINE_OPTION Option, _In_opt_ PPH_STRING Value, _In_opt_ PVOID Context)
 

Enumerations

enum  _PH_PEB_OFFSET {
  PhpoCurrentDirectory, PhpoDllPath, PhpoImagePathName, PhpoCommandLine,
  PhpoWindowTitle, PhpoDesktopInfo, PhpoShellInfo, PhpoRuntimeData,
  PhpoTypeMask = 0xffff, PhpoWow64 = 0x10000
}
 Specifies a PEB string. More...
 
enum  _PH_MAPPED_ARCHIVE_MEMBER_TYPE { NormalArchiveMemberType, LinkerArchiveMemberType, LongnamesArchiveMemberType }
 
enum  _PH_SEEK_ORIGIN { SeekStart, SeekCurrent, SeekEnd }
 
enum  _PH_PROVIDER_THREAD_STATE { ProviderThreadRunning, ProviderThreadStopped, ProviderThreadStopping }
 
enum  _PH_HASH_ALGORITHM { Md5HashAlgorithm, Sha1HashAlgorithm, Crc32HashAlgorithm }
 
enum  _PH_COMMAND_LINE_OPTION_TYPE { NoArgumentType, MandatoryArgumentType, OptionalArgumentType }
 

Functions

PHLIBAPI NTSTATUS NTAPI PhOpenProcess (_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE ProcessId)
 Opens a process.
 
PHLIBAPI NTSTATUS NTAPI PhOpenThread (_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE ThreadId)
 Opens a thread.
 
PHLIBAPI NTSTATUS NTAPI PhOpenThreadProcess (_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE ThreadHandle)
 
PHLIBAPI NTSTATUS NTAPI PhOpenProcessToken (_Out_ PHANDLE TokenHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE ProcessHandle)
 Opens a process token.
 
PHLIBAPI NTSTATUS NTAPI PhOpenThreadToken (_Out_ PHANDLE TokenHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE ThreadHandle, _In_ BOOLEAN OpenAsSelf)
 Opens a thread token.
 
PHLIBAPI NTSTATUS NTAPI PhGetObjectSecurity (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _Out_ PSECURITY_DESCRIPTOR *SecurityDescriptor)
 
PHLIBAPI NTSTATUS NTAPI PhSetObjectSecurity (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
 
PHLIBAPI NTSTATUS NTAPI PhTerminateProcess (_In_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus)
 Terminates a process.
 
PHLIBAPI NTSTATUS NTAPI PhSuspendProcess (_In_ HANDLE ProcessHandle)
 Suspends a process' threads.
 
PHLIBAPI NTSTATUS NTAPI PhResumeProcess (_In_ HANDLE ProcessHandle)
 Resumes a process' threads.
 
PHLIBAPI NTSTATUS NTAPI PhTerminateThread (_In_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus)
 Terminates a thread.
 
PHLIBAPI NTSTATUS NTAPI PhSuspendThread (_In_ HANDLE ThreadHandle, _Out_opt_ PULONG PreviousSuspendCount)
 Suspends a thread.
 
PHLIBAPI NTSTATUS NTAPI PhResumeThread (_In_ HANDLE ThreadHandle, _Out_opt_ PULONG PreviousSuspendCount)
 Resumes a thread.
 
PHLIBAPI NTSTATUS NTAPI PhGetThreadContext (_In_ HANDLE ThreadHandle, _Inout_ PCONTEXT Context)
 Gets the processor context of a thread.
 
PHLIBAPI NTSTATUS NTAPI PhSetThreadContext (_In_ HANDLE ThreadHandle, _In_ PCONTEXT Context)
 Sets the processor context of a thread.
 
PHLIBAPI NTSTATUS NTAPI PhReadVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesRead)
 Copies memory from another process into the current process.
 
PHLIBAPI NTSTATUS NTAPI PhWriteVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_reads_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesWritten)
 Copies memory from the current process into another process.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessImageFileName (_In_ HANDLE ProcessHandle, _Out_ PPH_STRING *FileName)
 Gets the file name of the process' image.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessImageFileNameWin32 (_In_ HANDLE ProcessHandle, _Out_ PPH_STRING *FileName)
 Gets the Win32 file name of the process' image.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessPebString (_In_ HANDLE ProcessHandle, _In_ PH_PEB_OFFSET Offset, _Out_ PPH_STRING *String)
 Gets a string stored in a process' parameters structure.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessCommandLine (_In_ HANDLE ProcessHandle, _Out_ PPH_STRING *CommandLine)
 Gets a process' command line.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessWindowTitle (_In_ HANDLE ProcessHandle, _Out_ PULONG WindowFlags, _Out_ PPH_STRING *WindowTitle)
 Gets the window flags and window title of a process.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessIsPosix (_In_ HANDLE ProcessHandle, _Out_ PBOOLEAN IsPosix)
 Gets whether the process is running under the POSIX subsystem.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessExecuteFlags (_In_ HANDLE ProcessHandle, _Out_ PULONG ExecuteFlags)
 Gets a process' no-execute status.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessDepStatus (_In_ HANDLE ProcessHandle, _Out_ PULONG DepStatus)
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessPosixCommandLine (_In_ HANDLE ProcessHandle, _Out_ PPH_STRING *CommandLine)
 Gets the POSIX command line of a process.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessEnvironment (_In_ HANDLE ProcessHandle, _In_ ULONG Flags, _Out_ PVOID *Environment, _Out_ PULONG EnvironmentLength)
 Gets a process' environment block.
 
PHLIBAPI BOOLEAN NTAPI PhEnumProcessEnvironmentVariables (_In_ PVOID Environment, _In_ ULONG EnvironmentLength, _Inout_ PULONG EnumerationKey, _Out_ PPH_ENVIRONMENT_VARIABLE Variable)
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessMappedFileName (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_ PPH_STRING *FileName)
 Gets the file name of a mapped section.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessWorkingSetInformation (_In_ HANDLE ProcessHandle, _Out_ PMEMORY_WORKING_SET_INFORMATION *WorkingSetInformation)
 Gets working set information for a process.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessWsCounters (_In_ HANDLE ProcessHandle, _Out_ PPH_PROCESS_WS_COUNTERS WsCounters)
 Gets working set counters for a process.
 
PHLIBAPI NTSTATUS NTAPI PhSetProcessIoPriority (_In_ HANDLE ProcessHandle, _In_ ULONG IoPriority)
 Sets a process' I/O priority.
 
PHLIBAPI NTSTATUS NTAPI PhSetProcessExecuteFlags (_In_ HANDLE ProcessHandle, _In_ ULONG ExecuteFlags)
 Sets a process' no-execute status.
 
PHLIBAPI NTSTATUS NTAPI PhSetProcessDepStatus (_In_ HANDLE ProcessHandle, _In_ ULONG DepStatus)
 
PHLIBAPI NTSTATUS NTAPI PhSetProcessDepStatusInvasive (_In_ HANDLE ProcessHandle, _In_ ULONG DepStatus, _In_opt_ PLARGE_INTEGER Timeout)
 
PHLIBAPI NTSTATUS NTAPI PhInjectDllProcess (_In_ HANDLE ProcessHandle, _In_ PWSTR FileName, _In_opt_ PLARGE_INTEGER Timeout)
 Causes a process to load a DLL.
 
PHLIBAPI NTSTATUS NTAPI PhUnloadDllProcess (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_opt_ PLARGE_INTEGER Timeout)
 Causes a process to unload a DLL.
 
PHLIBAPI NTSTATUS NTAPI PhSetThreadIoPriority (_In_ HANDLE ThreadHandle, _In_ ULONG IoPriority)
 Sets a thread's I/O priority.
 
PHLIBAPI NTSTATUS NTAPI PhGetJobProcessIdList (_In_ HANDLE JobHandle, _Out_ PJOBOBJECT_BASIC_PROCESS_ID_LIST *ProcessIdList)
 
NTSTATUS NTAPI PhQueryTokenVariableSize (_In_ HANDLE TokenHandle, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, _Out_ PVOID *Buffer)
 Queries variable-sized information for a token.
 
PHLIBAPI NTSTATUS NTAPI PhGetTokenUser (_In_ HANDLE TokenHandle, _Out_ PTOKEN_USER *User)
 Gets a token's user.
 
PHLIBAPI NTSTATUS NTAPI PhGetTokenOwner (_In_ HANDLE TokenHandle, _Out_ PTOKEN_OWNER *Owner)
 Gets a token's owner.
 
PHLIBAPI NTSTATUS NTAPI PhGetTokenPrimaryGroup (_In_ HANDLE TokenHandle, _Out_ PTOKEN_PRIMARY_GROUP *PrimaryGroup)
 Gets a token's primary group.
 
PHLIBAPI NTSTATUS NTAPI PhGetTokenGroups (_In_ HANDLE TokenHandle, _Out_ PTOKEN_GROUPS *Groups)
 Gets a token's groups.
 
PHLIBAPI NTSTATUS NTAPI PhGetTokenPrivileges (_In_ HANDLE TokenHandle, _Out_ PTOKEN_PRIVILEGES *Privileges)
 Gets a token's privileges.
 
PHLIBAPI NTSTATUS NTAPI PhSetTokenSessionId (_In_ HANDLE TokenHandle, _In_ ULONG SessionId)
 
PHLIBAPI BOOLEAN NTAPI PhSetTokenPrivilege (_In_ HANDLE TokenHandle, _In_opt_ PWSTR PrivilegeName, _In_opt_ PLUID PrivilegeLuid, _In_ ULONG Attributes)
 Modifies a token privilege.
 
PHLIBAPI BOOLEAN NTAPI PhSetTokenPrivilege2 (_In_ HANDLE TokenHandle, _In_ LONG Privilege, _In_ ULONG Attributes)
 
PHLIBAPI NTSTATUS NTAPI PhSetTokenIsVirtualizationEnabled (_In_ HANDLE TokenHandle, _In_ BOOLEAN IsVirtualizationEnabled)
 Sets whether virtualization is enabled for a token.
 
PHLIBAPI NTSTATUS NTAPI PhGetTokenIntegrityLevel (_In_ HANDLE TokenHandle, _Out_opt_ PMANDATORY_LEVEL IntegrityLevel, _Out_opt_ PWSTR *IntegrityString)
 Gets a token's integrity level.
 
PHLIBAPI NTSTATUS NTAPI PhGetFileSize (_In_ HANDLE FileHandle, _Out_ PLARGE_INTEGER Size)
 
PHLIBAPI NTSTATUS NTAPI PhSetFileSize (_In_ HANDLE FileHandle, _In_ PLARGE_INTEGER Size)
 
PHLIBAPI NTSTATUS NTAPI PhGetTransactionManagerBasicInformation (_In_ HANDLE TransactionManagerHandle, _Out_ PTRANSACTIONMANAGER_BASIC_INFORMATION BasicInformation)
 
PHLIBAPI NTSTATUS NTAPI PhGetTransactionManagerLogFileName (_In_ HANDLE TransactionManagerHandle, _Out_ PPH_STRING *LogFileName)
 
PHLIBAPI NTSTATUS NTAPI PhGetTransactionBasicInformation (_In_ HANDLE TransactionHandle, _Out_ PTRANSACTION_BASIC_INFORMATION BasicInformation)
 
PHLIBAPI NTSTATUS NTAPI PhGetTransactionPropertiesInformation (_In_ HANDLE TransactionHandle, _Out_opt_ PLARGE_INTEGER Timeout, _Out_opt_ TRANSACTION_OUTCOME *Outcome, _Out_opt_ PPH_STRING *Description)
 
PHLIBAPI NTSTATUS NTAPI PhGetResourceManagerBasicInformation (_In_ HANDLE ResourceManagerHandle, _Out_opt_ PGUID Guid, _Out_opt_ PPH_STRING *Description)
 
PHLIBAPI NTSTATUS NTAPI PhGetEnlistmentBasicInformation (_In_ HANDLE EnlistmentHandle, _Out_ PENLISTMENT_BASIC_INFORMATION BasicInformation)
 
NTSTATUS NTAPI PhOpenDriverByBaseAddress (_Out_ PHANDLE DriverHandle, _In_ PVOID BaseAddress)
 Opens a driver object using a base address.
 
NTSTATUS NTAPI PhGetDriverName (_In_ HANDLE DriverHandle, _Out_ PPH_STRING *Name)
 Gets the object name of a driver.
 
NTSTATUS NTAPI PhGetDriverServiceKeyName (_In_ HANDLE DriverHandle, _Out_ PPH_STRING *ServiceKeyName)
 Gets the service key name of a driver.
 
PHLIBAPI NTSTATUS NTAPI PhUnloadDriver (_In_opt_ PVOID BaseAddress, _In_opt_ PWSTR Name)
 Unloads a driver.
 
PHLIBAPI NTSTATUS NTAPI PhDuplicateObject (_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle, _In_opt_ HANDLE TargetProcessHandle, _Out_opt_ PHANDLE TargetHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ ULONG Options)
 Duplicates a handle.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcessModules (_In_ HANDLE ProcessHandle, _In_ PPH_ENUM_PROCESS_MODULES_CALLBACK Callback, _In_opt_ PVOID Context)
 Enumerates the modules loaded by a process.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcessModulesEx (_In_ HANDLE ProcessHandle, _In_ PPH_ENUM_PROCESS_MODULES_PARAMETERS Parameters)
 Enumerates the modules loaded by a process.
 
PHLIBAPI NTSTATUS NTAPI PhSetProcessModuleLoadCount (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ ULONG LoadCount)
 Sets the load count of a process module.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcessModules32 (_In_ HANDLE ProcessHandle, _In_ PPH_ENUM_PROCESS_MODULES_CALLBACK Callback, _In_opt_ PVOID Context)
 Enumerates the 32-bit modules loaded by a process.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcessModules32Ex (_In_ HANDLE ProcessHandle, _In_ PPH_ENUM_PROCESS_MODULES_PARAMETERS Parameters)
 Enumerates the 32-bit modules loaded by a process.
 
PHLIBAPI NTSTATUS NTAPI PhSetProcessModuleLoadCount32 (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ ULONG LoadCount)
 Sets the load count of a 32-bit process module.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcedureAddressRemote (_In_ HANDLE ProcessHandle, _In_ PWSTR FileName, _In_opt_ PSTR ProcedureName, _In_opt_ ULONG ProcedureNumber, _Out_ PVOID *ProcedureAddress, _Out_opt_ PVOID *DllBase)
 Gets the address of a procedure in a process.
 
PHLIBAPI NTSTATUS NTAPI PhEnumKernelModules (_Out_ PRTL_PROCESS_MODULES *Modules)
 Enumerates the modules loaded by the kernel.
 
NTSTATUS NTAPI PhEnumKernelModulesEx (_Out_ PRTL_PROCESS_MODULE_INFORMATION_EX *Modules)
 Enumerates the modules loaded by the kernel.
 
PHLIBAPI PPH_STRING NTAPI PhGetKernelFileName (VOID)
 Gets the file name of the kernel image.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcesses (_Out_ PVOID *Processes)
 Enumerates the running processes.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcessesEx (_Out_ PVOID *Processes, _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass)
 Enumerates the running processes.
 
PHLIBAPI NTSTATUS NTAPI PhEnumProcessesForSession (_Out_ PVOID *Processes, _In_ ULONG SessionId)
 Enumerates the running processes for a session.
 
PHLIBAPI
PSYSTEM_PROCESS_INFORMATION
NTAPI 		PhFindProcessInformation (_In_ PVOID Processes, _In_ HANDLE ProcessId)
 Finds the process information structure for a specific process.
 
PHLIBAPI
PSYSTEM_PROCESS_INFORMATION
NTAPI 		PhFindProcessInformationByImageName (_In_ PVOID Processes, _In_ PPH_STRINGREF ImageName)
 Finds the process information structure for a specific process.
 
PHLIBAPI NTSTATUS NTAPI PhEnumHandles (_Out_ PSYSTEM_HANDLE_INFORMATION *Handles)
 Enumerates all open handles.
 
PHLIBAPI NTSTATUS NTAPI PhEnumHandlesEx (_Out_ PSYSTEM_HANDLE_INFORMATION_EX *Handles)
 Enumerates all open handles.
 
PHLIBAPI NTSTATUS NTAPI PhEnumPagefiles (_Out_ PVOID *Pagefiles)
 Enumerates all pagefiles.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessImageFileNameByProcessId (_In_ HANDLE ProcessId, _Out_ PPH_STRING *FileName)
 Gets the file name of a process' image.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessIsDotNet (_In_ HANDLE ProcessId, _Out_ PBOOLEAN IsDotNet)
 Determines if a process is managed.
 
PHLIBAPI NTSTATUS NTAPI PhGetProcessIsDotNetEx (_In_ HANDLE ProcessId, _In_opt_ HANDLE ProcessHandle, _In_ ULONG InFlags, _Out_opt_ PBOOLEAN IsDotNet, _Out_opt_ PULONG Flags)
 Determines if a process is managed.
 
PHLIBAPI NTSTATUS NTAPI PhEnumDirectoryObjects (_In_ HANDLE DirectoryHandle, _In_ PPH_ENUM_DIRECTORY_OBJECTS Callback, _In_opt_ PVOID Context)
 Enumerates the objects in a directory object.
 
PHLIBAPI NTSTATUS NTAPI PhEnumDirectoryFile (_In_ HANDLE FileHandle, _In_opt_ PUNICODE_STRING SearchPattern, _In_ PPH_ENUM_DIRECTORY_FILE Callback, _In_opt_ PVOID Context)
 
PHLIBAPI NTSTATUS NTAPI PhEnumFileStreams (_In_ HANDLE FileHandle, _Out_ PVOID *Streams)
 
VOID NTAPI PhInitializeDevicePrefixes (VOID)
 Initializes the device prefixes module.
 
PHLIBAPI VOID NTAPI PhUpdateMupDevicePrefixes (VOID)
 
PHLIBAPI VOID NTAPI PhUpdateDosDevicePrefixes (VOID)
 Updates the DOS device names array.
 
PHLIBAPI PPH_STRING NTAPI PhResolveDevicePrefix (_In_ PPH_STRING Name)
 Resolves a NT path into a Win32 path.
 
PHLIBAPI PPH_STRING NTAPI PhGetFileName (_In_ PPH_STRING FileName)
 Converts a file name into Win32 format.
 
PHLIBAPI NTSTATUS NTAPI PhEnumGenericModules (_In_ HANDLE ProcessId, _In_opt_ HANDLE ProcessHandle, _In_ ULONG Flags, _In_ PPH_ENUM_GENERIC_MODULES_CALLBACK Callback, _In_opt_ PVOID Context)
 Enumerates the modules loaded by a process.
 
PHLIBAPI NTSTATUS NTAPI PhCreateKey (_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ HANDLE RootDirectory, _In_ PPH_STRINGREF ObjectName, _In_ ULONG Attributes, _In_ ULONG CreateOptions, _Out_opt_ PULONG Disposition)
 Creates or opens a registry key.
 
PHLIBAPI NTSTATUS NTAPI PhOpenKey (_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ HANDLE RootDirectory, _In_ PPH_STRINGREF ObjectName, _In_ ULONG Attributes)
 Opens a registry key.
 
PHLIBAPI NTSTATUS NTAPI PhOpenLsaPolicy (_Out_ PLSA_HANDLE PolicyHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PUNICODE_STRING SystemName)
 
LSA_HANDLE NTAPI PhGetLookupPolicyHandle (VOID)
 Retrieves a handle to the local LSA policy with POLICY_LOOKUP_NAMES access.
 
PHLIBAPI BOOLEAN NTAPI PhLookupPrivilegeName (_In_ PLUID PrivilegeValue, _Out_ PPH_STRING *PrivilegeName)
 Gets the name of a privilege from its LUID.
 
PHLIBAPI BOOLEAN NTAPI PhLookupPrivilegeDisplayName (_In_ PPH_STRINGREF PrivilegeName, _Out_ PPH_STRING *PrivilegeDisplayName)
 Gets the display name of a privilege from its name.
 
PHLIBAPI BOOLEAN NTAPI PhLookupPrivilegeValue (_In_ PPH_STRINGREF PrivilegeName, _Out_ PLUID PrivilegeValue)
 Gets the LUID of a privilege from its name.
 
PHLIBAPI NTSTATUS NTAPI PhLookupSid (_In_ PSID Sid, _Out_opt_ PPH_STRING *Name, _Out_opt_ PPH_STRING *DomainName, _Out_opt_ PSID_NAME_USE NameUse)
 Gets information about a SID.
 
PHLIBAPI NTSTATUS NTAPI PhLookupName (_In_ PPH_STRINGREF Name, _Out_opt_ PSID *Sid, _Out_opt_ PPH_STRING *DomainName, _Out_opt_ PSID_NAME_USE NameUse)
 Gets information about a name.
 
PHLIBAPI PPH_STRING NTAPI PhGetSidFullName (_In_ PSID Sid, _In_ BOOLEAN IncludeDomain, _Out_opt_ PSID_NAME_USE NameUse)
 Gets the name of a SID.
 
PHLIBAPI PPH_STRING NTAPI PhSidToStringSid (_In_ PSID Sid)
 Gets a SDDL string representation of a SID.
 
PPH_GET_CLIENT_ID_NAME NTAPI PhSetHandleClientIdFunction (_In_ PPH_GET_CLIENT_ID_NAME GetClientIdName)
 
PHLIBAPI PPH_STRING NTAPI PhFormatNativeKeyName (_In_ PPH_STRING Name)
 
NTSTATUS NTAPI PhGetSectionFileName (_In_ HANDLE SectionHandle, _Out_ PPH_STRING *FileName)
 
PHLIBAPI _Callback_ PPH_STRING
NTAPI 		PhStdGetClientIdName (_In_ PCLIENT_ID ClientId)
 
PHLIBAPI NTSTATUS NTAPI PhGetHandleInformation (_In_ HANDLE ProcessHandle, _In_ HANDLE Handle, _In_ ULONG ObjectTypeNumber, _Out_opt_ POBJECT_BASIC_INFORMATION BasicInformation, _Out_opt_ PPH_STRING *TypeName, _Out_opt_ PPH_STRING *ObjectName, _Out_opt_ PPH_STRING *BestObjectName)
 Gets information for a handle.
 
PHLIBAPI NTSTATUS NTAPI PhGetHandleInformationEx (_In_ HANDLE ProcessHandle, _In_ HANDLE Handle, _In_ ULONG ObjectTypeNumber, _Reserved_ ULONG Flags, _Out_opt_ PNTSTATUS SubStatus, _Out_opt_ POBJECT_BASIC_INFORMATION BasicInformation, _Out_opt_ PPH_STRING *TypeName, _Out_opt_ PPH_STRING *ObjectName, _Out_opt_ PPH_STRING *BestObjectName, _Reserved_ PVOID *ExtraInformation)
 Gets information for a handle.
 
PHLIBAPI NTSTATUS NTAPI PhEnumObjectTypes (_Out_ POBJECT_TYPES_INFORMATION *ObjectTypes)
 
ULONG NTAPI PhGetObjectTypeNumber (_In_ PUNICODE_STRING TypeName)
 
NTSTATUS NTAPI PhCallWithTimeout (_In_ PUSER_THREAD_START_ROUTINE Routine, _In_opt_ PVOID Context, _In_opt_ PLARGE_INTEGER AcquireTimeout, _In_ PLARGE_INTEGER CallTimeout)
 
NTSTATUS NTAPI PhCallNtQueryObjectWithTimeout (_In_ HANDLE Handle, _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation, _In_ ULONG ObjectInformationLength, _Out_opt_ PULONG ReturnLength)
 
NTSTATUS NTAPI PhCallNtQuerySecurityObjectWithTimeout (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ ULONG Length, _Out_ PULONG LengthNeeded)
 
NTSTATUS NTAPI PhCallNtSetSecurityObjectWithTimeout (_In_ HANDLE Handle, _In_ SECURITY_INFORMATION SecurityInformation, _In_ PSECURITY_DESCRIPTOR SecurityDescriptor)
 
NTSTATUS NTAPI PhCallKphDuplicateObjectWithTimeout (_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle, _In_opt_ HANDLE TargetProcessHandle, _Out_opt_ PHANDLE TargetHandle, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes, _In_ ULONG Options)
 
PHLIBAPI NTSTATUS NTAPI PhInitializeMappedImage (_Out_ PPH_MAPPED_IMAGE MappedImage, _In_ PVOID ViewBase, _In_ SIZE_T Size)
 
PHLIBAPI NTSTATUS NTAPI PhLoadMappedImage (_In_opt_ PWSTR FileName, _In_opt_ HANDLE FileHandle, _In_ BOOLEAN ReadOnly, _Out_ PPH_MAPPED_IMAGE MappedImage)
 
PHLIBAPI NTSTATUS NTAPI PhUnloadMappedImage (_Inout_ PPH_MAPPED_IMAGE MappedImage)
 
PHLIBAPI NTSTATUS NTAPI PhMapViewOfEntireFile (_In_opt_ PWSTR FileName, _In_opt_ HANDLE FileHandle, _In_ BOOLEAN ReadOnly, _Out_ PVOID *ViewBase, _Out_ PSIZE_T Size)
 
PHLIBAPI PIMAGE_SECTION_HEADER
NTAPI 		PhMappedImageRvaToSection (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ ULONG Rva)
 
PHLIBAPI PVOID NTAPI PhMappedImageRvaToVa (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ ULONG Rva, _Out_opt_ PIMAGE_SECTION_HEADER *Section)
 
PHLIBAPI BOOLEAN NTAPI PhGetMappedImageSectionName (_In_ PIMAGE_SECTION_HEADER Section, _Out_writes_opt_z_(Count) PSTR Buffer, _In_ ULONG Count, _Out_opt_ PULONG ReturnCount)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageDataEntry (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ ULONG Index, _Out_ PIMAGE_DATA_DIRECTORY *Entry)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageLoadConfig32 (_In_ PPH_MAPPED_IMAGE MappedImage, _Out_ PIMAGE_LOAD_CONFIG_DIRECTORY32 *LoadConfig)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageLoadConfig64 (_In_ PPH_MAPPED_IMAGE MappedImage, _Out_ PIMAGE_LOAD_CONFIG_DIRECTORY64 *LoadConfig)
 
NTSTATUS NTAPI PhLoadRemoteMappedImage (_In_ HANDLE ProcessHandle, _In_ PVOID ViewBase, _Out_ PPH_REMOTE_MAPPED_IMAGE RemoteMappedImage)
 
NTSTATUS NTAPI PhUnloadRemoteMappedImage (_Inout_ PPH_REMOTE_MAPPED_IMAGE RemoteMappedImage)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExports (_Out_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_ PPH_MAPPED_IMAGE MappedImage)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExportEntry (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_ ULONG Index, _Out_ PPH_MAPPED_IMAGE_EXPORT_ENTRY Entry)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExportFunction (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_opt_ PSTR Name, _In_opt_ USHORT Ordinal, _Out_ PPH_MAPPED_IMAGE_EXPORT_FUNCTION Function)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExportFunctionRemote (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_opt_ PSTR Name, _In_opt_ USHORT Ordinal, _In_ PVOID RemoteBase, _Out_ PVOID *Function)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageImports (_Out_ PPH_MAPPED_IMAGE_IMPORTS Imports, _In_ PPH_MAPPED_IMAGE MappedImage)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageImportDll (_In_ PPH_MAPPED_IMAGE_IMPORTS Imports, _In_ ULONG Index, _Out_ PPH_MAPPED_IMAGE_IMPORT_DLL ImportDll)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageImportEntry (_In_ PPH_MAPPED_IMAGE_IMPORT_DLL ImportDll, _In_ ULONG Index, _Out_ PPH_MAPPED_IMAGE_IMPORT_ENTRY Entry)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedImageDelayImports (_Out_ PPH_MAPPED_IMAGE_IMPORTS Imports, _In_ PPH_MAPPED_IMAGE MappedImage)
 
USHORT NTAPI PhCheckSum (_In_ ULONG Sum, _In_reads_(Count) PUSHORT Buffer, _In_ ULONG Count)
 
PHLIBAPI ULONG NTAPI PhCheckSumMappedImage (_In_ PPH_MAPPED_IMAGE MappedImage)
 
PHLIBAPI NTSTATUS NTAPI PhInitializeMappedArchive (_Out_ PPH_MAPPED_ARCHIVE MappedArchive, _In_ PVOID ViewBase, _In_ SIZE_T Size)
 
PHLIBAPI NTSTATUS NTAPI PhLoadMappedArchive (_In_opt_ PWSTR FileName, _In_opt_ HANDLE FileHandle, _In_ BOOLEAN ReadOnly, _Out_ PPH_MAPPED_ARCHIVE MappedArchive)
 
PHLIBAPI NTSTATUS NTAPI PhUnloadMappedArchive (_Inout_ PPH_MAPPED_ARCHIVE MappedArchive)
 
PHLIBAPI NTSTATUS NTAPI PhGetNextMappedArchiveMember (_In_ PPH_MAPPED_ARCHIVE_MEMBER Member, _Out_ PPH_MAPPED_ARCHIVE_MEMBER NextMember)
 Gets the next archive member.
 
PHLIBAPI BOOLEAN NTAPI PhIsMappedArchiveMemberShortFormat (_In_ PPH_MAPPED_ARCHIVE_MEMBER Member)
 
PHLIBAPI NTSTATUS NTAPI PhGetMappedArchiveImportEntry (_In_ PPH_MAPPED_ARCHIVE_MEMBER Member, _Out_ PPH_MAPPED_ARCHIVE_IMPORT_ENTRY Entry)
 
BOOLEAN NTAPI PhIoSupportInitialization (VOID)
 
PHLIBAPI NTSTATUS NTAPI PhCreateFileWin32 (_Out_ PHANDLE FileHandle, _In_ PWSTR FileName, _In_ ACCESS_MASK DesiredAccess, _In_opt_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions)
 Creates or opens a file.
 
PHLIBAPI NTSTATUS NTAPI PhCreateFileWin32Ex (_Out_ PHANDLE FileHandle, _In_ PWSTR FileName, _In_ ACCESS_MASK DesiredAccess, _In_opt_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _Out_opt_ PULONG CreateStatus)
 Creates or opens a file.
 
PHLIBAPI NTSTATUS NTAPI PhQueryFullAttributesFileWin32 (_In_ PWSTR FileName, _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation)
 Queries file attributes.
 
PHLIBAPI NTSTATUS NTAPI PhDeleteFileWin32 (_In_ PWSTR FileName)
 Deletes a file.
 
PHLIBAPI NTSTATUS NTAPI PhListenNamedPipe (_In_ HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, _Out_ PIO_STATUS_BLOCK IoStatusBlock)
 
PHLIBAPI NTSTATUS NTAPI PhDisconnectNamedPipe (_In_ HANDLE FileHandle)
 
PHLIBAPI NTSTATUS NTAPI PhPeekNamedPipe (_In_ HANDLE FileHandle, _Out_writes_bytes_opt_(Length) PVOID Buffer, _In_ ULONG Length, _Out_opt_ PULONG NumberOfBytesRead, _Out_opt_ PULONG NumberOfBytesAvailable, _Out_opt_ PULONG NumberOfBytesLeftInMessage)
 
PHLIBAPI NTSTATUS NTAPI PhTransceiveNamedPipe (_In_ HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength)
 
PHLIBAPI NTSTATUS NTAPI PhWaitForNamedPipe (_In_opt_ PUNICODE_STRING FileSystemName, _In_ PUNICODE_STRING Name, _In_opt_ PLARGE_INTEGER Timeout, _In_ BOOLEAN UseDefaultTimeout)
 
PHLIBAPI NTSTATUS NTAPI PhImpersonateClientOfNamedPipe (_In_ HANDLE FileHandle)
 
PHLIBAPI NTSTATUS NTAPI PhCreateFileStream (_Out_ PPH_FILE_STREAM *FileStream, _In_ PWSTR FileName, _In_ ACCESS_MASK DesiredAccess, _In_ ULONG ShareMode, _In_ ULONG CreateDisposition, _In_ ULONG Flags)
 
PHLIBAPI NTSTATUS NTAPI PhCreateFileStream2 (_Out_ PPH_FILE_STREAM *FileStream, _In_ HANDLE FileHandle, _In_ ULONG Flags, _In_ ULONG BufferLength)
 
PHLIBAPI VOID NTAPI PhVerifyFileStream (_In_ PPH_FILE_STREAM FileStream)
 Verifies that a file stream's position matches the position held by the file object.
 
PHLIBAPI NTSTATUS NTAPI PhReadFileStream (_Inout_ PPH_FILE_STREAM FileStream, _Out_writes_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _Out_opt_ PULONG ReadLength)
 
PHLIBAPI NTSTATUS NTAPI PhWriteFileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_reads_bytes_(Length) PVOID Buffer, _In_ ULONG Length)
 
PHLIBAPI NTSTATUS NTAPI PhFlushFileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_ BOOLEAN Full)
 Flushes the file stream.
 
PHLIBAPI VOID NTAPI PhGetPositionFileStream (_In_ PPH_FILE_STREAM FileStream, _Out_ PLARGE_INTEGER Position)
 
PHLIBAPI NTSTATUS NTAPI PhSeekFileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_ PLARGE_INTEGER Offset, _In_ PH_SEEK_ORIGIN Origin)
 
PHLIBAPI NTSTATUS NTAPI PhLockFileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_ PLARGE_INTEGER Position, _In_ PLARGE_INTEGER Length, _In_ BOOLEAN Wait, _In_ BOOLEAN Shared)
 
PHLIBAPI NTSTATUS NTAPI PhUnlockFileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_ PLARGE_INTEGER Position, _In_ PLARGE_INTEGER Length)
 
PHLIBAPI NTSTATUS NTAPI PhWriteStringAsUtf8FileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_ PPH_STRINGREF String)
 
PHLIBAPI NTSTATUS NTAPI PhWriteStringAsUtf8FileStream2 (_Inout_ PPH_FILE_STREAM FileStream, _In_ PWSTR String)
 
PHLIBAPI NTSTATUS NTAPI PhWriteStringAsUtf8FileStreamEx (_Inout_ PPH_FILE_STREAM FileStream, _In_ PWSTR Buffer, _In_ SIZE_T Length)
 
PHLIBAPI NTSTATUS NTAPI PhWriteStringFormatAsUtf8FileStream_V (_Inout_ PPH_FILE_STREAM FileStream, _In_ _Printf_format_string_ PWSTR Format, _In_ va_list ArgPtr)
 
PHLIBAPI NTSTATUS NTAPI PhWriteStringFormatAsUtf8FileStream (_Inout_ PPH_FILE_STREAM FileStream, _In_ _Printf_format_string_ PWSTR Format,...)
 
PHLIBAPI VOID NTAPI PhInitializeProviderThread (_Out_ PPH_PROVIDER_THREAD ProviderThread, _In_ ULONG Interval)
 Initializes a provider thread.
 
PHLIBAPI VOID NTAPI PhDeleteProviderThread (_Inout_ PPH_PROVIDER_THREAD ProviderThread)
 Frees resources used by a provider thread.
 
PHLIBAPI VOID NTAPI PhStartProviderThread (_Inout_ PPH_PROVIDER_THREAD ProviderThread)
 Starts a provider thread.
 
PHLIBAPI VOID NTAPI PhStopProviderThread (_Inout_ PPH_PROVIDER_THREAD ProviderThread)
 Stops a provider thread.
 
PHLIBAPI VOID NTAPI PhSetIntervalProviderThread (_Inout_ PPH_PROVIDER_THREAD ProviderThread, _In_ ULONG Interval)
 Sets the run interval for a provider thread.
 
PHLIBAPI VOID NTAPI PhRegisterProvider (_Inout_ PPH_PROVIDER_THREAD ProviderThread, _In_ PPH_PROVIDER_FUNCTION Function, _In_opt_ PVOID Object, _Out_ PPH_PROVIDER_REGISTRATION Registration)
 Registers a provider with a provider thread.
 
PHLIBAPI VOID NTAPI PhUnregisterProvider (_Inout_ PPH_PROVIDER_REGISTRATION Registration)
 Unregisters a provider.
 
PHLIBAPI BOOLEAN NTAPI PhBoostProvider (_Inout_ PPH_PROVIDER_REGISTRATION Registration, _Out_opt_ PULONG FutureRunId)
 Causes a provider to be queued for immediate execution.
 
PHLIBAPI ULONG NTAPI PhGetRunIdProvider (_In_ PPH_PROVIDER_REGISTRATION Registration)
 Gets the current run ID of a provider.
 
PHLIBAPI BOOLEAN NTAPI PhGetEnabledProvider (_In_ PPH_PROVIDER_REGISTRATION Registration)
 Gets whether a provider is enabled.
 
PHLIBAPI VOID NTAPI PhSetEnabledProvider (_Inout_ PPH_PROVIDER_REGISTRATION Registration, _In_ BOOLEAN Enabled)
 Sets whether a provider is enabled.
 
PHLIBAPI PVOID NTAPI PhEnumServices (_In_ SC_HANDLE ScManagerHandle, _In_opt_ ULONG Type, _In_opt_ ULONG State, _Out_ PULONG Count)
 
PHLIBAPI SC_HANDLE NTAPI PhOpenService (_In_ PWSTR ServiceName, _In_ ACCESS_MASK DesiredAccess)
 
PHLIBAPI PVOID NTAPI PhGetServiceConfig (_In_ SC_HANDLE ServiceHandle)
 
PHLIBAPI PVOID NTAPI PhQueryServiceVariableSize (_In_ SC_HANDLE ServiceHandle, _In_ ULONG InfoLevel)
 
PHLIBAPI PPH_STRING NTAPI PhGetServiceDescription (_In_ SC_HANDLE ServiceHandle)
 
PHLIBAPI BOOLEAN NTAPI PhGetServiceDelayedAutoStart (_In_ SC_HANDLE ServiceHandle, _Out_ PBOOLEAN DelayedAutoStart)
 
PHLIBAPI BOOLEAN NTAPI PhSetServiceDelayedAutoStart (_In_ SC_HANDLE ServiceHandle, _In_ BOOLEAN DelayedAutoStart)
 
PHLIBAPI PWSTR NTAPI PhGetServiceStateString (_In_ ULONG ServiceState)
 
PHLIBAPI PWSTR NTAPI PhGetServiceTypeString (_In_ ULONG ServiceType)
 
PHLIBAPI ULONG NTAPI PhGetServiceTypeInteger (_In_ PWSTR ServiceType)
 
PHLIBAPI PWSTR NTAPI PhGetServiceStartTypeString (_In_ ULONG ServiceStartType)
 
PHLIBAPI ULONG NTAPI PhGetServiceStartTypeInteger (_In_ PWSTR ServiceStartType)
 
PHLIBAPI PWSTR NTAPI PhGetServiceErrorControlString (_In_ ULONG ServiceErrorControl)
 
PHLIBAPI ULONG NTAPI PhGetServiceErrorControlInteger (_In_ PWSTR ServiceErrorControl)
 
PHLIBAPI PPH_STRING NTAPI PhGetServiceNameFromTag (_In_ HANDLE ProcessId, _In_ PVOID ServiceTag)
 
PHLIBAPI NTSTATUS NTAPI PhGetThreadServiceTag (_In_ HANDLE ThreadHandle, _In_opt_ HANDLE ProcessHandle, _Out_ PVOID *ServiceTag)
 
NTSTATUS NTAPI PhGetServiceDllParameter (_In_ PPH_STRINGREF ServiceName, _Out_ PPH_STRING *ServiceDll)
 
FORCEINLINE PH_RECTANGLE PhRectToRectangle (_In_ RECT Rect)
 
FORCEINLINE RECT PhRectangleToRect (_In_ PH_RECTANGLE Rectangle)
 
FORCEINLINE VOID PhConvertRect (_Inout_ PRECT Rect, _In_ PRECT ParentRect)
 
FORCEINLINE RECT PhMapRect (_In_ RECT InnerRect, _In_ RECT OuterRect)
 
PHLIBAPI VOID NTAPI PhAdjustRectangleToBounds (_Inout_ PPH_RECTANGLE Rectangle, _In_ PPH_RECTANGLE Bounds)
 Ensures a rectangle is positioned within the specified bounds.
 
PHLIBAPI VOID NTAPI PhCenterRectangle (_Inout_ PPH_RECTANGLE Rectangle, _In_ PPH_RECTANGLE Bounds)
 Positions a rectangle in the center of the specified bounds.
 
PHLIBAPI VOID NTAPI PhAdjustRectangleToWorkingArea (_In_ HWND hWnd, _Inout_ PPH_RECTANGLE Rectangle)
 Ensures a rectangle is positioned within the working area of the specified window's monitor.
 
PHLIBAPI VOID NTAPI PhCenterWindow (_In_ HWND WindowHandle, _In_opt_ HWND ParentWindowHandle)
 Centers a window.
 
FORCEINLINE VOID PhLargeIntegerToSystemTime (_Out_ PSYSTEMTIME SystemTime, _In_ PLARGE_INTEGER LargeInteger)
 
FORCEINLINE VOID PhLargeIntegerToLocalSystemTime (_Out_ PSYSTEMTIME SystemTime, _In_ PLARGE_INTEGER LargeInteger)
 
PHLIBAPI VOID NTAPI PhReferenceObjects (_In_reads_(NumberOfObjects) PVOID *Objects, _In_ ULONG NumberOfObjects)
 References an array of objects.
 
PHLIBAPI VOID NTAPI PhDereferenceObjects (_In_reads_(NumberOfObjects) PVOID *Objects, _In_ ULONG NumberOfObjects)
 Dereferences an array of objects.
 
PHLIBAPI PPH_STRING NTAPI PhGetMessage (_In_ PVOID DllHandle, _In_ ULONG MessageTableId, _In_ ULONG MessageLanguageId, _In_ ULONG MessageId)
 Gets a string stored in a DLL's message table.
 
PHLIBAPI PPH_STRING NTAPI PhGetNtMessage (_In_ NTSTATUS Status)
 Gets a message describing a NT status value.
 
PHLIBAPI PPH_STRING NTAPI PhGetWin32Message (_In_ ULONG Result)
 Gets a message describing a Win32 error code.
 
PHLIBAPI INT NTAPI PhShowMessage (_In_ HWND hWnd, _In_ ULONG Type, _In_ PWSTR Format,...)
 Displays a message box.
 
PHLIBAPI INT NTAPI PhShowMessage_V (_In_ HWND hWnd, _In_ ULONG Type, _In_ PWSTR Format, _In_ va_list ArgPtr)
 
PPH_STRING NTAPI PhGetStatusMessage (_In_ NTSTATUS Status, _In_opt_ ULONG Win32Result)
 
PHLIBAPI VOID NTAPI PhShowStatus (_In_ HWND hWnd, _In_opt_ PWSTR Message, _In_ NTSTATUS Status, _In_opt_ ULONG Win32Result)
 Displays an error message for a NTSTATUS value or Win32 error code.
 
PHLIBAPI BOOLEAN NTAPI PhShowContinueStatus (_In_ HWND hWnd, _In_opt_ PWSTR Message, _In_ NTSTATUS Status, _In_opt_ ULONG Win32Result)
 Displays an error message for a NTSTATUS value or Win32 error code, and allows the user to cancel the current operation.
 
PHLIBAPI BOOLEAN NTAPI PhShowConfirmMessage (_In_ HWND hWnd, _In_ PWSTR Verb, _In_ PWSTR Object, _In_opt_ PWSTR Message, _In_ BOOLEAN Warning)
 Displays a confirmation message.
 
PHLIBAPI BOOLEAN NTAPI PhFindIntegerSiKeyValuePairs (_In_ PPH_KEY_VALUE_PAIR KeyValuePairs, _In_ ULONG SizeOfKeyValuePairs, _In_ PWSTR String, _Out_ PULONG Integer)
 Finds an integer in an array of string-integer pairs.
 
PHLIBAPI BOOLEAN NTAPI PhFindStringSiKeyValuePairs (_In_ PPH_KEY_VALUE_PAIR KeyValuePairs, _In_ ULONG SizeOfKeyValuePairs, _In_ ULONG Integer, _Out_ PWSTR *String)
 Finds a string in an array of string-integer pairs.
 
PHLIBAPI VOID NTAPI PhGenerateGuid (_Out_ PGUID Guid)
 Creates a random (type 4) UUID.
 
PHLIBAPI VOID NTAPI PhGenerateGuidFromName (_Out_ PGUID Guid, _In_ PGUID Namespace, _In_ PCHAR Name, _In_ ULONG NameLength, _In_ UCHAR Version)
 Creates a name-based (type 3 or 5) UUID.
 
PHLIBAPI VOID NTAPI PhGenerateRandomAlphaString (_Out_writes_z_(Count) PWSTR Buffer, _In_ ULONG Count)
 Fills a buffer with random uppercase alphabetical characters.
 
PHLIBAPI PPH_STRING NTAPI PhEllipsisString (_In_ PPH_STRING String, _In_ ULONG DesiredCount)
 Modifies a string to ensure it is within the specified length.
 
PHLIBAPI PPH_STRING NTAPI PhEllipsisStringPath (_In_ PPH_STRING String, _In_ ULONG DesiredCount)
 Modifies a string to ensure it is within the specified length, parsing the string as a path.
 
PHLIBAPI BOOLEAN NTAPI PhMatchWildcards (_In_ PWSTR Pattern, _In_ PWSTR String, _In_ BOOLEAN IgnoreCase)
 Matches a pattern against a string.
 
PHLIBAPI PPH_STRING NTAPI PhEscapeStringForMenuPrefix (_In_ PPH_STRINGREF String)
 Escapes a string for prefix characters (ampersands).
 
PHLIBAPI LONG NTAPI PhCompareUnicodeStringZIgnoreMenuPrefix (_In_ PWSTR A, _In_ PWSTR B, _In_ BOOLEAN IgnoreCase, _In_ BOOLEAN MatchIfPrefix)
 Compares two strings, ignoring prefix characters (ampersands).
 
PHLIBAPI PPH_STRING NTAPI PhFormatDate (_In_opt_ PSYSTEMTIME Date, _In_opt_ PWSTR Format)
 Formats a date using the user's default locale.
 
PHLIBAPI PPH_STRING NTAPI PhFormatTime (_In_opt_ PSYSTEMTIME Time, _In_opt_ PWSTR Format)
 Formats a time using the user's default locale.
 
PHLIBAPI PPH_STRING NTAPI PhFormatDateTime (_In_opt_ PSYSTEMTIME DateTime)
 Formats a date and time using the user's default locale.
 
PHLIBAPI PPH_STRING NTAPI PhFormatTimeSpanRelative (_In_ ULONG64 TimeSpan)
 Formats a relative time span.
 
PHLIBAPI PPH_STRING NTAPI PhFormatUInt64 (_In_ ULONG64 Value, _In_ BOOLEAN GroupDigits)
 Formats a 64-bit unsigned integer.
 
PHLIBAPI PPH_STRING NTAPI PhFormatDecimal (_In_ PWSTR Value, _In_ ULONG FractionalDigits, _In_ BOOLEAN GroupDigits)
 
PHLIBAPI PPH_STRING NTAPI PhFormatSize (_In_ ULONG64 Size, _In_ ULONG MaxSizeUnit)
 Gets a string representing a size.
 
PHLIBAPI PPH_STRING NTAPI PhFormatGuid (_In_ PGUID Guid)
 Converts a UUID to its string representation.
 
PHLIBAPI PVOID NTAPI PhGetFileVersionInfo (_In_ PWSTR FileName)
 Retrieves image version information for a file.
 
PHLIBAPI ULONG NTAPI PhGetFileVersionInfoLangCodePage (_In_ PVOID VersionInfo)
 Retrieves the language ID and code page used by a version information block.
 
PHLIBAPI PPH_STRING NTAPI PhGetFileVersionInfoString (_In_ PVOID VersionInfo, _In_ PWSTR SubBlock)
 Retrieves a string in a version information block.
 
PHLIBAPI PPH_STRING NTAPI PhGetFileVersionInfoString2 (_In_ PVOID VersionInfo, _In_ ULONG LangCodePage, _In_ PWSTR StringName)
 Retrieves a string in a version information block.
 
PHLIBAPI BOOLEAN NTAPI PhInitializeImageVersionInfo (_Out_ PPH_IMAGE_VERSION_INFO ImageVersionInfo, _In_ PWSTR FileName)
 Initializes a structure with version information.
 
PHLIBAPI VOID NTAPI PhDeleteImageVersionInfo (_Inout_ PPH_IMAGE_VERSION_INFO ImageVersionInfo)
 Frees a version information structure initialized by PhInitializeImageVersionInfo().
 
PHLIBAPI PPH_STRING NTAPI PhFormatImageVersionInfo (_In_opt_ PPH_STRING FileName, _In_ PPH_IMAGE_VERSION_INFO ImageVersionInfo, _In_opt_ PPH_STRINGREF Indent, _In_opt_ ULONG LineLimit)
 
PHLIBAPI PPH_STRING NTAPI PhGetFullPath (_In_ PWSTR FileName, _Out_opt_ PULONG IndexOfFileName)
 Gets an absolute file name.
 
PHLIBAPI PPH_STRING NTAPI PhExpandEnvironmentStrings (_In_ PPH_STRINGREF String)
 Expands environment variables in a string.
 
PHLIBAPI PPH_STRING NTAPI PhGetBaseName (_In_ PPH_STRING FileName)
 Gets the base name from a file name.
 
PHLIBAPI PPH_STRING NTAPI PhGetSystemDirectory (VOID)
 Retrieves the system directory path.
 
PHLIBAPI VOID NTAPI PhGetSystemRoot (_Out_ PPH_STRINGREF SystemRoot)
 Retrieves the Windows directory path.
 
PHLIBAPI PLDR_DATA_TABLE_ENTRY
NTAPI 		PhFindLoaderEntry (_In_opt_ PVOID DllBase, _In_opt_ PPH_STRINGREF FullDllName, _In_opt_ PPH_STRINGREF BaseDllName)
 Locates a loader entry in the current process.
 
PHLIBAPI PPH_STRING NTAPI PhGetDllFileName (_In_ PVOID DllHandle, _Out_opt_ PULONG IndexOfFileName)
 Retrieves the file name of a DLL loaded by the current process.
 
PHLIBAPI PPH_STRING NTAPI PhGetApplicationFileName (VOID)
 Retrieves the file name of the current process image.
 
PHLIBAPI PPH_STRING NTAPI PhGetApplicationDirectory (VOID)
 Retrieves the directory of the current process image.
 
PHLIBAPI PPH_STRING NTAPI PhGetKnownLocation (_In_ ULONG Folder, _In_opt_ PWSTR AppendPath)
 Gets a known location as a file name.
 
PHLIBAPI NTSTATUS NTAPI PhWaitForMultipleObjectsAndPump (_In_opt_ HWND hWnd, _In_ ULONG NumberOfHandles, _In_ PHANDLE Handles, _In_ ULONG Timeout)
 Waits on multiple objects while processing window messages.
 
PHLIBAPI NTSTATUS NTAPI PhCreateProcess (_In_ PWSTR FileName, _In_opt_ PPH_STRINGREF CommandLine, _In_opt_ PVOID Environment, _In_opt_ PPH_STRINGREF CurrentDirectory, _In_opt_ PPH_CREATE_PROCESS_INFO Information, _In_ ULONG Flags, _In_opt_ HANDLE ParentProcessHandle, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle)
 Creates a native process and an initial thread.
 
PHLIBAPI NTSTATUS NTAPI PhCreateProcessWin32 (_In_opt_ PWSTR FileName, _In_opt_ PWSTR CommandLine, _In_opt_ PVOID Environment, _In_opt_ PWSTR CurrentDirectory, _In_ ULONG Flags, _In_opt_ HANDLE TokenHandle, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle)
 Creates a Win32 process and an initial thread.
 
PHLIBAPI NTSTATUS NTAPI PhCreateProcessWin32Ex (_In_opt_ PWSTR FileName, _In_opt_ PWSTR CommandLine, _In_opt_ PVOID Environment, _In_opt_ PWSTR CurrentDirectory, _In_opt_ STARTUPINFO *StartupInfo, _In_ ULONG Flags, _In_opt_ HANDLE TokenHandle, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle)
 Creates a Win32 process and an initial thread.
 
PHLIBAPI NTSTATUS NTAPI PhCreateProcessAsUser (_In_ PPH_CREATE_PROCESS_AS_USER_INFO Information, _In_ ULONG Flags, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle)
 Creates a Win32 process and an initial thread under the specified user.
 
NTSTATUS NTAPI PhFilterTokenForLimitedUser (_In_ HANDLE TokenHandle, _Out_ PHANDLE NewTokenHandle)
 Filters a token to create a limited user security context.
 
PHLIBAPI VOID NTAPI PhShellExecute (_In_ HWND hWnd, _In_ PWSTR FileName, _In_opt_ PWSTR Parameters)
 Opens a file or location through the shell.
 
PHLIBAPI BOOLEAN NTAPI PhShellExecuteEx (_In_opt_ HWND hWnd, _In_ PWSTR FileName, _In_opt_ PWSTR Parameters, _In_ ULONG ShowWindowType, _In_ ULONG Flags, _In_opt_ ULONG Timeout, _Out_opt_ PHANDLE ProcessHandle)
 Opens a file or location through the shell.
 
PHLIBAPI VOID NTAPI PhShellExploreFile (_In_ HWND hWnd, _In_ PWSTR FileName)
 Opens Windows Explorer with a file selected.
 
PHLIBAPI VOID NTAPI PhShellProperties (_In_ HWND hWnd, _In_ PWSTR FileName)
 Shows properties for a file.
 
PPH_STRING NTAPI PhExpandKeyName (_In_ PPH_STRING KeyName, _In_ BOOLEAN Computer)
 Expands registry name abbreviations.
 
PHLIBAPI VOID NTAPI PhShellOpenKey (_In_ HWND hWnd, _In_ PPH_STRING KeyName)
 Opens a key in the Registry Editor.
 
PKEY_VALUE_PARTIAL_INFORMATION
NTAPI 		PhQueryRegistryValue (_In_ HANDLE KeyHandle, _In_opt_ PWSTR ValueName)
 Gets a registry value of any type.
 
PHLIBAPI PPH_STRING NTAPI PhQueryRegistryString (_In_ HANDLE KeyHandle, _In_opt_ PWSTR ValueName)
 Gets a registry string value.
 
PHLIBAPI VOID NTAPI PhMapFlags1 (_Inout_ PULONG Value2, _In_ ULONG Value1, _In_ const PH_FLAG_MAPPING *Mappings, _In_ ULONG NumberOfMappings)
 
PHLIBAPI VOID NTAPI PhMapFlags2 (_Inout_ PULONG Value1, _In_ ULONG Value2, _In_ const PH_FLAG_MAPPING *Mappings, _In_ ULONG NumberOfMappings)
 
PHLIBAPI PVOID NTAPI PhCreateOpenFileDialog (VOID)
 Creates a file dialog for the user to select a file to open.
 
PHLIBAPI PVOID NTAPI PhCreateSaveFileDialog (VOID)
 Creates a file dialog for the user to select a file to save to.
 
PHLIBAPI VOID NTAPI PhFreeFileDialog (_In_ PVOID FileDialog)
 Frees a file dialog.
 
PHLIBAPI BOOLEAN NTAPI PhShowFileDialog (_In_ HWND hWnd, _In_ PVOID FileDialog)
 Shows a file dialog to the user.
 
PHLIBAPI ULONG NTAPI PhGetFileDialogOptions (_In_ PVOID FileDialog)
 Gets the options for a file dialog.
 
PHLIBAPI VOID NTAPI PhSetFileDialogOptions (_In_ PVOID FileDialog, _In_ ULONG Options)
 Sets the options for a file dialog.
 
PHLIBAPI ULONG NTAPI PhGetFileDialogFilterIndex (_In_ PVOID FileDialog)
 Gets the index of the currently selected file type filter for a file dialog.
 
PHLIBAPI VOID NTAPI PhSetFileDialogFilter (_In_ PVOID FileDialog, _In_ PPH_FILETYPE_FILTER Filters, _In_ ULONG NumberOfFilters)
 Sets the file type filter for a file dialog.
 
PHLIBAPI PPH_STRING NTAPI PhGetFileDialogFileName (_In_ PVOID FileDialog)
 Gets the file name selected in a file dialog.
 
PHLIBAPI VOID NTAPI PhSetFileDialogFileName (_In_ PVOID FileDialog, _In_ PWSTR FileName)
 Sets the file name of a file dialog.
 
PHLIBAPI NTSTATUS NTAPI PhIsExecutablePacked (_In_ PWSTR FileName, _Out_ PBOOLEAN IsPacked, _Out_opt_ PULONG NumberOfModules, _Out_opt_ PULONG NumberOfFunctions)
 Determines if an executable image is packed.
 
ULONG NTAPI PhCrc32 (_In_ ULONG Crc, _In_reads_(Length) PCHAR Buffer, _In_ SIZE_T Length)
 
PHLIBAPI VOID NTAPI PhInitializeHash (_Out_ PPH_HASH_CONTEXT Context, _In_ PH_HASH_ALGORITHM Algorithm)
 Initializes hashing.
 
PHLIBAPI VOID NTAPI PhUpdateHash (_Inout_ PPH_HASH_CONTEXT Context, _In_reads_bytes_(Length) PVOID Buffer, _In_ ULONG Length)
 Hashes a block of data.
 
PHLIBAPI BOOLEAN NTAPI PhFinalHash (_Inout_ PPH_HASH_CONTEXT Context, _Out_writes_bytes_(HashLength) PVOID Hash, _In_ ULONG HashLength, _Out_opt_ PULONG ReturnLength)
 Computes the final hash value.
 
PHLIBAPI PPH_STRING NTAPI PhParseCommandLinePart (_In_ PPH_STRINGREF CommandLine, _Inout_ PULONG_PTR Index)
 Parses one part of a command line string.
 
PHLIBAPI BOOLEAN NTAPI PhParseCommandLine (_In_ PPH_STRINGREF CommandLine, _In_opt_ PPH_COMMAND_LINE_OPTION Options, _In_ ULONG NumberOfOptions, _In_ ULONG Flags, _In_ PPH_COMMAND_LINE_CALLBACK Callback, _In_opt_ PVOID Context)
 Parses a command line string.
 
PHLIBAPI PPH_STRING NTAPI PhEscapeCommandLinePart (_In_ PPH_STRINGREF String)
 Escapes a string for use in a command line.
 
PHLIBAPI BOOLEAN NTAPI PhParseCommandLineFuzzy (_In_ PPH_STRINGREF CommandLine, _Out_ PPH_STRINGREF FileName, _Out_ PPH_STRINGREF Arguments, _Out_opt_ PPH_STRING *FullFileName)
 Parses a command line string.
 

Variables

PPH_OBJECT_TYPE PhFileStreamType
 
WCHAR * PhServiceTypeStrings [6]
 
WCHAR * PhServiceStartTypeStrings [5]
 
WCHAR * PhServiceErrorControlStrings [4]
 
WCHAR * PhSizeUnitNames [7]
 
ULONG PhMaxSizeUnit
 

Macro Definition Documentation

#define GUID_VARIANT_MICROSOFT   0xc0

Definition at line 2481 of file ph.h.

#define GUID_VARIANT_MICROSOFT_MASK   0xe0

Definition at line 2480 of file ph.h.

#define GUID_VARIANT_NCS   0x00

Definition at line 2477 of file ph.h.

#define GUID_VARIANT_NCS_MASK   0x80

Definition at line 2476 of file ph.h.

#define GUID_VARIANT_RESERVED   0xe0

Definition at line 2483 of file ph.h.

#define GUID_VARIANT_RESERVED_MASK   0xe0

Definition at line 2482 of file ph.h.

#define GUID_VARIANT_STANDARD   0x80

Definition at line 2479 of file ph.h.

#define GUID_VARIANT_STANDARD_MASK   0xc0

Definition at line 2478 of file ph.h.

#define GUID_VERSION_DCE   2

Definition at line 2471 of file ph.h.

#define GUID_VERSION_MAC   1

Definition at line 2470 of file ph.h.

#define GUID_VERSION_MD5   3

Definition at line 2472 of file ph.h.

#define GUID_VERSION_RANDOM   4

Definition at line 2473 of file ph.h.

#define GUID_VERSION_SHA1   5

Definition at line 2474 of file ph.h.

#define MAX_OBJECT_TYPE_NUMBER   257

Definition at line 1124 of file ph.h.

#define PH_CLR_KNOWN_IS_WOW64   0x4

Definition at line 843 of file ph.h.

#define PH_CLR_MSCORLIB_PRESENT   0x10000

Definition at line 850 of file ph.h.

#define PH_CLR_NO_WOW64_CHECK   0x2

Definition at line 842 of file ph.h.

#define PH_CLR_PROCESS_IS_WOW64   0x100000

Definition at line 851 of file ph.h.

#define PH_CLR_USE_SECTION_CHECK   0x1

Definition at line 841 of file ph.h.

#define PH_CLR_VERSION_1_0   0x1

Definition at line 845 of file ph.h.

#define PH_CLR_VERSION_1_1   0x2

Definition at line 846 of file ph.h.

#define PH_CLR_VERSION_2_0   0x4

Definition at line 847 of file ph.h.

#define PH_CLR_VERSION_4_ABOVE   0x8

Definition at line 848 of file ph.h.

#define PH_CLR_VERSION_MASK   0xf

Definition at line 849 of file ph.h.

#define PH_COMMAND_LINE_IGNORE_FIRST_PART   0x2

Definition at line 3177 of file ph.h.

#define PH_COMMAND_LINE_IGNORE_UNKNOWN_OPTIONS   0x1

Definition at line 3176 of file ph.h.

#define PH_CREATE_PROCESS_BREAKAWAY_FROM_JOB   0x8

Definition at line 2815 of file ph.h.

#define PH_CREATE_PROCESS_INHERIT_HANDLES   0x1

Definition at line 2812 of file ph.h.

#define PH_CREATE_PROCESS_NEW_CONSOLE   0x10

Definition at line 2816 of file ph.h.

#define PH_CREATE_PROCESS_SET_SESSION_ID   0x20000

Definition at line 2889 of file ph.h.

#define PH_CREATE_PROCESS_SUSPENDED   0x4

Definition at line 2814 of file ph.h.

#define PH_CREATE_PROCESS_UNICODE_ENVIRONMENT   0x2

Definition at line 2813 of file ph.h.

#define PH_CREATE_PROCESS_USE_LINKED_TOKEN   0x10000

Definition at line 2888 of file ph.h.

#define PH_CREATE_PROCESS_USE_PROCESS_TOKEN   0x1000

Definition at line 2886 of file ph.h.

#define PH_CREATE_PROCESS_USE_SESSION_TOKEN   0x2000

Definition at line 2887 of file ph.h.

#define PH_CREATE_PROCESS_WITH_PROFILE   0x40000

Definition at line 2890 of file ph.h.

#define PH_ENUM_GENERIC_MAPPED_FILES   0x1

Definition at line 996 of file ph.h.

#define PH_ENUM_GENERIC_MAPPED_IMAGES   0x2

Definition at line 997 of file ph.h.

#define PH_ENUM_PROCESS_MODULES_DONT_RESOLVE_WOW64_FS   0x1

Definition at line 633 of file ph.h.

#define PH_ENUM_PROCESS_MODULES_LIMIT   0x800

Definition at line 614 of file ph.h.

#define PH_ENUM_PROCESS_MODULES_TRY_MAPPED_FILE_NAME   0x2

Definition at line 634 of file ph.h.

#define PH_FILE_STREAM_APPEND   0x00010000

Definition at line 1763 of file ph.h.

#define PH_FILE_STREAM_ASYNCHRONOUS   0x4

Indicates that the file handle supports asynchronous operations.

The file handle must not have been opened with FILE_SYNCHRONOUS_IO_ALERT or FILE_SYNCHRONOUS_IO_NONALERT.

Definition at line 1757 of file ph.h.

#define PH_FILE_STREAM_HANDLE_UNOWNED   0x1

Indicates that the file stream object should not close the file handle upon deletion.

Definition at line 1750 of file ph.h.

#define PH_FILE_STREAM_OWN_POSITION   0x8

Indicates that the file stream object should maintain the file position and not use the file object's own file position.

Definition at line 1760 of file ph.h.

#define PH_FILE_STREAM_UNBUFFERED   0x2

Indicates that the file stream object should not buffer I/O operations.

Note that this does not prevent the operating system from buffering I/O.

Definition at line 1753 of file ph.h.

#define PH_FILE_STREAM_WRITTEN   0x80000000

Indicates that at least one write has been issued to the file handle.

Definition at line 1767 of file ph.h.

#define PH_FILEDIALOG_CREATEPROMPT   0x1

Definition at line 3036 of file ph.h.

#define PH_FILEDIALOG_DEFAULTEXPANDED   0x40

Definition at line 3042 of file ph.h.

#define PH_FILEDIALOG_FILEMUSTEXIST   0x4

Definition at line 3038 of file ph.h.

#define PH_FILEDIALOG_NODEREFERENCELINKS   0x10

Definition at line 3040 of file ph.h.

#define PH_FILEDIALOG_OVERWRITEPROMPT   0x20

Definition at line 3041 of file ph.h.

#define PH_FILEDIALOG_PATHMUSTEXIST   0x2

Definition at line 3037 of file ph.h.

#define PH_FILEDIALOG_PICKFOLDERS   0x100

Definition at line 3044 of file ph.h.

#define PH_FILEDIALOG_SHOWHIDDEN   0x8

Definition at line 3039 of file ph.h.

#define PH_FILEDIALOG_STRICTFILETYPES   0x80

Definition at line 3043 of file ph.h.

#define PH_FIRST_OBJECT_TYPE (   ObjectTypes)    (POBJECT_TYPE_INFORMATION)((PCHAR)(ObjectTypes) + ALIGN_UP(sizeof(OBJECT_TYPES_INFORMATION), ULONG_PTR))

Definition at line 1186 of file ph.h.

#define PH_FIRST_PAGEFILE (   Pagefiles)
Value:
( \
/* The size of a pagefile can never be 0. A TotalSize of 0
* is used to indicate that there are no pagefiles.
*/ ((PSYSTEM_PAGEFILE_INFORMATION)(Pagefiles))->TotalSize ? \
(PSYSTEM_PAGEFILE_INFORMATION)(Pagefiles) : \
NULL \
)

Definition at line 806 of file ph.h.

#define PH_FIRST_PROCESS (   Processes)    ((PSYSTEM_PROCESS_INFORMATION)(Processes))

Gets a pointer to the first process information structure in a buffer returned by PhEnumProcesses().

Parameters
ProcessesA pointer to a buffer returned by PhEnumProcesses().

Definition at line 734 of file ph.h.

#define PH_FIRST_STREAM (   Streams)    ((PFILE_STREAM_INFORMATION)(Streams))

Definition at line 906 of file ph.h.

#define PH_GET_PROCESS_ENVIRONMENT_WOW64   0x1

Definition at line 285 of file ph.h.

#define PH_KEY_CLASSES_ROOT   PH_KEY_PREDEFINE(2)

Definition at line 1016 of file ph.h.

#define PH_KEY_CURRENT_USER   PH_KEY_PREDEFINE(3)

Definition at line 1017 of file ph.h.

#define PH_KEY_CURRENT_USER_NUMBER   3

Definition at line 1018 of file ph.h.

#define PH_KEY_IS_PREDEFINED (   Predefine)    (((LONG_PTR)(Predefine) < 0) && ((LONG_PTR)(Predefine) & 0x1))

Definition at line 1011 of file ph.h.

#define PH_KEY_LOCAL_MACHINE   PH_KEY_PREDEFINE(0)

Definition at line 1014 of file ph.h.

#define PH_KEY_MAXIMUM_PREDEFINE   4

Definition at line 1019 of file ph.h.

#define PH_KEY_PREDEFINE (   Number)    ((HANDLE)(LONG_PTR)(-3 - (Number) * 2))

Definition at line 1010 of file ph.h.

#define PH_KEY_PREDEFINE_TO_NUMBER (   Predefine)    (ULONG)(((-(LONG_PTR)(Predefine) - 3) >> 1))

Definition at line 1012 of file ph.h.

#define PH_KEY_USERS   PH_KEY_PREDEFINE(1)

Definition at line 1015 of file ph.h.

#define PH_MAPPED_IMAGE_DELAY_IMPORTS   0x1

Definition at line 1443 of file ph.h.

#define PH_MAX_MESSAGE_SIZE   800

Definition at line 2386 of file ph.h.

#define PH_MODULE_TYPE_KERNEL_MODULE   4

Definition at line 959 of file ph.h.

#define PH_MODULE_TYPE_MAPPED_FILE   2

Definition at line 957 of file ph.h.

#define PH_MODULE_TYPE_MAPPED_IMAGE   5

Definition at line 960 of file ph.h.

#define PH_MODULE_TYPE_MODULE   1

Definition at line 956 of file ph.h.

#define PH_MODULE_TYPE_WOW64_MODULE   3

Definition at line 958 of file ph.h.

#define PH_NEXT_OBJECT_TYPE (   ObjectType)
Value:
(POBJECT_TYPE_INFORMATION)((PCHAR)(ObjectType) + sizeof(OBJECT_TYPE_INFORMATION) + \
ALIGN_UP(ObjectType->TypeName.MaximumLength, ULONG_PTR))

Definition at line 1189 of file ph.h.

#define PH_NEXT_PAGEFILE (   Pagefile)
Value:
( \
((PSYSTEM_PAGEFILE_INFORMATION)(Pagefile))->NextEntryOffset ? \
(PSYSTEM_PAGEFILE_INFORMATION)((PCHAR)(Pagefile) + \
((PSYSTEM_PAGEFILE_INFORMATION)(Pagefile))->NextEntryOffset) : \
NULL \
)

Definition at line 811 of file ph.h.

#define PH_NEXT_PROCESS (   Process)
Value:
( \
((PSYSTEM_PROCESS_INFORMATION)(Process))->NextEntryOffset ? \
(PSYSTEM_PROCESS_INFORMATION)((PCHAR)(Process) + \
((PSYSTEM_PROCESS_INFORMATION)(Process))->NextEntryOffset) : \
NULL \
)

Gets a pointer to the process information structure after a given structure.

Parameters
ProcessA pointer to a process information structure.
Returns
A pointer to the next process information structure, or NULL if there are no more.

Definition at line 746 of file ph.h.

#define PH_NEXT_STREAM (   Stream)
Value:
( \
((PFILE_STREAM_INFORMATION)(Stream))->NextEntryOffset ? \
(PFILE_STREAM_INFORMATION)((PCHAR)(Stream) + \
((PFILE_STREAM_INFORMATION)(Stream))->NextEntryOffset) : \
NULL \
)

Definition at line 907 of file ph.h.

#define PH_PROCESS_DEP_ATL_THUNK_EMULATION_DISABLED   0x2

Definition at line 266 of file ph.h.

#define PH_PROCESS_DEP_ENABLED   0x1

Definition at line 265 of file ph.h.

#define PH_PROCESS_DEP_PERMANENT   0x4

Definition at line 267 of file ph.h.

#define PH_SHELL_EXECUTE_ADMIN   0x1

Definition at line 2919 of file ph.h.

#define PH_SHELL_EXECUTE_PUMP_MESSAGES   0x2

Definition at line 2920 of file ph.h.

#define PhaFormatDateTime (   DateTime)    ((PPH_STRING)PhAutoDereferenceObject(PhFormatDateTime(DateTime)))

Definition at line 2603 of file ph.h.

#define PhaFormatDecimal (   Value,
  FractionalDigits,
  GroupDigits 
)    ((PPH_STRING)PhAutoDereferenceObject(PhFormatDecimal((Value), (FractionalDigits), (GroupDigits))))

Definition at line 2633 of file ph.h.

#define PhaFormatSize (   Size,
  MaxSizeUnit 
)    ((PPH_STRING)PhAutoDereferenceObject(PhFormatSize((Size), (MaxSizeUnit))))

Definition at line 2644 of file ph.h.

#define PhaFormatUInt64 (   Value,
  GroupDigits 
)    ((PPH_STRING)PhAutoDereferenceObject(PhFormatUInt64((Value), (GroupDigits))))

Definition at line 2621 of file ph.h.

#define PhShowError (   hWnd,
  Format,
  ... 
)    PhShowMessage(hWnd, MB_OK | MB_ICONERROR, Format, __VA_ARGS__)

Definition at line 2408 of file ph.h.

#define PhShowInformation (   hWnd,
  Format,
  ... 
)    PhShowMessage(hWnd, MB_OK | MB_ICONINFORMATION, Format, __VA_ARGS__)

Definition at line 2410 of file ph.h.

#define PhShowWarning (   hWnd,
  Format,
  ... 
)    PhShowMessage(hWnd, MB_OK | MB_ICONWARNING, Format, __VA_ARGS__)

Definition at line 2409 of file ph.h.

#define SYSTEM_IDLE_PROCESS_ID   ((HANDLE)0)

The PID of the idle process.

Definition at line 17 of file ph.h.

#define SYSTEM_IDLE_PROCESS_NAME   (L"System Idle Process")

Definition at line 21 of file ph.h.

#define SYSTEM_PROCESS_ID   ((HANDLE)4)

The PID of the system process.

Definition at line 19 of file ph.h.

Typedef Documentation

typedef union _GUID_EX GUID_EX
typedef union _GUID_EX * PGUID_EX
typedef struct _PH_COMMAND_LINE_OPTION PH_COMMAND_LINE_OPTION
typedef enum _PH_COMMAND_LINE_OPTION_TYPE PH_COMMAND_LINE_OPTION_TYPE
typedef struct _PH_CREATE_PROCESS_AS_USER_INFO PH_CREATE_PROCESS_AS_USER_INFO
typedef struct _PH_CREATE_PROCESS_INFO PH_CREATE_PROCESS_INFO
typedef struct _PH_ENUM_PROCESS_MODULES_PARAMETERS PH_ENUM_PROCESS_MODULES_PARAMETERS
typedef struct _PH_ENVIRONMENT_VARIABLE PH_ENVIRONMENT_VARIABLE
typedef struct _PH_FILE_STREAM PH_FILE_STREAM
typedef struct _PH_FILETYPE_FILTER PH_FILETYPE_FILTER
typedef struct _PH_FLAG_MAPPING PH_FLAG_MAPPING
typedef enum _PH_HASH_ALGORITHM PH_HASH_ALGORITHM
typedef struct _PH_HASH_CONTEXT PH_HASH_CONTEXT
typedef struct _PH_IMAGE_VERSION_INFO PH_IMAGE_VERSION_INFO
typedef struct _PH_INTEGER_PAIR PH_INTEGER_PAIR
typedef struct _PH_MAPPED_ARCHIVE PH_MAPPED_ARCHIVE
typedef struct _PH_MAPPED_ARCHIVE_IMPORT_ENTRY PH_MAPPED_ARCHIVE_IMPORT_ENTRY
typedef struct _PH_MAPPED_ARCHIVE_MEMBER PH_MAPPED_ARCHIVE_MEMBER
typedef enum _PH_MAPPED_ARCHIVE_MEMBER_TYPE PH_MAPPED_ARCHIVE_MEMBER_TYPE
typedef struct _PH_MAPPED_IMAGE PH_MAPPED_IMAGE
typedef struct _PH_MAPPED_IMAGE_EXPORT_ENTRY PH_MAPPED_IMAGE_EXPORT_ENTRY
typedef struct _PH_MAPPED_IMAGE_EXPORT_FUNCTION PH_MAPPED_IMAGE_EXPORT_FUNCTION
typedef struct _PH_MAPPED_IMAGE_EXPORTS PH_MAPPED_IMAGE_EXPORTS
typedef struct _PH_MAPPED_IMAGE_IMPORT_DLL PH_MAPPED_IMAGE_IMPORT_DLL
typedef struct _PH_MAPPED_IMAGE_IMPORT_ENTRY PH_MAPPED_IMAGE_IMPORT_ENTRY
typedef struct _PH_MAPPED_IMAGE_IMPORTS PH_MAPPED_IMAGE_IMPORTS
typedef struct _PH_MODULE_INFO PH_MODULE_INFO
typedef enum _PH_PEB_OFFSET PH_PEB_OFFSET

Specifies a PEB string.

typedef struct _PH_PROCESS_WS_COUNTERS PH_PROCESS_WS_COUNTERS
typedef struct _PH_PROVIDER_REGISTRATION PH_PROVIDER_REGISTRATION
typedef struct _PH_PROVIDER_THREAD PH_PROVIDER_THREAD
typedef enum _PH_PROVIDER_THREAD_STATE PH_PROVIDER_THREAD_STATE
typedef struct _PH_RECTANGLE PH_RECTANGLE
typedef struct _PH_REMOTE_MAPPED_IMAGE PH_REMOTE_MAPPED_IMAGE
typedef enum _PH_SEEK_ORIGIN PH_SEEK_ORIGIN
typedef BOOLEAN(NTAPI * PPH_COMMAND_LINE_CALLBACK)(_In_opt_ PPH_COMMAND_LINE_OPTION Option, _In_opt_ PPH_STRING Value, _In_opt_ PVOID Context)

Definition at line 3170 of file ph.h.

typedef struct _PH_COMMAND_LINE_OPTION * PPH_COMMAND_LINE_OPTION
typedef enum _PH_COMMAND_LINE_OPTION_TYPE * PPH_COMMAND_LINE_OPTION_TYPE
typedef struct _PH_CREATE_PROCESS_AS_USER_INFO * PPH_CREATE_PROCESS_AS_USER_INFO
typedef struct _PH_CREATE_PROCESS_INFO * PPH_CREATE_PROCESS_INFO
typedef BOOLEAN(NTAPI * PPH_ENUM_DIRECTORY_FILE)(_In_ PFILE_DIRECTORY_INFORMATION Information, _In_opt_ PVOID Context)

Definition at line 891 of file ph.h.

typedef BOOLEAN(NTAPI * PPH_ENUM_DIRECTORY_OBJECTS)(_In_ PPH_STRINGREF Name, _In_ PPH_STRINGREF TypeName, _In_opt_ PVOID Context)

A callback function passed to PhEnumDirectoryObjects() and called for each directory object.

Parameters
NameThe name of the object.
TypeNameThe name of the object's type.
ContextA user-defined value passed to PhEnumDirectoryObjects().
Returns
TRUE to continue the enumeration, FALSE to stop.

Definition at line 876 of file ph.h.

typedef BOOLEAN(NTAPI * PPH_ENUM_GENERIC_MODULES_CALLBACK)(_In_ PPH_MODULE_INFO Module, _In_opt_ PVOID Context)

A callback function passed to PhEnumGenericModules() and called for each process module.

Parameters
ModuleA structure providing information about the module.
ContextA user-defined value passed to PhEnumGenericModules().
Returns
TRUE to continue the enumeration, FALSE to stop.

Definition at line 991 of file ph.h.

typedef BOOLEAN(NTAPI * PPH_ENUM_PROCESS_MODULES_CALLBACK)(_In_ PLDR_DATA_TABLE_ENTRY Module, _In_opt_ PVOID Context)

A callback function passed to PhEnumProcessModules() and called for each process module.

Parameters
ModuleA structure providing information about the module.
ContextA user-defined value passed to PhEnumProcessModules().
Returns
TRUE to continue the enumeration, FALSE to stop.

Definition at line 628 of file ph.h.

typedef struct _PH_ENUM_PROCESS_MODULES_PARAMETERS * PPH_ENUM_PROCESS_MODULES_PARAMETERS
typedef struct _PH_ENVIRONMENT_VARIABLE * PPH_ENVIRONMENT_VARIABLE
typedef struct _PH_FILE_STREAM * PPH_FILE_STREAM
typedef struct _PH_FILETYPE_FILTER * PPH_FILETYPE_FILTER
typedef struct _PH_FLAG_MAPPING * PPH_FLAG_MAPPING
typedef PPH_STRING(NTAPI * PPH_GET_CLIENT_ID_NAME)(_In_ PCLIENT_ID ClientId)

Definition at line 1126 of file ph.h.

typedef NTSTATUS(NTAPI * PPH_GET_OBJECT_SECURITY)(_Out_ PSECURITY_DESCRIPTOR *SecurityDescriptor, _In_ SECURITY_INFORMATION SecurityInformation, _In_opt_ PVOID Context)

Definition at line 31 of file ph.h.

typedef struct _PH_HASH_CONTEXT * PPH_HASH_CONTEXT
typedef struct _PH_IMAGE_VERSION_INFO * PPH_IMAGE_VERSION_INFO
typedef struct _PH_INTEGER_PAIR * PPH_INTEGER_PAIR
typedef struct _PH_MAPPED_ARCHIVE * PPH_MAPPED_ARCHIVE

Definition at line 1535 of file ph.h.

typedef struct _PH_MAPPED_ARCHIVE_IMPORT_ENTRY * PPH_MAPPED_ARCHIVE_IMPORT_ENTRY
typedef struct _PH_MAPPED_ARCHIVE_MEMBER * PPH_MAPPED_ARCHIVE_MEMBER
typedef struct _PH_MAPPED_IMAGE * PPH_MAPPED_IMAGE
typedef struct _PH_MAPPED_IMAGE_EXPORT_ENTRY * PPH_MAPPED_IMAGE_EXPORT_ENTRY
typedef struct _PH_MAPPED_IMAGE_EXPORT_FUNCTION * PPH_MAPPED_IMAGE_EXPORT_FUNCTION
typedef struct _PH_MAPPED_IMAGE_EXPORTS * PPH_MAPPED_IMAGE_EXPORTS
typedef struct _PH_MAPPED_IMAGE_IMPORT_DLL * PPH_MAPPED_IMAGE_IMPORT_DLL
typedef struct _PH_MAPPED_IMAGE_IMPORT_ENTRY * PPH_MAPPED_IMAGE_IMPORT_ENTRY
typedef struct _PH_MAPPED_IMAGE_IMPORTS * PPH_MAPPED_IMAGE_IMPORTS
typedef struct _PH_MODULE_INFO * PPH_MODULE_INFO
typedef NTSTATUS(NTAPI * PPH_OPEN_OBJECT)(_Out_ PHANDLE Handle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ PVOID Context)

Definition at line 25 of file ph.h.

typedef struct _PH_PROCESS_WS_COUNTERS * PPH_PROCESS_WS_COUNTERS
typedef VOID(NTAPI * PPH_PROVIDER_FUNCTION)(_In_ PVOID Object)

Definition at line 1941 of file ph.h.

typedef struct _PH_PROVIDER_REGISTRATION * PPH_PROVIDER_REGISTRATION
typedef struct _PH_PROVIDER_THREAD * PPH_PROVIDER_THREAD

Definition at line 1946 of file ph.h.

typedef struct _PH_RECTANGLE * PPH_RECTANGLE
typedef struct _PH_REMOTE_MAPPED_IMAGE * PPH_REMOTE_MAPPED_IMAGE
typedef NTSTATUS(NTAPI * PPH_SET_OBJECT_SECURITY)(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_ SECURITY_INFORMATION SecurityInformation, _In_opt_ PVOID Context)

Definition at line 37 of file ph.h.

Enumeration Type Documentation

enum _PH_COMMAND_LINE_OPTION_TYPE
Enumerator:
NoArgumentType 
MandatoryArgumentType 
OptionalArgumentType 

Definition at line 3156 of file ph.h.

enum _PH_HASH_ALGORITHM
Enumerator:
Md5HashAlgorithm 
Sha1HashAlgorithm 
Crc32HashAlgorithm 

Definition at line 3116 of file ph.h.

enum _PH_MAPPED_ARCHIVE_MEMBER_TYPE
Enumerator:
NormalArchiveMemberType 
LinkerArchiveMemberType 
LongnamesArchiveMemberType 

Definition at line 1537 of file ph.h.

enum _PH_PEB_OFFSET

Specifies a PEB string.

Enumerator:
PhpoCurrentDirectory 
PhpoDllPath 
PhpoImagePathName 
PhpoCommandLine 
PhpoWindowTitle 
PhpoDesktopInfo 
PhpoShellInfo 
PhpoRuntimeData 
PhpoTypeMask 
PhpoWow64 

Definition at line 208 of file ph.h.

enum _PH_PROVIDER_THREAD_STATE
Enumerator:
ProviderThreadRunning 
ProviderThreadStopped 
ProviderThreadStopping 

Definition at line 1934 of file ph.h.

enum _PH_SEEK_ORIGIN
Enumerator:
SeekStart 
SeekCurrent 
SeekEnd 

Definition at line 1770 of file ph.h.

Function Documentation

PHLIBAPI VOID NTAPI PhAdjustRectangleToBounds ( _Inout_ PPH_RECTANGLE  Rectangle,
_In_ PPH_RECTANGLE  Bounds 
)

Ensures a rectangle is positioned within the specified bounds.

Parameters
RectangleThe rectangle to be adjusted.
BoundsThe bounds.
Remarks
If the rectangle is too large to fit inside the bounds, it is positioned at the top-left of the bounds.

Definition at line 65 of file support.c.

PHLIBAPI VOID NTAPI PhAdjustRectangleToWorkingArea ( _In_ HWND  hWnd,
_Inout_ PPH_RECTANGLE  Rectangle 
)

Ensures a rectangle is positioned within the working area of the specified window's monitor.

Parameters
hWndA handle to a window.
RectangleThe rectangle to be adjusted.

Definition at line 104 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhBoostProvider ( _Inout_ PPH_PROVIDER_REGISTRATION  Registration,
_Out_opt_ PULONG  FutureRunId 
)

Causes a provider to be queued for immediate execution.

Parameters
RegistrationA pointer to the registration object for a provider.
FutureRunIdA variable which receives the run ID of the future run.
Returns
TRUE if the operation was successful; FALSE if the provider is being unregistered, the provider is already being boosted, or the provider thread is not running.
Remarks
Boosted providers will be run immediately, ignoring the run interval. Boosting will not however affect the normal runs.

Definition at line 410 of file provider.c.

NTSTATUS NTAPI PhCallKphDuplicateObjectWithTimeout ( _In_ HANDLE  SourceProcessHandle,
_In_ HANDLE  SourceHandle,
_In_opt_ HANDLE  TargetProcessHandle,
_Out_opt_ PHANDLE  TargetHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ ULONG  HandleAttributes,
_In_ ULONG  Options 
)

Definition at line 1801 of file hndlinfo.c.

NTSTATUS NTAPI PhCallNtQueryObjectWithTimeout ( _In_ HANDLE  Handle,
_In_ OBJECT_INFORMATION_CLASS  ObjectInformationClass,
_Out_writes_bytes_opt_(ObjectInformationLength) PVOID  ObjectInformation,
_In_ ULONG  ObjectInformationLength,
_Out_opt_ PULONG  ReturnLength 
)

Definition at line 1739 of file hndlinfo.c.

NTSTATUS NTAPI PhCallNtQuerySecurityObjectWithTimeout ( _In_ HANDLE  Handle,
_In_ SECURITY_INFORMATION  SecurityInformation,
_Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR  SecurityDescriptor,
_In_ ULONG  Length,
_Out_ PULONG  LengthNeeded 
)

Definition at line 1761 of file hndlinfo.c.

NTSTATUS NTAPI PhCallNtSetSecurityObjectWithTimeout ( _In_ HANDLE  Handle,
_In_ SECURITY_INFORMATION  SecurityInformation,
_In_ PSECURITY_DESCRIPTOR  SecurityDescriptor 
)

Definition at line 1783 of file hndlinfo.c.

NTSTATUS NTAPI PhCallWithTimeout ( _In_ PUSER_THREAD_START_ROUTINE  Routine,
_In_opt_ PVOID  Context,
_In_opt_ PLARGE_INTEGER  AcquireTimeout,
_In_ PLARGE_INTEGER  CallTimeout 
)

Definition at line 1646 of file hndlinfo.c.

PHLIBAPI VOID NTAPI PhCenterRectangle ( _Inout_ PPH_RECTANGLE  Rectangle,
_In_ PPH_RECTANGLE  Bounds 
)

Positions a rectangle in the center of the specified bounds.

Parameters
RectangleThe rectangle to be adjusted.
BoundsThe bounds.

Definition at line 88 of file support.c.

PHLIBAPI VOID NTAPI PhCenterWindow ( _In_ HWND  WindowHandle,
_In_opt_ HWND  ParentWindowHandle 
)

Centers a window.

Parameters
WindowHandleThe window to center.
ParentWindowHandleIf specified, the window will be positioned at the center of this window. Otherwise, the window will be positioned at the center of the monitor.

Definition at line 131 of file support.c.

USHORT NTAPI PhCheckSum ( _In_ ULONG  Sum,
_In_reads_(Count) PUSHORT  Buffer,
_In_ ULONG  Count 
)

Definition at line 1179 of file mapimg.c.

PHLIBAPI ULONG NTAPI PhCheckSumMappedImage ( _In_ PPH_MAPPED_IMAGE  MappedImage)

Definition at line 1196 of file mapimg.c.

PHLIBAPI LONG NTAPI PhCompareUnicodeStringZIgnoreMenuPrefix ( _In_ PWSTR  A,
_In_ PWSTR  B,
_In_ BOOLEAN  IgnoreCase,
_In_ BOOLEAN  MatchIfPrefix 
)

Compares two strings, ignoring prefix characters (ampersands).

Parameters
AThe first string.
BThe second string.
IgnoreCaseWhether to ignore character cases.
MatchIfPrefixSpecify TRUE to return 0 when A is a prefix of B.

Definition at line 1064 of file support.c.

FORCEINLINE VOID PhConvertRect ( _Inout_ PRECT  Rect,
_In_ PRECT  ParentRect 
)

Definition at line 2258 of file ph.h.

ULONG NTAPI PhCrc32 ( _In_ ULONG  Crc,
_In_reads_(Length) PCHAR  Buffer,
_In_ SIZE_T  Length 
)

Definition at line 4389 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhCreateFileStream ( _Out_ PPH_FILE_STREAM *  FileStream,
_In_ PWSTR  FileName,
_In_ ACCESS_MASK  DesiredAccess,
_In_ ULONG  ShareMode,
_In_ ULONG  CreateDisposition,
_In_ ULONG  Flags 
)

Definition at line 506 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhCreateFileStream2 ( _Out_ PPH_FILE_STREAM *  FileStream,
_In_ HANDLE  FileHandle,
_In_ ULONG  Flags,
_In_ ULONG  BufferLength 
)

Definition at line 569 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhCreateFileWin32 ( _Out_ PHANDLE  FileHandle,
_In_ PWSTR  FileName,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ ULONG  FileAttributes,
_In_ ULONG  ShareAccess,
_In_ ULONG  CreateDisposition,
_In_ ULONG  CreateOptions 
)

Creates or opens a file.

Parameters
FileHandleA variable that receives the file handle.
FileNameThe Win32 file name.
DesiredAccessThe desired access to the file.
FileAttributesFile attributes applied if the file is created or overwritten.
ShareAccessThe file access granted to other threads.
  • FILE_SHARE_READ Allows other threads to read from the file.
  • FILE_SHARE_WRITE Allows other threads to write to the file.
  • FILE_SHARE_DELETE Allows other threads to delete the file.
CreateDispositionThe action to perform if the file does or does not exist.
  • FILE_SUPERSEDE If the file exists, replace it. Otherwise, create the file.
  • FILE_CREATE If the file exists, fail. Otherwise, create the file.
  • FILE_OPEN If the file exists, open it. Otherwise, fail.
  • FILE_OPEN_IF If the file exists, open it. Otherwise, create the file.
  • FILE_OVERWRITE If the file exists, open and overwrite it. Otherwise, fail.
  • FILE_OVERWRITE_IF If the file exists, open and overwrite it. Otherwise, create the file.
CreateOptionsThe options to apply when the file is opened or created.

Definition at line 65 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhCreateFileWin32Ex ( _Out_ PHANDLE  FileHandle,
_In_ PWSTR  FileName,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ ULONG  FileAttributes,
_In_ ULONG  ShareAccess,
_In_ ULONG  CreateDisposition,
_In_ ULONG  CreateOptions,
_Out_opt_ PULONG  CreateStatus 
)

Creates or opens a file.

Parameters
FileHandleA variable that receives the file handle.
FileNameThe Win32 file name.
DesiredAccessThe desired access to the file.
FileAttributesFile attributes applied if the file is created or overwritten.
ShareAccessThe file access granted to other threads.
  • FILE_SHARE_READ Allows other threads to read from the file.
  • FILE_SHARE_WRITE Allows other threads to write to the file.
  • FILE_SHARE_DELETE Allows other threads to delete the file.
CreateDispositionThe action to perform if the file does or does not exist.
  • FILE_SUPERSEDE If the file exists, replace it. Otherwise, create the file.
  • FILE_CREATE If the file exists, fail. Otherwise, create the file.
  • FILE_OPEN If the file exists, open it. Otherwise, fail.
  • FILE_OPEN_IF If the file exists, open it. Otherwise, create the file.
  • FILE_OVERWRITE If the file exists, open and overwrite it. Otherwise, fail.
  • FILE_OVERWRITE_IF If the file exists, open and overwrite it. Otherwise, create the file.
CreateOptionsThe options to apply when the file is opened or created.
CreateStatusA variable that receives creation information.
  • FILE_SUPERSEDED The file was replaced because FILE_SUPERSEDE was specified in CreateDisposition.
  • FILE_OPENED The file was opened because FILE_OPEN or FILE_OPEN_IF was specified in CreateDisposition.
  • FILE_CREATED The file was created because FILE_CREATE or FILE_OPEN_IF was specified in CreateDisposition.
  • FILE_OVERWRITTEN The file was overwritten because FILE_OVERWRITE or FILE_OVERWRITE_IF was specified in CreateDisposition.
  • FILE_EXISTS The file was not opened because it already existed and FILE_CREATE was specified in CreateDisposition.
  • FILE_DOES_NOT_EXIST The file was not opened because it did not exist and FILE_OPEN or FILE_OVERWRITE was specified in CreateDisposition.

Definition at line 122 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhCreateKey ( _Out_ PHANDLE  KeyHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ HANDLE  RootDirectory,
_In_ PPH_STRINGREF  ObjectName,
_In_ ULONG  Attributes,
_In_ ULONG  CreateOptions,
_Out_opt_ PULONG  Disposition 
)

Creates or opens a registry key.

Parameters
KeyHandleA variable which receives a handle to the key.
DesiredAccessThe desired access to the key.
RootDirectoryA handle to a root key, or one of the following predefined keys:
  • PH_KEY_LOCAL_MACHINE Represents \Registry\Machine.
  • PH_KEY_USERS Represents \Registry\User.
  • PH_KEY_CLASSES_ROOT Represents \Registry\Machine\Software\Classes.
  • PH_KEY_CURRENT_USER Represents \Registry\User\[SID of current user].
ObjectNameThe path to the key.
AttributesAdditional object flags.
CreateOptionsThe options to apply when creating or opening the key.
DispositionA variable which receives a value indicating whether a new key was created or an existing key was opened:
  • REG_CREATED_NEW_KEY A new key was created.
  • REG_OPENED_EXISTING_KEY An existing key was opened.

Definition at line 6289 of file native.c.

PHLIBAPI PVOID NTAPI PhCreateOpenFileDialog ( VOID  )

Creates a file dialog for the user to select a file to open.

Returns
An opaque pointer representing the file dialog. You must free the file dialog using PhFreeFileDialog() when you no longer need it.

Definition at line 3742 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhCreateProcess ( _In_ PWSTR  FileName,
_In_opt_ PPH_STRINGREF  CommandLine,
_In_opt_ PVOID  Environment,
_In_opt_ PPH_STRINGREF  CurrentDirectory,
_In_opt_ PPH_CREATE_PROCESS_INFO  Information,
_In_ ULONG  Flags,
_In_opt_ HANDLE  ParentProcessHandle,
_Out_opt_ PCLIENT_ID  ClientId,
_Out_opt_ PHANDLE  ProcessHandle,
_Out_opt_ PHANDLE  ThreadHandle 
)

Creates a native process and an initial thread.

Parameters
FileNameThe Win32 file name of the image.
CommandLineThe command line string to pass to the process. This string cannot be used to specify the image to execute.
EnvironmentThe environment block for the process. Specify NULL to use the environment of the current process.
CurrentDirectoryThe current directory string to pass to the process.
InformationAdditional parameters to pass to the process.
FlagsA combination of the following:
  • PH_CREATE_PROCESS_INHERIT_HANDLES Inheritable handles will be duplicated to the process from the parent process.
  • PH_CREATE_PROCESS_SUSPENDED The initial thread will be created suspended.
  • PH_CREATE_PROCESS_BREAKAWAY_FROM_JOB The process will not be assigned to the job object associated with the parent process.
  • PH_CREATE_PROCESS_NEW_CONSOLE The process will have its own console, instead of inheriting the console of the parent process.
ParentProcessHandleThe process from which the new process will inherit attributes. Specify NULL for the current process.
ClientIdA variable which recieves the identifier of the initial thread.
ProcessHandleA variable which receives a handle to the process.
ThreadHandleA variable which receives a handle to the initial thread.

Definition at line 2312 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhCreateProcessAsUser ( _In_ PPH_CREATE_PROCESS_AS_USER_INFO  Information,
_In_ ULONG  Flags,
_Out_opt_ PCLIENT_ID  ClientId,
_Out_opt_ PHANDLE  ProcessHandle,
_Out_opt_ PHANDLE  ThreadHandle 
)

Creates a Win32 process and an initial thread under the specified user.

Parameters
InformationParameters specifying how to create the process.
FlagsSee PhCreateProcess(). Additional flags may be used:
  • PH_CREATE_PROCESS_USE_PROCESS_TOKEN Use the token of the process specified by ProcessIdWithToken in Information.
  • PH_CREATE_PROCESS_USE_SESSION_TOKEN Use the token of the session specified by SessionIdWithToken in Information.
  • PH_CREATE_PROCESS_USE_LINKED_TOKEN Use the linked token to create the process; this causes the process to be elevated or unelevated depending on the specified options.
  • PH_CREATE_PROCESS_SET_SESSION_ID SessionId is specified in Information.
  • PH_CREATE_PROCESS_WITH_PROFILE Load the user profile, if supported.
ClientIdA variable which recieves the identifier of the initial thread.
ProcessHandleA variable which receives a handle to the process.
ThreadHandleA variable which receives a handle to the initial thread.

Definition at line 2622 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhCreateProcessWin32 ( _In_opt_ PWSTR  FileName,
_In_opt_ PWSTR  CommandLine,
_In_opt_ PVOID  Environment,
_In_opt_ PWSTR  CurrentDirectory,
_In_ ULONG  Flags,
_In_opt_ HANDLE  TokenHandle,
_Out_opt_ PHANDLE  ProcessHandle,
_Out_opt_ PHANDLE  ThreadHandle 
)

Creates a Win32 process and an initial thread.

Parameters
FileNameThe Win32 file name of the image.
CommandLineThe command line to execute. This can be specified instead of FileName to indicate the image to execute.
EnvironmentThe environment block for the process. Specify NULL to use the environment of the current process.
CurrentDirectoryThe current directory string to pass to the process.
FlagsSee PhCreateProcess().
TokenHandleThe token of the process. Specify NULL for the token of the parent process.
ProcessHandleA variable which receives a handle to the process.
ThreadHandleA variable which receives a handle to the initial thread.

Definition at line 2441 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhCreateProcessWin32Ex ( _In_opt_ PWSTR  FileName,
_In_opt_ PWSTR  CommandLine,
_In_opt_ PVOID  Environment,
_In_opt_ PWSTR  CurrentDirectory,
_In_opt_ STARTUPINFO *  StartupInfo,
_In_ ULONG  Flags,
_In_opt_ HANDLE  TokenHandle,
_Out_opt_ PCLIENT_ID  ClientId,
_Out_opt_ PHANDLE  ProcessHandle,
_Out_opt_ PHANDLE  ThreadHandle 
)

Creates a Win32 process and an initial thread.

Parameters
FileNameThe Win32 file name of the image.
CommandLineThe command line to execute. This can be specified instead of FileName to indicate the image to execute.
EnvironmentThe environment block for the process. Specify NULL to use the environment of the current process.
CurrentDirectoryThe current directory string to pass to the process.
StartupInfoA STARTUPINFO structure containing additional parameters for the process.
FlagsSee PhCreateProcess().
TokenHandleThe token of the process. Specify NULL for the token of the parent process.
ClientIdA variable which recieves the identifier of the initial thread.
ProcessHandleA variable which receives a handle to the process.
ThreadHandleA variable which receives a handle to the initial thread.

Definition at line 2518 of file support.c.

PHLIBAPI PVOID NTAPI PhCreateSaveFileDialog ( VOID  )

Creates a file dialog for the user to select a file to save to.

Returns
An opaque pointer representing the file dialog. You must free the file dialog using PhFreeFileDialog() when you no longer need it.

Definition at line 3781 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhDeleteFileWin32 ( _In_ PWSTR  FileName)

Deletes a file.

Parameters
FileNameThe Win32 file name.

Definition at line 227 of file iosup.c.

PHLIBAPI VOID NTAPI PhDeleteImageVersionInfo ( _Inout_ PPH_IMAGE_VERSION_INFO  ImageVersionInfo)

Frees a version information structure initialized by PhInitializeImageVersionInfo().

Parameters
ImageVersionInfoThe version information structure.

Definition at line 1684 of file support.c.

PHLIBAPI VOID NTAPI PhDeleteProviderThread ( _Inout_ PPH_PROVIDER_THREAD  ProviderThread)

Frees resources used by a provider thread.

Parameters
ProviderThreadA pointer to a provider thread object.

Definition at line 87 of file provider.c.

PHLIBAPI VOID NTAPI PhDereferenceObjects ( _In_reads_(NumberOfObjects) PVOID *  Objects,
_In_ ULONG  NumberOfObjects 
)

Dereferences an array of objects.

Parameters
ObjectsAn array of objects.
NumberOfObjectsThe number of elements in Objects.

Definition at line 198 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhDisconnectNamedPipe ( _In_ HANDLE  FileHandle)

Definition at line 274 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhDuplicateObject ( _In_ HANDLE  SourceProcessHandle,
_In_ HANDLE  SourceHandle,
_In_opt_ HANDLE  TargetProcessHandle,
_Out_opt_ PHANDLE  TargetHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ ULONG  HandleAttributes,
_In_ ULONG  Options 
)

Duplicates a handle.

Parameters
SourceProcessHandleA handle to the source process. The handle must have PROCESS_DUP_HANDLE access.
SourceHandleThe handle to duplicate from the source process.
TargetProcessHandleA handle to the target process. If DUPLICATE_CLOSE_SOURCE is specified in the Options parameter, this parameter can be NULL.
TargetHandleA variable which receives the new handle in the target process. If DUPLICATE_CLOSE_SOURCE is specified in the Options parameter, this parameter can be NULL.
DesiredAccessThe desired access to the object referenced by the source handle.
HandleAttributesThe attributes to apply to the new handle.
OptionsThe options to use when duplicating the handle.

Definition at line 3309 of file native.c.

PHLIBAPI PPH_STRING NTAPI PhEllipsisString ( _In_ PPH_STRING  String,
_In_ ULONG  DesiredCount 
)

Modifies a string to ensure it is within the specified length.

Parameters
StringThe input string.
DesiredCountThe desired number of characters in the new string. If necessary, parts of the string are replaced with an ellipsis to indicate characters have been omitted.
Returns
The new string.

Definition at line 817 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhEllipsisStringPath ( _In_ PPH_STRING  String,
_In_ ULONG  DesiredCount 
)

Modifies a string to ensure it is within the specified length, parsing the string as a path.

Parameters
StringThe input string.
DesiredCountThe desired number of characters in the new string. If necessary, parts of the string are replaced with an ellipsis to indicate characters have been omitted.
Returns
The new string.

Definition at line 852 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhEnumDirectoryFile ( _In_ HANDLE  FileHandle,
_In_opt_ PUNICODE_STRING  SearchPattern,
_In_ PPH_ENUM_DIRECTORY_FILE  Callback,
_In_opt_ PVOID  Context 
)

Definition at line 5124 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumDirectoryObjects ( _In_ HANDLE  DirectoryHandle,
_In_ PPH_ENUM_DIRECTORY_OBJECTS  Callback,
_In_opt_ PVOID  Context 
)

Enumerates the objects in a directory object.

Parameters
DirectoryHandleA handle to a directory. The handle must have DIRECTORY_QUERY access.
CallbackA callback function which is executed for each object.
ContextA user-defined value to pass to the callback function.

Definition at line 5028 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumFileStreams ( _In_ HANDLE  FileHandle,
_Out_ PVOID *  Streams 
)

Definition at line 5231 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumGenericModules ( _In_ HANDLE  ProcessId,
_In_opt_ HANDLE  ProcessHandle,
_In_ ULONG  Flags,
_In_ PPH_ENUM_GENERIC_MODULES_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Enumerates the modules loaded by a process.

Parameters
ProcessIdThe ID of a process. If SYSTEM_PROCESS_ID is specified the function enumerates the kernel modules.
ProcessHandleA handle to the process.
FlagsFlags controlling the information to retrieve.
  • PH_ENUM_GENERIC_MAPPED_FILES Enumerate mapped files.
  • PH_ENUM_GENERIC_MAPPED_IMAGES Enumerate mapped images (those which are not mapped by the loader).
CallbackA callback function which is executed for each module.
ContextA user-defined value to pass to the callback function.

Definition at line 6006 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumHandles ( _Out_ PSYSTEM_HANDLE_INFORMATION *  Handles)

Enumerates all open handles.

Parameters
HandlesA variable which receives a pointer to a structure containing information about all opened handles. You must free the structure using PhFree() when you no longer need it.
Return values
STATUS_INSUFFICIENT_RESOURCESThe handle information returned by the kernel is too large.

Definition at line 4540 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumHandlesEx ( _Out_ PSYSTEM_HANDLE_INFORMATION_EX *  Handles)

Enumerates all open handles.

Parameters
HandlesA variable which receives a pointer to a structure containing information about all opened handles. You must free the structure using PhFree() when you no longer need it.
Return values
STATUS_INSUFFICIENT_RESOURCESThe handle information returned by the kernel is too large.
Remarks
This function is only available starting with Windows XP.

Definition at line 4596 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumKernelModules ( _Out_ PRTL_PROCESS_MODULES *  Modules)

Enumerates the modules loaded by the kernel.

Parameters
ModulesA variable which receives a pointer to a structure containing information about the kernel modules. You must free the structure using PhFree() when you no longer need it.

Definition at line 4197 of file native.c.

NTSTATUS NTAPI PhEnumKernelModulesEx ( _Out_ PRTL_PROCESS_MODULE_INFORMATION_EX *  Modules)

Enumerates the modules loaded by the kernel.

Parameters
ModulesA variable which receives a pointer to a structure containing information about the kernel modules. You must free the structure using PhFree() when you no longer need it.

Definition at line 4243 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumObjectTypes ( _Out_ POBJECT_TYPES_INFORMATION *  ObjectTypes)

Definition at line 1415 of file hndlinfo.c.

PHLIBAPI NTSTATUS NTAPI PhEnumPagefiles ( _Out_ PVOID *  Pagefiles)

Enumerates all pagefiles.

Parameters
PagefilesA variable which receives a pointer to a buffer containing information about all active pagefiles. You must free the structure using PhFree() when you no longer need it.
Return values
STATUS_INSUFFICIENT_RESOURCESThe handle information returned by the kernel is too large.

Definition at line 4649 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhEnumProcessEnvironmentVariables ( _In_ PVOID  Environment,
_In_ ULONG  EnvironmentLength,
_Inout_ PULONG  EnumerationKey,
_Out_ PPH_ENVIRONMENT_VARIABLE  Variable 
)

Definition at line 1353 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcesses ( _Out_ PVOID *  Processes)

Enumerates the running processes.

Parameters
ProcessesA variable which receives a pointer to a buffer containing process information. You must free the buffer using PhFree() when you no longer need it.
Remarks
You can use the PH_FIRST_PROCESS and PH_NEXT_PROCESS macros to process the information contained in the buffer.

Definition at line 4321 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcessesEx ( _Out_ PVOID *  Processes,
_In_ SYSTEM_INFORMATION_CLASS  SystemInformationClass 
)

Enumerates the running processes.

Parameters
ProcessesA variable which receives a pointer to a buffer containing process information. You must free the buffer using PhFree() when you no longer need it.
Remarks
You can use the PH_FIRST_PROCESS and PH_NEXT_PROCESS macros to process the information contained in the buffer.

Definition at line 4340 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcessesForSession ( _Out_ PVOID *  Processes,
_In_ ULONG  SessionId 
)

Enumerates the running processes for a session.

Parameters
ProcessesA variable which receives a pointer to a buffer containing process information. You must free the buffer using PhFree() when you no longer need it.
SessionIdA session ID.
Remarks
You can use the PH_FIRST_PROCESS and PH_NEXT_PROCESS macros to process the information contained in the buffer.

Definition at line 4414 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcessModules ( _In_ HANDLE  ProcessHandle,
_In_ PPH_ENUM_PROCESS_MODULES_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Enumerates the modules loaded by a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
CallbackA callback function which is executed for each process module.
ContextA user-defined value to pass to the callback function.

Definition at line 3589 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcessModules32 ( _In_ HANDLE  ProcessHandle,
_In_ PPH_ENUM_PROCESS_MODULES_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Enumerates the 32-bit modules loaded by a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
CallbackA callback function which is executed for each process module.
ContextA user-defined value to pass to the callback function.
Return values
STATUS_NOT_SUPPORTEDThe process is not running under WOW64.
Remarks
Do not use this function under a 32-bit environment.

Definition at line 3973 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcessModules32Ex ( _In_ HANDLE  ProcessHandle,
_In_ PPH_ENUM_PROCESS_MODULES_PARAMETERS  Parameters 
)

Enumerates the 32-bit modules loaded by a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access. If PH_ENUM_PROCESS_MODULES_TRY_MAPPED_FILE_NAME is specified in Parameters, the handle should have PROCESS_QUERY_INFORMATION access.
ParametersThe enumeration parameters.
Return values
STATUS_NOT_SUPPORTEDThe process is not running under WOW64.
Remarks
Do not use this function under a 32-bit environment.

Definition at line 4004 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhEnumProcessModulesEx ( _In_ HANDLE  ProcessHandle,
_In_ PPH_ENUM_PROCESS_MODULES_PARAMETERS  Parameters 
)

Enumerates the modules loaded by a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access. If PH_ENUM_PROCESS_MODULES_TRY_MAPPED_FILE_NAME is specified in Parameters, the handle should have PROCESS_QUERY_INFORMATION access.
ParametersThe enumeration parameters.

Definition at line 3614 of file native.c.

PHLIBAPI PVOID NTAPI PhEnumServices ( _In_ SC_HANDLE  ScManagerHandle,
_In_opt_ ULONG  Type,
_In_opt_ ULONG  State,
_Out_ PULONG  Count 
)

Definition at line 72 of file svcsup.c.

PHLIBAPI PPH_STRING NTAPI PhEscapeCommandLinePart ( _In_ PPH_STRINGREF  String)

Escapes a string for use in a command line.

Parameters
StringThe string to escape.
Returns
The escaped string.
Remarks
Only the double quotation mark is escaped.

Definition at line 4788 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhEscapeStringForMenuPrefix ( _In_ PPH_STRINGREF  String)

Escapes a string for prefix characters (ampersands).

Parameters
StringThe string to process.
Returns
The escaped string, with each ampersand replaced by 2 ampersands.

Definition at line 1005 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhExpandEnvironmentStrings ( _In_ PPH_STRINGREF  String)

Expands environment variables in a string.

Parameters
StringThe string.

Definition at line 1865 of file support.c.

PPH_STRING NTAPI PhExpandKeyName ( _In_ PPH_STRING  KeyName,
_In_ BOOLEAN  Computer 
)

Expands registry name abbreviations.

Parameters
KeyNameThe key name.
ComputerTRUE to prepend "Computer" or "My Computer" for use with the Registry Editor.

Definition at line 3338 of file support.c.

NTSTATUS NTAPI PhFilterTokenForLimitedUser ( _In_ HANDLE  TokenHandle,
_Out_ PHANDLE  NewTokenHandle 
)

Filters a token to create a limited user security context.

Parameters
TokenHandleA handle to an existing token. The handle must have TOKEN_DUPLICATE, TOKEN_QUERY, TOKEN_ADJUST_GROUPS, TOKEN_ADJUST_DEFAULT, READ_CONTROL and WRITE_DAC access.
NewTokenHandleA variable which receives a handle to the filtered token. The handle will have the same granted access as TokenHandle.

Definition at line 2976 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhFinalHash ( _Inout_ PPH_HASH_CONTEXT  Context,
_Out_writes_bytes_(HashLength) PVOID  Hash,
_In_ ULONG  HashLength,
_Out_opt_ PULONG  ReturnLength 
)

Computes the final hash value.

Parameters
ContextA hashing context structure.
HashA buffer which receives the final hash value.
HashLengthThe size of the buffer, in bytes.
ReturnLengthA variable which receives the required size of the buffer, in bytes.

Definition at line 4477 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhFindIntegerSiKeyValuePairs ( _In_ PPH_KEY_VALUE_PAIR  KeyValuePairs,
_In_ ULONG  SizeOfKeyValuePairs,
_In_ PWSTR  String,
_Out_ PULONG  Integer 
)

Finds an integer in an array of string-integer pairs.

Parameters
KeyValuePairsThe array.
SizeOfKeyValuePairsThe size of the array, in bytes.
StringThe string to search for.
IntegerA variable which receives the found integer.
Returns
TRUE if the string was found, otherwise FALSE.
Remarks
The search is case-sensitive.

Definition at line 608 of file support.c.

PHLIBAPI PLDR_DATA_TABLE_ENTRY NTAPI PhFindLoaderEntry ( _In_opt_ PVOID  DllBase,
_In_opt_ PPH_STRINGREF  FullDllName,
_In_opt_ PPH_STRINGREF  BaseDllName 
)

Locates a loader entry in the current process.

Parameters
DllBaseThe base address of the DLL. Specify NULL if this is not a search criteria.
FullDllNameThe full name of the DLL. Specify NULL if this is not a search criteria.
BaseDllNameThe base name of the DLL. Specify NULL if this is not a search criteria.
Remarks
This function must be called with the loader lock acquired. The first entry matching all of the specified values is returned.

Definition at line 2040 of file support.c.

PHLIBAPI PSYSTEM_PROCESS_INFORMATION NTAPI PhFindProcessInformation ( _In_ PVOID  Processes,
_In_ HANDLE  ProcessId 
)

Finds the process information structure for a specific process.

Parameters
ProcessesA pointer to a buffer returned by PhEnumProcesses().
ProcessIdThe ID of the process.
Returns
A pointer to the process information structure for the specified process, or NULL if the structure could not be found.

Definition at line 4477 of file native.c.

PHLIBAPI PSYSTEM_PROCESS_INFORMATION NTAPI PhFindProcessInformationByImageName ( _In_ PVOID  Processes,
_In_ PPH_STRINGREF  ImageName 
)

Finds the process information structure for a specific process.

Parameters
ProcessesA pointer to a buffer returned by PhEnumProcesses().
ImageNameThe image name to search for.
Returns
A pointer to the process information structure for the specified process, or NULL if the structure could not be found.

Definition at line 4507 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhFindStringSiKeyValuePairs ( _In_ PPH_KEY_VALUE_PAIR  KeyValuePairs,
_In_ ULONG  SizeOfKeyValuePairs,
_In_ ULONG  Integer,
_Out_ PWSTR *  String 
)

Finds a string in an array of string-integer pairs.

Parameters
KeyValuePairsThe array.
SizeOfKeyValuePairsThe size of the array, in bytes.
IntegerThe integer to search for.
StringA variable which receives the found string.
Returns
TRUE if the integer was found, otherwise FALSE.

Definition at line 639 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhFlushFileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ BOOLEAN  Full 
)

Flushes the file stream.

Parameters
FileStreamA file stream object.
FullTRUE to flush the file object through the operating system, otherwise FALSE to only ensure the buffer is flushed to the operating system.

Definition at line 1036 of file iosup.c.

PHLIBAPI PPH_STRING NTAPI PhFormatDate ( _In_opt_ PSYSTEMTIME  Date,
_In_opt_ PWSTR  Format 
)

Formats a date using the user's default locale.

Parameters
DateThe time structure. If NULL, the current time is used.
FormatThe format of the date. If NULL, the format appropriate to the user's locale is used.

Definition at line 1140 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatDateTime ( _In_opt_ PSYSTEMTIME  DateTime)

Formats a date and time using the user's default locale.

Parameters
DateTimeThe time structure. If NULL, the current time is used.
Returns
A string containing the time, a space character, then the date.

Definition at line 1198 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatDecimal ( _In_ PWSTR  Value,
_In_ ULONG  FractionalDigits,
_In_ BOOLEAN  GroupDigits 
)

Definition at line 1373 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatGuid ( _In_ PGUID  Guid)

Converts a UUID to its string representation.

Parameters
GuidA UUID.

Definition at line 1460 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatImageVersionInfo ( _In_opt_ PPH_STRING  FileName,
_In_ PPH_IMAGE_VERSION_INFO  ImageVersionInfo,
_In_opt_ PPH_STRINGREF  Indent,
_In_opt_ ULONG  LineLimit 
)

Definition at line 1694 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatNativeKeyName ( _In_ PPH_STRING  Name)

Definition at line 361 of file hndlinfo.c.

PHLIBAPI PPH_STRING NTAPI PhFormatSize ( _In_ ULONG64  Size,
_In_ ULONG  MaxSizeUnit 
)

Gets a string representing a size.

Parameters
SizeThe size value.
MaxSizeUnitThe largest unit of size to use, -1 to use PhMaxSizeUnit, or -2 for no limit.
  • 0 Bytes.
  • 1 Kilobytes.
  • 2 Megabytes.
  • 3 Gigabytes.
  • 4 Terabytes.
  • 5 Petabytes.
  • 6 Exabytes.

Definition at line 1439 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatTime ( _In_opt_ PSYSTEMTIME  Time,
_In_opt_ PWSTR  Format 
)

Formats a time using the user's default locale.

Parameters
TimeThe time structure. If NULL, the current time is used.
FormatThe format of the time. If NULL, the format appropriate to the user's locale is used.

Definition at line 1169 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatTimeSpanRelative ( _In_ ULONG64  TimeSpan)

Formats a relative time span.

Parameters
TimeSpanThe time span, in ticks.

Definition at line 1237 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhFormatUInt64 ( _In_ ULONG64  Value,
_In_ BOOLEAN  GroupDigits 
)

Formats a 64-bit unsigned integer.

Parameters
ValueThe integer.
GroupDigitsTRUE to group digits, otherwise FALSE.

Definition at line 1360 of file support.c.

PHLIBAPI VOID NTAPI PhFreeFileDialog ( _In_ PVOID  FileDialog)

Frees a file dialog.

Parameters
FileDialogThe file dialog.

Definition at line 3817 of file support.c.

PHLIBAPI VOID NTAPI PhGenerateGuid ( _Out_ PGUID  Guid)

Creates a random (type 4) UUID.

Parameters
GuidThe destination UUID.

Definition at line 665 of file support.c.

PHLIBAPI VOID NTAPI PhGenerateGuidFromName ( _Out_ PGUID  Guid,
_In_ PGUID  Namespace,
_In_ PCHAR  Name,
_In_ ULONG  NameLength,
_In_ UCHAR  Version 
)

Creates a name-based (type 3 or 5) UUID.

Parameters
GuidThe destination UUID.
NamespaceThe UUID of the namespace.
NameThe input name.
NameLengthThe length of the input name, not including the null terminator if present.
VersionThe type of UUID.
  • GUID_VERSION_MD5 Creates a type 3, MD5-based UUID.
  • GUID_VERSION_SHA1 Creates a type 5, SHA1-based UUID.

Definition at line 723 of file support.c.

PHLIBAPI VOID NTAPI PhGenerateRandomAlphaString ( _Out_writes_z_(Count) PWSTR  Buffer,
_In_ ULONG  Count 
)

Fills a buffer with random uppercase alphabetical characters.

Parameters
BufferThe buffer to fill with random characters, plus a null terminator.
CountThe number of characters available in the buffer, including space for the null terminator.

Definition at line 788 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetApplicationDirectory ( VOID  )

Retrieves the directory of the current process image.

Definition at line 2144 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetApplicationFileName ( VOID  )

Retrieves the file name of the current process image.

Definition at line 2134 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetBaseName ( _In_ PPH_STRING  FileName)

Gets the base name from a file name.

Parameters
FileNameThe file name.

Definition at line 1924 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetDllFileName ( _In_ PVOID  DllHandle,
_Out_opt_ PULONG  IndexOfFileName 
)

Retrieves the file name of a DLL loaded by the current process.

Parameters
DllHandleThe base address of the DLL.
IndexOfFileNameA variable which receives the index of the base name of the DLL in the returned string.
Returns
The file name of the DLL, or NULL if the DLL could not be found.

Definition at line 2088 of file support.c.

NTSTATUS NTAPI PhGetDriverName ( _In_ HANDLE  DriverHandle,
_Out_ PPH_STRING *  Name 
)

Gets the object name of a driver.

Parameters
DriverHandleA handle to a driver.
NameA variable which receives a pointer to a string containing the object name. You must free the string using PhDereferenceObject() when you no longer need it.
Remarks
This function requires a valid KProcessHacker handle.

Definition at line 3084 of file native.c.

NTSTATUS NTAPI PhGetDriverServiceKeyName ( _In_ HANDLE  DriverHandle,
_Out_ PPH_STRING *  ServiceKeyName 
)

Gets the service key name of a driver.

Parameters
DriverHandleA handle to a driver.
ServiceKeyNameA variable which receives a pointer to a string containing the service key name. You must free the string using PhDereferenceObject() when you no longer need it.
Remarks
This function requires a valid KProcessHacker handle.

Definition at line 3120 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhGetEnabledProvider ( _In_ PPH_PROVIDER_REGISTRATION  Registration)

Gets whether a provider is enabled.

Parameters
RegistrationA pointer to the registration object for a provider.

Definition at line 474 of file provider.c.

PHLIBAPI NTSTATUS NTAPI PhGetEnlistmentBasicInformation ( _In_ HANDLE  EnlistmentHandle,
_Out_ PENLISTMENT_BASIC_INFORMATION  BasicInformation 
)

Definition at line 2865 of file native.c.

PHLIBAPI PPH_STRING NTAPI PhGetFileDialogFileName ( _In_ PVOID  FileDialog)

Gets the file name selected in a file dialog.

Parameters
FileDialogThe file dialog.
Returns
A pointer to a string containing the file name. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 4112 of file support.c.

PHLIBAPI ULONG NTAPI PhGetFileDialogFilterIndex ( _In_ PVOID  FileDialog)

Gets the index of the currently selected file type filter for a file dialog.

Parameters
FileDialogThe file dialog.
Returns
The one-based index of the selected file type, or 0 if an error occurred.

Definition at line 4024 of file support.c.

PHLIBAPI ULONG NTAPI PhGetFileDialogOptions ( _In_ PVOID  FileDialog)

Gets the options for a file dialog.

Parameters
FileDialogThe file dialog.
Returns
The currently enabled options. See the documentation for PhSetFileDialogOptions() for details.

Definition at line 3909 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetFileName ( _In_ PPH_STRING  FileName)

Converts a file name into Win32 format.

Parameters
FileNameA string containing a file name.
Returns
A pointer to a string containing the Win32 file name. You must free the string using PhDereferenceObject() when you no longer need it.
Remarks
This function may convert NT object name paths to invalid ones. If the path to be converted is not necessarily a file name, use PhResolveDevicePrefix().

Definition at line 5547 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetFileSize ( _In_ HANDLE  FileHandle,
_Out_ PLARGE_INTEGER  Size 
)

Definition at line 2516 of file native.c.

PHLIBAPI PVOID NTAPI PhGetFileVersionInfo ( _In_ PWSTR  FileName)

Retrieves image version information for a file.

Parameters
FileNameThe file name.
Returns
A version information block. You must free this using PhFree() when you no longer need it.

Definition at line 1484 of file support.c.

PHLIBAPI ULONG NTAPI PhGetFileVersionInfoLangCodePage ( _In_ PVOID  VersionInfo)

Retrieves the language ID and code page used by a version information block.

Parameters
VersionInfoThe version information block.

Definition at line 1527 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetFileVersionInfoString ( _In_ PVOID  VersionInfo,
_In_ PWSTR  SubBlock 
)

Retrieves a string in a version information block.

Parameters
VersionInfoThe version information block.
SubBlockThe path to the sub-block.

Definition at line 1551 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetFileVersionInfoString2 ( _In_ PVOID  VersionInfo,
_In_ ULONG  LangCodePage,
_In_ PWSTR  StringName 
)

Retrieves a string in a version information block.

Parameters
VersionInfoThe version information block.
LangCodePageThe language ID and code page of the string.
StringNameThe name of the string.

Definition at line 1582 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetFullPath ( _In_ PWSTR  FileName,
_Out_opt_ PULONG  IndexOfFileName 
)

Gets an absolute file name.

Parameters
FileNameA file name.
IndexOfFileNameA variable which receives the index of the base name.
Returns
An absolute file name, or NULL if the function failed.

Definition at line 1811 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhGetHandleInformation ( _In_ HANDLE  ProcessHandle,
_In_ HANDLE  Handle,
_In_ ULONG  ObjectTypeNumber,
_Out_opt_ POBJECT_BASIC_INFORMATION  BasicInformation,
_Out_opt_ PPH_STRING *  TypeName,
_Out_opt_ PPH_STRING *  ObjectName,
_Out_opt_ PPH_STRING *  BestObjectName 
)

Gets information for a handle.

Parameters
ProcessHandleA handle to the process in which the handle resides.
HandleThe handle value.
ObjectTypeNumberThe object type number of the handle. You can specify -1 for this parameter if the object type number is not known.
BasicInformationA variable which receives basic information about the object.
TypeNameA variable which receives the object type name.
ObjectNameA variable which receives the object name.
BestObjectNameA variable which receives the formatted object name.
Return values
STATUS_INVALID_HANDLEThe handle specified in ProcessHandle or Handle is invalid.
STATUS_INVALID_PARAMETER_3The value specified in ObjectTypeNumber is invalid.

Definition at line 1155 of file hndlinfo.c.

PHLIBAPI NTSTATUS NTAPI PhGetHandleInformationEx ( _In_ HANDLE  ProcessHandle,
_In_ HANDLE  Handle,
_In_ ULONG  ObjectTypeNumber,
_Reserved_ ULONG  Flags,
_Out_opt_ PNTSTATUS  SubStatus,
_Out_opt_ POBJECT_BASIC_INFORMATION  BasicInformation,
_Out_opt_ PPH_STRING *  TypeName,
_Out_opt_ PPH_STRING *  ObjectName,
_Out_opt_ PPH_STRING *  BestObjectName,
_Reserved_ PVOID *  ExtraInformation 
)

Gets information for a handle.

Parameters
ProcessHandleA handle to the process in which the handle resides.
HandleThe handle value.
ObjectTypeNumberThe object type number of the handle. You can specify -1 for this parameter if the object type number is not known.
FlagsReserved.
SubStatusA variable which receives the NTSTATUS value of the last component that fails. If all operations succeed, the value will be STATUS_SUCCESS. If the function returns an error status, this variable is not set.
BasicInformationA variable which receives basic information about the object.
TypeNameA variable which receives the object type name.
ObjectNameA variable which receives the object name.
BestObjectNameA variable which receives the formatted object name.
ExtraInformationReserved.
Return values
STATUS_INVALID_HANDLEThe handle specified in ProcessHandle or Handle is invalid.
STATUS_INVALID_PARAMETER_3The value specified in ObjectTypeNumber is invalid.
Remarks
If BasicInformation or TypeName are specified, the function will fail if either cannot be queried. ObjectName, BestObjectName and ExtraInformation will return NULL if they cannot be queried.

Definition at line 1232 of file hndlinfo.c.

PHLIBAPI NTSTATUS NTAPI PhGetJobProcessIdList ( _In_ HANDLE  JobHandle,
_Out_ PJOBOBJECT_BASIC_PROCESS_ID_LIST *  ProcessIdList 
)

Definition at line 2058 of file native.c.

PHLIBAPI PPH_STRING NTAPI PhGetKernelFileName ( VOID  )

Gets the file name of the kernel image.

Returns
A pointer to a string containing the kernel image file name. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 4289 of file native.c.

PHLIBAPI PPH_STRING NTAPI PhGetKnownLocation ( _In_ ULONG  Folder,
_In_opt_ PWSTR  AppendPath 
)

Gets a known location as a file name.

Parameters
FolderA CSIDL value representing the known location.
AppendPathA string to append to the folder path.

Definition at line 2174 of file support.c.

LSA_HANDLE NTAPI PhGetLookupPolicyHandle ( VOID  )

Retrieves a handle to the local LSA policy with POLICY_LOOKUP_NAMES access.

Remarks
Do not close the handle; it is cached.

Definition at line 58 of file lsa.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedArchiveImportEntry ( _In_ PPH_MAPPED_ARCHIVE_MEMBER  Member,
_Out_ PPH_MAPPED_ARCHIVE_IMPORT_ENTRY  Entry 
)

Definition at line 369 of file maplib.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageDataEntry ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ ULONG  Index,
_Out_ PIMAGE_DATA_DIRECTORY *  Entry 
)

Definition at line 341 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageDelayImports ( _Out_ PPH_MAPPED_IMAGE_IMPORTS  Imports,
_In_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 1119 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExportEntry ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_ ULONG  Index,
_Out_ PPH_MAPPED_IMAGE_EXPORT_ENTRY  Entry 
)

Definition at line 644 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExportFunction ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_opt_ PSTR  Name,
_In_opt_ USHORT  Ordinal,
_Out_ PPH_MAPPED_IMAGE_EXPORT_FUNCTION  Function 
)

Definition at line 680 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExportFunctionRemote ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_opt_ PSTR  Name,
_In_opt_ USHORT  Ordinal,
_In_ PVOID  RemoteBase,
_Out_ PVOID *  Function 
)

Definition at line 741 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageExports ( _Out_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 545 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageImportDll ( _In_ PPH_MAPPED_IMAGE_IMPORTS  Imports,
_In_ ULONG  Index,
_Out_ PPH_MAPPED_IMAGE_IMPORT_DLL  ImportDll 
)

Definition at line 892 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageImportEntry ( _In_ PPH_MAPPED_IMAGE_IMPORT_DLL  ImportDll,
_In_ ULONG  Index,
_Out_ PPH_MAPPED_IMAGE_IMPORT_ENTRY  Entry 
)

Definition at line 1033 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageImports ( _Out_ PPH_MAPPED_IMAGE_IMPORTS  Imports,
_In_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 832 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageLoadConfig32 ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_Out_ PIMAGE_LOAD_CONFIG_DIRECTORY32 *  LoadConfig 
)

Definition at line 415 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhGetMappedImageLoadConfig64 ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_Out_ PIMAGE_LOAD_CONFIG_DIRECTORY64 *  LoadConfig 
)

Definition at line 428 of file mapimg.c.

PHLIBAPI BOOLEAN NTAPI PhGetMappedImageSectionName ( _In_ PIMAGE_SECTION_HEADER  Section,
_Out_writes_opt_z_(Count) PSTR  Buffer,
_In_ ULONG  Count,
_Out_opt_ PULONG  ReturnCount 
)

Definition at line 317 of file mapimg.c.

PHLIBAPI PPH_STRING NTAPI PhGetMessage ( _In_ PVOID  DllHandle,
_In_ ULONG  MessageTableId,
_In_ ULONG  MessageLanguageId,
_In_ ULONG  MessageId 
)

Gets a string stored in a DLL's message table.

Parameters
DllHandleThe base address of the DLL.
MessageTableIdThe identifier of the message table.
MessageLanguageIdThe language ID of the message.
MessageIdThe identifier of the message.
Returns
A pointer to a string containing the message. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 221 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhGetNextMappedArchiveMember ( _In_ PPH_MAPPED_ARCHIVE_MEMBER  Member,
_Out_ PPH_MAPPED_ARCHIVE_MEMBER  NextMember 
)

Gets the next archive member.

Parameters
MemberAn archive member structure.
NextMemberA variable which receives a structure describing the next archive member. This pointer may be the same as the pointer specified in Member.

Definition at line 193 of file maplib.c.

PHLIBAPI PPH_STRING NTAPI PhGetNtMessage ( _In_ NTSTATUS  Status)

Gets a message describing a NT status value.

Parameters
StatusThe NT status value.

Definition at line 281 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhGetObjectSecurity ( _In_ HANDLE  Handle,
_In_ SECURITY_INFORMATION  SecurityInformation,
_Out_ PSECURITY_DESCRIPTOR *  SecurityDescriptor 
)

Definition at line 233 of file native.c.

ULONG NTAPI PhGetObjectTypeNumber ( _In_ PUNICODE_STRING  TypeName)

Definition at line 1455 of file hndlinfo.c.

PHLIBAPI VOID NTAPI PhGetPositionFileStream ( _In_ PPH_FILE_STREAM  FileStream,
_Out_ PLARGE_INTEGER  Position 
)

Definition at line 1069 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcedureAddressRemote ( _In_ HANDLE  ProcessHandle,
_In_ PWSTR  FileName,
_In_opt_ PSTR  ProcedureName,
_In_opt_ ULONG  ProcedureNumber,
_Out_ PVOID *  ProcedureAddress,
_Out_opt_ PVOID *  DllBase 
)

Gets the address of a procedure in a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
FileNameThe file name of the DLL containing the procedure.
ProcedureNameThe name of the procedure.
ProcedureNumberThe ordinal of the procedure.
ProcedureAddressA variable which receives the address of the procedure in the address space of the process.
DllBaseA variable which receives the base address of the DLL containing the procedure.

Definition at line 4126 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessCommandLine ( _In_ HANDLE  ProcessHandle,
_Out_ PPH_STRING *  CommandLine 
)

Gets a process' command line.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION. Before Windows 8.1, the handle must also have PROCESS_VM_READ access.
StringA variable which receives a pointer to a string containing the command line. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 833 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessDepStatus ( _In_ HANDLE  ProcessHandle,
_Out_ PULONG  DepStatus 
)

Definition at line 1060 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessEnvironment ( _In_ HANDLE  ProcessHandle,
_In_ ULONG  Flags,
_Out_ PVOID *  Environment,
_Out_ PULONG  EnvironmentLength 
)

Gets a process' environment block.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access.
FlagsA combination of flags.
  • PH_GET_PROCESS_ENVIRONMENT_WOW64 Retrieve the environment block from the WOW64 PEB.
EnvironmentA variable which will receive a pointer to the environment block copied from the process. You must free the block using PhFreePage() when you no longer need it.
EnvironmentLengthA variable which will receive the length of the environment block, in bytes.

Definition at line 1240 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessExecuteFlags ( _In_ HANDLE  ProcessHandle,
_Out_ PULONG  ExecuteFlags 
)

Gets a process' no-execute status.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_INFORMATION access.
ExecuteFlagsA variable which receives the no-execute flags.

Definition at line 1033 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessImageFileName ( _In_ HANDLE  ProcessHandle,
_Out_ PPH_STRING *  FileName 
)

Gets the file name of the process' image.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
FileNameA variable which receives a pointer to a string containing the file name. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 630 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessImageFileNameByProcessId ( _In_ HANDLE  ProcessId,
_Out_ PPH_STRING *  FileName 
)

Gets the file name of a process' image.

Parameters
ProcessIdThe ID of the process.
FileNameA variable which receives a pointer to a string containing the file name. You must free the string using PhDereferenceObject() when you no longer need it.
Remarks
This function only works on Windows Vista and above. There does not appear to be any access checking performed by the kernel for this.

Definition at line 4699 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessImageFileNameWin32 ( _In_ HANDLE  ProcessHandle,
_Out_ PPH_STRING *  FileName 
)

Gets the Win32 file name of the process' image.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
FileNameA variable which receives a pointer to a string containing the file name. You must free the string using PhDereferenceObject() when you no longer need it.
Remarks
This function is only available on Windows Vista and above.

Definition at line 665 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessIsDotNet ( _In_ HANDLE  ProcessId,
_Out_ PBOOLEAN  IsDotNet 
)

Determines if a process is managed.

Parameters
ProcessIdThe ID of the process.
IsDotNetA variable which receives a boolean indicating whether the process is managed.

Definition at line 4758 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessIsDotNetEx ( _In_ HANDLE  ProcessId,
_In_opt_ HANDLE  ProcessHandle,
_In_ ULONG  InFlags,
_Out_opt_ PBOOLEAN  IsDotNet,
_Out_opt_ PULONG  Flags 
)

Determines if a process is managed.

Parameters
ProcessIdThe ID of the process.
ProcessHandleAn optional handle to the process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
InFlagsA combination of flags.
  • PH_CLR_USE_SECTION_CHECK Checks for the existence of related section objects to determine whether the process is managed.
  • PH_CLR_NO_WOW64_CHECK Instead of a separate query, uses the presence of the PH_CLR_KNOWN_IS_WOW64 flag to determine whether the process is running under WOW64.
  • PH_CLR_KNOWN_IS_WOW64 When PH_CLR_NO_WOW64_CHECK is specified, indicates that the process is managed.
IsDotNetA variable which receives a boolean indicating whether the process is managed.
FlagsA variable which receives additional flags.

Definition at line 4868 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessIsPosix ( _In_ HANDLE  ProcessHandle,
_Out_ PBOOLEAN  IsPosix 
)

Gets whether the process is running under the POSIX subsystem.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
IsPosixA variable which receives a boolean indicating whether the process is running under the POSIX subsystem.

Definition at line 991 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessMappedFileName ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_Out_ PPH_STRING *  FileName 
)

Gets the file name of a mapped section.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_INFORMATION access.
BaseAddressThe base address of the section view.
FileNameA variable which receives a pointer to a string containing the file name of the section. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 1433 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessPebString ( _In_ HANDLE  ProcessHandle,
_In_ PH_PEB_OFFSET  Offset,
_Out_ PPH_STRING *  String 
)

Gets a string stored in a process' parameters structure.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
OffsetThe string to retrieve.
StringA variable which receives a pointer to the requested string. You must free the string using PhDereferenceObject() when you no longer need it.
Return values
STATUS_INVALID_PARAMETER_2An invalid value was specified in the Offset parameter.

Definition at line 702 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessPosixCommandLine ( _In_ HANDLE  ProcessHandle,
_Out_ PPH_STRING *  CommandLine 
)

Gets the POSIX command line of a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_VM_READ access.
CommandLineA variable which receives a pointer to a string containing the POSIX command line. You must free the string using PhDereferenceObject() when you no longer need it.
Return values
STATUS_UNSUCCESSFULThe command line of the process could not be retrieved because it is too large.
Remarks
Do not use this function on a non-POSIX process. Use the PhGetProcessIsPosix() function to determine whether a process is running under the POSIX subsystem.

Definition at line 1109 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessWindowTitle ( _In_ HANDLE  ProcessHandle,
_Out_ PULONG  WindowFlags,
_Out_ PPH_STRING *  WindowTitle 
)

Gets the window flags and window title of a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION. Before Windows 7 SP1, the handle must also have PROCESS_VM_READ access.
WindowFlagsA variable which receives the window flags.
WindowTitleA variable which receives a pointer to the window title. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 874 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessWorkingSetInformation ( _In_ HANDLE  ProcessHandle,
_Out_ PMEMORY_WORKING_SET_INFORMATION *  WorkingSetInformation 
)

Gets working set information for a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_INFORMATION access.
WorkingSetInformationA variable which receives a pointer to the information. You must free the buffer using PhFree() when you no longer need it.

Definition at line 1498 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetProcessWsCounters ( _In_ HANDLE  ProcessHandle,
_Out_ PPH_PROCESS_WS_COUNTERS  WsCounters 
)

Gets working set counters for a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_INFORMATION access.
WsCountersA variable which receives the counters.

Definition at line 1548 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetResourceManagerBasicInformation ( _In_ HANDLE  ResourceManagerHandle,
_Out_opt_ PGUID  Guid,
_Out_opt_ PPH_STRING *  Description 
)

Definition at line 2829 of file native.c.

PHLIBAPI ULONG NTAPI PhGetRunIdProvider ( _In_ PPH_PROVIDER_REGISTRATION  Registration)

Gets the current run ID of a provider.

Parameters
RegistrationA pointer to the registration object for a provider.

Definition at line 461 of file provider.c.

NTSTATUS NTAPI PhGetSectionFileName ( _In_ HANDLE  SectionHandle,
_Out_ PPH_STRING *  FileName 
)

Definition at line 453 of file hndlinfo.c.

PHLIBAPI PVOID NTAPI PhGetServiceConfig ( _In_ SC_HANDLE  ServiceHandle)

Definition at line 159 of file svcsup.c.

PHLIBAPI BOOLEAN NTAPI PhGetServiceDelayedAutoStart ( _In_ SC_HANDLE  ServiceHandle,
_Out_ PBOOLEAN  DelayedAutoStart 
)

Definition at line 244 of file svcsup.c.

PHLIBAPI PPH_STRING NTAPI PhGetServiceDescription ( _In_ SC_HANDLE  ServiceHandle)

Definition at line 220 of file svcsup.c.

NTSTATUS NTAPI PhGetServiceDllParameter ( _In_ PPH_STRINGREF  ServiceName,
_Out_ PPH_STRING *  ServiceDll 
)

Definition at line 475 of file svcsup.c.

PHLIBAPI ULONG NTAPI PhGetServiceErrorControlInteger ( _In_ PWSTR  ServiceErrorControl)

Definition at line 387 of file svcsup.c.

PHLIBAPI PWSTR NTAPI PhGetServiceErrorControlString ( _In_ ULONG  ServiceErrorControl)

Definition at line 370 of file svcsup.c.

PHLIBAPI PPH_STRING NTAPI PhGetServiceNameFromTag ( _In_ HANDLE  ProcessId,
_In_ PVOID  ServiceTag 
)

Definition at line 404 of file svcsup.c.

PHLIBAPI ULONG NTAPI PhGetServiceStartTypeInteger ( _In_ PWSTR  ServiceStartType)

Definition at line 353 of file svcsup.c.

PHLIBAPI PWSTR NTAPI PhGetServiceStartTypeString ( _In_ ULONG  ServiceStartType)

Definition at line 336 of file svcsup.c.

PHLIBAPI PWSTR NTAPI PhGetServiceStateString ( _In_ ULONG  ServiceState)

Definition at line 285 of file svcsup.c.

PHLIBAPI ULONG NTAPI PhGetServiceTypeInteger ( _In_ PWSTR  ServiceType)

Definition at line 319 of file svcsup.c.

PHLIBAPI PWSTR NTAPI PhGetServiceTypeString ( _In_ ULONG  ServiceType)

Definition at line 302 of file svcsup.c.

PHLIBAPI PPH_STRING NTAPI PhGetSidFullName ( _In_ PSID  Sid,
_In_ BOOLEAN  IncludeDomain,
_Out_opt_ PSID_NAME_USE  NameUse 
)

Gets the name of a SID.

Parameters
SidA SID to query.
IncludeDomainTRUE to include the domain name, otherwise FALSE.
NameUseA variable which receives the SID's usage.
Returns
A pointer to a string containing the name of the SID in the following format: domain\name. You must free the string using PhDereferenceObject() when you no longer need it. If an error occurs, the function returns NULL.

Definition at line 387 of file lsa.c.

PPH_STRING NTAPI PhGetStatusMessage ( _In_ NTSTATUS  Status,
_In_opt_ ULONG  Win32Result 
)

Definition at line 387 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhGetSystemDirectory ( VOID  )

Retrieves the system directory path.

Definition at line 1940 of file support.c.

PHLIBAPI VOID NTAPI PhGetSystemRoot ( _Out_ PPH_STRINGREF  SystemRoot)

Retrieves the Windows directory path.

Definition at line 1996 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhGetThreadContext ( _In_ HANDLE  ThreadHandle,
_Inout_ PCONTEXT  Context 
)

Gets the processor context of a thread.

Parameters
ThreadHandleA handle to a thread. The handle must have THREAD_GET_CONTEXT access.
ContextA variable which receives the context structure.

Definition at line 441 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetThreadServiceTag ( _In_ HANDLE  ThreadHandle,
_In_opt_ HANDLE  ProcessHandle,
_Out_ PVOID *  ServiceTag 
)

Definition at line 436 of file svcsup.c.

PHLIBAPI NTSTATUS NTAPI PhGetTokenGroups ( _In_ HANDLE  TokenHandle,
_Out_ PTOKEN_GROUPS *  Groups 
)

Gets a token's groups.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_QUERY access.
GroupsA variable which receives a pointer to a structure containing the token's groups. You must free the structure using PhFree() when you no longer need it.

Definition at line 2252 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTokenIntegrityLevel ( _In_ HANDLE  TokenHandle,
_Out_opt_ PMANDATORY_LEVEL  IntegrityLevel,
_Out_opt_ PWSTR *  IntegrityString 
)

Gets a token's integrity level.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_QUERY access.
IntegrityLevelA variable which receives the integrity level of the token.
IntegrityStringA variable which receives a pointer to a string containing a string representation of the integrity level.

Definition at line 2411 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTokenOwner ( _In_ HANDLE  TokenHandle,
_Out_ PTOKEN_OWNER *  Owner 
)

Gets a token's owner.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_QUERY access.
OwnerA variable which receives a pointer to a structure containing the token's owner. You must free the structure using PhFree() when you no longer need it.

Definition at line 2208 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTokenPrimaryGroup ( _In_ HANDLE  TokenHandle,
_Out_ PTOKEN_PRIMARY_GROUP *  PrimaryGroup 
)

Gets a token's primary group.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_QUERY access.
PrimaryGroupA variable which receives a pointer to a structure containing the token's primary group. You must free the structure using PhFree() when you no longer need it.

Definition at line 2230 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTokenPrivileges ( _In_ HANDLE  TokenHandle,
_Out_ PTOKEN_PRIVILEGES *  Privileges 
)

Gets a token's privileges.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_QUERY access.
PrivilegesA variable which receives a pointer to a structure containing the token's privileges. You must free the structure using PhFree() when you no longer need it.

Definition at line 2274 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTokenUser ( _In_ HANDLE  TokenHandle,
_Out_ PTOKEN_USER *  User 
)

Gets a token's user.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_QUERY access.
UserA variable which receives a pointer to a structure containing the token's user. You must free the structure using PhFree() when you no longer need it.

Definition at line 2186 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTransactionBasicInformation ( _In_ HANDLE  TransactionHandle,
_Out_ PTRANSACTION_BASIC_INFORMATION  BasicInformation 
)

Definition at line 2713 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTransactionManagerBasicInformation ( _In_ HANDLE  TransactionManagerHandle,
_Out_ PTRANSACTIONMANAGER_BASIC_INFORMATION  BasicInformation 
)

Definition at line 2613 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTransactionManagerLogFileName ( _In_ HANDLE  TransactionManagerHandle,
_Out_ PPH_STRING *  LogFileName 
)

Definition at line 2634 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhGetTransactionPropertiesInformation ( _In_ HANDLE  TransactionHandle,
_Out_opt_ PLARGE_INTEGER  Timeout,
_Out_opt_ TRANSACTION_OUTCOME *  Outcome,
_Out_opt_ PPH_STRING *  Description 
)

Definition at line 2734 of file native.c.

PHLIBAPI PPH_STRING NTAPI PhGetWin32Message ( _In_ ULONG  Result)

Gets a message describing a Win32 error code.

Parameters
ResultThe Win32 error code.

Definition at line 324 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhImpersonateClientOfNamedPipe ( _In_ HANDLE  FileHandle)

Definition at line 483 of file iosup.c.

VOID NTAPI PhInitializeDevicePrefixes ( VOID  )

Initializes the device prefixes module.

Definition at line 5246 of file native.c.

PHLIBAPI VOID NTAPI PhInitializeHash ( _Out_ PPH_HASH_CONTEXT  Context,
_In_ PH_HASH_ALGORITHM  Algorithm 
)

Initializes hashing.

Parameters
ContextA hashing context structure.
AlgorithmThe hash algorithm to use:
  • Md5HashAlgorithm MD5 (128 bits)
  • Sha1HashAlgorithm SHA-1 (160 bits)
  • Crc32HashAlgorithm CRC-32-IEEE 802.3 (32 bits)

Definition at line 4415 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhInitializeImageVersionInfo ( _Out_ PPH_IMAGE_VERSION_INFO  ImageVersionInfo,
_In_ PWSTR  FileName 
)

Initializes a structure with version information.

Parameters
ImageVersionInfoThe version information structure.
FileNameThe file name of an image.

Definition at line 1621 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhInitializeMappedArchive ( _Out_ PPH_MAPPED_ARCHIVE  MappedArchive,
_In_ PVOID  ViewBase,
_In_ SIZE_T  Size 
)

Definition at line 45 of file maplib.c.

PHLIBAPI NTSTATUS NTAPI PhInitializeMappedImage ( _Out_ PPH_MAPPED_IMAGE  MappedImage,
_In_ PVOID  ViewBase,
_In_ SIZE_T  Size 
)

Definition at line 45 of file mapimg.c.

PHLIBAPI VOID NTAPI PhInitializeProviderThread ( _Out_ PPH_PROVIDER_THREAD  ProviderThread,
_In_ ULONG  Interval 
)

Initializes a provider thread.

Parameters
ProviderThreadA pointer to a provider thread object.
IntervalThe interval between each run, in milliseconds.

Definition at line 59 of file provider.c.

PHLIBAPI NTSTATUS NTAPI PhInjectDllProcess ( _In_ HANDLE  ProcessHandle,
_In_ PWSTR  FileName,
_In_opt_ PLARGE_INTEGER  Timeout 
)

Causes a process to load a DLL.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ and PROCESS_VM_WRITE access.
FileNameThe file name of the DLL to inject.
TimeoutThe timeout, in milliseconds, for the process to load the DLL.
Remarks
If the process does not load the DLL before the timeout expires it may crash. Choose the timeout value carefully.

Definition at line 1741 of file native.c.

BOOLEAN NTAPI PhIoSupportInitialization ( VOID  )

Definition at line 29 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhIsExecutablePacked ( _In_ PWSTR  FileName,
_Out_ PBOOLEAN  IsPacked,
_Out_opt_ PULONG  NumberOfModules,
_Out_opt_ PULONG  NumberOfFunctions 
)

Determines if an executable image is packed.

Parameters
FileNameThe file name of the image.
IsPackedA variable that receives TRUE if the image is packed, otherwise FALSE.
NumberOfModulesA variable that receives the number of DLLs that the image imports functions from.
NumberOfFunctionsA variable that receives the number of functions that the image imports.

Definition at line 4235 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhIsMappedArchiveMemberShortFormat ( _In_ PPH_MAPPED_ARCHIVE_MEMBER  Member)

Definition at line 358 of file maplib.c.

FORCEINLINE VOID PhLargeIntegerToLocalSystemTime ( _Out_ PSYSTEMTIME  SystemTime,
_In_ PLARGE_INTEGER  LargeInteger 
)

Definition at line 2332 of file ph.h.

FORCEINLINE VOID PhLargeIntegerToSystemTime ( _Out_ PSYSTEMTIME  SystemTime,
_In_ PLARGE_INTEGER  LargeInteger 
)

Definition at line 2318 of file ph.h.

PHLIBAPI NTSTATUS NTAPI PhListenNamedPipe ( _In_ HANDLE  FileHandle,
_In_opt_ HANDLE  Event,
_In_opt_ PIO_APC_ROUTINE  ApcRoutine,
_In_opt_ PVOID  ApcContext,
_Out_ PIO_STATUS_BLOCK  IoStatusBlock 
)

Definition at line 252 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhLoadMappedArchive ( _In_opt_ PWSTR  FileName,
_In_opt_ HANDLE  FileHandle,
_In_ BOOLEAN  ReadOnly,
_Out_ PPH_MAPPED_ARCHIVE  MappedArchive 
)

Definition at line 132 of file maplib.c.

PHLIBAPI NTSTATUS NTAPI PhLoadMappedImage ( _In_opt_ PWSTR  FileName,
_In_opt_ HANDLE  FileHandle,
_In_ BOOLEAN  ReadOnly,
_Out_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 129 of file mapimg.c.

NTSTATUS NTAPI PhLoadRemoteMappedImage ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  ViewBase,
_Out_ PPH_REMOTE_MAPPED_IMAGE  RemoteMappedImage 
)

Definition at line 441 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhLockFileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ PLARGE_INTEGER  Position,
_In_ PLARGE_INTEGER  Length,
_In_ BOOLEAN  Wait,
_In_ BOOLEAN  Shared 
)

Definition at line 1174 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhLookupName ( _In_ PPH_STRINGREF  Name,
_Out_opt_ PSID *  Sid,
_Out_opt_ PPH_STRING *  DomainName,
_Out_opt_ PSID_NAME_USE  NameUse 
)

Gets information about a name.

Parameters
NameA name to query.
SidA variable which receives a pointer to a SID. You must free the SID using PhFree() when you no longer need it.
DomainNameA variable which receives a pointer to a string containing the SID's domain name. You must free the string using PhDereferenceObject() when you no longer need it.
NameUseA variable which receives the SID's usage.

Definition at line 293 of file lsa.c.

PHLIBAPI BOOLEAN NTAPI PhLookupPrivilegeDisplayName ( _In_ PPH_STRINGREF  PrivilegeName,
_Out_ PPH_STRING *  PrivilegeDisplayName 
)

Gets the display name of a privilege from its name.

Parameters
PrivilegeNameThe name of a privilege.
PrivilegeDisplayNameA variable which receives a pointer to a string containing the privilege's display name. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 146 of file lsa.c.

PHLIBAPI BOOLEAN NTAPI PhLookupPrivilegeName ( _In_ PLUID  PrivilegeValue,
_Out_ PPH_STRING *  PrivilegeName 
)

Gets the name of a privilege from its LUID.

Parameters
PrivilegeValueThe LUID of a privilege.
PrivilegeNameA variable which receives a pointer to a string containing the privilege name. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 114 of file lsa.c.

PHLIBAPI BOOLEAN NTAPI PhLookupPrivilegeValue ( _In_ PPH_STRINGREF  PrivilegeName,
_Out_ PLUID  PrivilegeValue 
)

Gets the LUID of a privilege from its name.

Parameters
PrivilegeNameThe name of a privilege.
PrivilegeValueA variable which receives the LUID of the privilege.

Definition at line 181 of file lsa.c.

PHLIBAPI NTSTATUS NTAPI PhLookupSid ( _In_ PSID  Sid,
_Out_opt_ PPH_STRING *  Name,
_Out_opt_ PPH_STRING *  DomainName,
_Out_opt_ PSID_NAME_USE  NameUse 
)

Gets information about a SID.

Parameters
SidA SID to query.
NameA variable which receives a pointer to a string containing the SID's name. You must free the string using PhDereferenceObject() when you no longer need it.
DomainNameA variable which receives a pointer to a string containing the SID's domain name. You must free the string using PhDereferenceObject() when you no longer need it.
NameUseA variable which receives the SID's usage.

Definition at line 212 of file lsa.c.

PHLIBAPI VOID NTAPI PhMapFlags1 ( _Inout_ PULONG  Value2,
_In_ ULONG  Value1,
_In_ const PH_FLAG_MAPPING *  Mappings,
_In_ ULONG  NumberOfMappings 
)

Definition at line 3536 of file support.c.

PHLIBAPI VOID NTAPI PhMapFlags2 ( _Inout_ PULONG  Value1,
_In_ ULONG  Value2,
_In_ const PH_FLAG_MAPPING *  Mappings,
_In_ ULONG  NumberOfMappings 
)

Definition at line 3578 of file support.c.

PHLIBAPI PIMAGE_SECTION_HEADER NTAPI PhMappedImageRvaToSection ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ ULONG  Rva 
)

Definition at line 273 of file mapimg.c.

PHLIBAPI PVOID NTAPI PhMappedImageRvaToVa ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ ULONG  Rva,
_Out_opt_ PIMAGE_SECTION_HEADER *  Section 
)

Definition at line 294 of file mapimg.c.

FORCEINLINE RECT PhMapRect ( _In_ RECT  InnerRect,
_In_ RECT  OuterRect 
)

Definition at line 2269 of file ph.h.

PHLIBAPI NTSTATUS NTAPI PhMapViewOfEntireFile ( _In_opt_ PWSTR  FileName,
_In_opt_ HANDLE  FileHandle,
_In_ BOOLEAN  ReadOnly,
_Out_ PVOID *  ViewBase,
_Out_ PSIZE_T  Size 
)

Definition at line 173 of file mapimg.c.

PHLIBAPI BOOLEAN NTAPI PhMatchWildcards ( _In_ PWSTR  Pattern,
_In_ PWSTR  String,
_In_ BOOLEAN  IgnoreCase 
)

Matches a pattern against a string.

Parameters
PatternThe pattern, which can contain asterisks and question marks.
StringThe string which the pattern is matched against.
IgnoreCaseWhether to ignore character cases.

Definition at line 985 of file support.c.

NTSTATUS NTAPI PhOpenDriverByBaseAddress ( _Out_ PHANDLE  DriverHandle,
_In_ PVOID  BaseAddress 
)

Opens a driver object using a base address.

Parameters
DriverHandleA variable which receives a handle to the driver object.
BaseAddressThe base address of the driver to open.
Return values
STATUS_OBJECT_NAME_NOT_FOUNDThe driver could not be found.
Remarks
This function requires a valid KProcessHacker handle.

Definition at line 2969 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhOpenKey ( _Out_ PHANDLE  KeyHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ HANDLE  RootDirectory,
_In_ PPH_STRINGREF  ObjectName,
_In_ ULONG  Attributes 
)

Opens a registry key.

Parameters
KeyHandleA variable which receives a handle to the key.
DesiredAccessThe desired access to the key.
RootDirectoryA handle to a root key, or one of the predefined keys. See PhCreateKey() for details.
ObjectNameThe path to the key.
AttributesAdditional object flags.

Definition at line 6344 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhOpenLsaPolicy ( _Out_ PLSA_HANDLE  PolicyHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ PUNICODE_STRING  SystemName 
)

Definition at line 36 of file lsa.c.

PHLIBAPI NTSTATUS NTAPI PhOpenProcess ( _Out_ PHANDLE  ProcessHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ HANDLE  ProcessId 
)

Opens a process.

Parameters
ProcessHandleA variable which receives a handle to the process.
DesiredAccessThe desired access to the process.
ProcessIdThe ID of the process.

Definition at line 72 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhOpenProcessToken ( _Out_ PHANDLE  TokenHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ HANDLE  ProcessHandle 
)

Opens a process token.

Parameters
TokenHandleA variable which receives a handle to the token.
DesiredAccessThe desired access to the token.
ProcessHandleA handle to a process.

Definition at line 185 of file native.c.

PHLIBAPI SC_HANDLE NTAPI PhOpenService ( _In_ PWSTR  ServiceName,
_In_ ACCESS_MASK  DesiredAccess 
)

Definition at line 140 of file svcsup.c.

PHLIBAPI NTSTATUS NTAPI PhOpenThread ( _Out_ PHANDLE  ThreadHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ HANDLE  ThreadId 
)

Opens a thread.

Parameters
ThreadHandleA variable which receives a handle to the thread.
DesiredAccessThe desired access to the thread.
ThreadIdThe ID of the thread.

Definition at line 112 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhOpenThreadProcess ( _Out_ PHANDLE  ProcessHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ HANDLE  ThreadHandle 
)

Definition at line 145 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhOpenThreadToken ( _Out_ PHANDLE  TokenHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ HANDLE  ThreadHandle,
_In_ BOOLEAN  OpenAsSelf 
)

Opens a thread token.

Parameters
TokenHandleA variable which receives a handle to the token.
DesiredAccessThe desired access to the token.
ThreadHandleA handle to a thread.
OpenAsSelfTRUE to use the primary token for access checks, FALSE to use the impersonation token.

Definition at line 218 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhParseCommandLine ( _In_ PPH_STRINGREF  CommandLine,
_In_opt_ PPH_COMMAND_LINE_OPTION  Options,
_In_ ULONG  NumberOfOptions,
_In_ ULONG  Flags,
_In_ PPH_COMMAND_LINE_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Parses a command line string.

Parameters
CommandLineThe command line string.
OptionsAn array of supported command line options.
NumberOfOptionsThe number of elements in Options.
FlagsA combination of flags.
  • PH_COMMAND_LINE_IGNORE_UNKNOWN_OPTIONS Unknown command line options are ignored instead of failing the function.
  • PH_COMMAND_LINE_IGNORE_FIRST_PART The first part of the command line string is ignored. This is used when the first part of the string contains the executable file name.
CallbackA callback function to execute for each command line option found.
ContextA user-defined value to pass to Callback.

Definition at line 4650 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhParseCommandLineFuzzy ( _In_ PPH_STRINGREF  CommandLine,
_Out_ PPH_STRINGREF  FileName,
_Out_ PPH_STRINGREF  Arguments,
_Out_opt_ PPH_STRING *  FullFileName 
)

Parses a command line string.

If the string does not contain quotation marks around the file name part, the function determines the file name to use.

Parameters
CommandLineThe command line string.
FileNameA variable which receives the part of CommandLine that contains the file name.
ArgumentsA variable which receives the part of CommandLine that contains the arguments.
FullFileNameA variable which receives the full path and file name. This may be NULL if the file was not found.

Definition at line 4906 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhParseCommandLinePart ( _In_ PPH_STRINGREF  CommandLine,
_Inout_ PULONG_PTR  Index 
)

Parses one part of a command line string.

Quotation marks and backslashes are handled appropriately.

Parameters
CommandLineThe entire command line string.
IndexThe starting index of the command line part to be parsed. There should be no leading whitespace at this index. The index is updated to point to the end of the command line part.

Definition at line 4541 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhPeekNamedPipe ( _In_ HANDLE  FileHandle,
_Out_writes_bytes_opt_(Length) PVOID  Buffer,
_In_ ULONG  Length,
_Out_opt_ PULONG  NumberOfBytesRead,
_Out_opt_ PULONG  NumberOfBytesAvailable,
_Out_opt_ PULONG  NumberOfBytesLeftInMessage 
)

Definition at line 305 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhQueryFullAttributesFileWin32 ( _In_ PWSTR  FileName,
_Out_ PFILE_NETWORK_OPEN_INFORMATION  FileInformation 
)

Queries file attributes.

Parameters
FileNameThe Win32 file name.
FileInformationA variable that receives the file information.

Definition at line 191 of file iosup.c.

PHLIBAPI PPH_STRING NTAPI PhQueryRegistryString ( _In_ HANDLE  KeyHandle,
_In_opt_ PWSTR  ValueName 
)

Gets a registry string value.

Parameters
KeyHandleA handle to the key.
ValueNameThe name of the value.
Returns
A pointer to a string containing the value, or NULL if the function failed. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 3506 of file support.c.

PKEY_VALUE_PARTIAL_INFORMATION NTAPI PhQueryRegistryValue ( _In_ HANDLE  KeyHandle,
_In_opt_ PWSTR  ValueName 
)

Gets a registry value of any type.

Parameters
KeyHandleA handle to the key.
ValueNameThe name of the value.
Returns
A buffer containing information about the registry value, or NULL if the function failed. You must free the buffer with PhFree() when you no longer need it.

Definition at line 3450 of file support.c.

PHLIBAPI PVOID NTAPI PhQueryServiceVariableSize ( _In_ SC_HANDLE  ServiceHandle,
_In_ ULONG  InfoLevel 
)

Definition at line 183 of file svcsup.c.

NTSTATUS NTAPI PhQueryTokenVariableSize ( _In_ HANDLE  TokenHandle,
_In_ TOKEN_INFORMATION_CLASS  TokenInformationClass,
_Out_ PVOID *  Buffer 
)

Queries variable-sized information for a token.

The function allocates a buffer to contain the information.

Parameters
TokenHandleA handle to a token. The access required depends on the information class specified.
TokenInformationClassThe information class to retrieve.
BufferA variable which receives a pointer to a buffer containing the information. You must free the buffer using PhFree() when you no longer need it.

Definition at line 2163 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhReadFileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_Out_writes_bytes_(Length) PVOID  Buffer,
_In_ ULONG  Length,
_Out_opt_ PULONG  ReadLength 
)

Definition at line 714 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhReadVirtualMemory ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_Out_writes_bytes_(BufferSize) PVOID  Buffer,
_In_ SIZE_T  BufferSize,
_Out_opt_ PSIZE_T  NumberOfBytesRead 
)

Copies memory from another process into the current process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_VM_READ access.
BaseAddressThe address from which memory is to be copied.
BufferA buffer which receives the copied memory.
BufferSizeThe number of bytes to copy.
NumberOfBytesReadA variable which receives the number of bytes copied to the buffer.

Definition at line 489 of file native.c.

FORCEINLINE RECT PhRectangleToRect ( _In_ PH_RECTANGLE  Rectangle)

Definition at line 2242 of file ph.h.

FORCEINLINE PH_RECTANGLE PhRectToRectangle ( _In_ RECT  Rect)

Definition at line 2226 of file ph.h.

PHLIBAPI VOID NTAPI PhReferenceObjects ( _In_reads_(NumberOfObjects) PVOID *  Objects,
_In_ ULONG  NumberOfObjects 
)

References an array of objects.

Parameters
ObjectsAn array of objects.
NumberOfObjectsThe number of elements in Objects.

Definition at line 181 of file support.c.

PHLIBAPI VOID NTAPI PhRegisterProvider ( _Inout_ PPH_PROVIDER_THREAD  ProviderThread,
_In_ PPH_PROVIDER_FUNCTION  Function,
_In_opt_ PVOID  Object,
_Out_ PPH_PROVIDER_REGISTRATION  Registration 
)

Registers a provider with a provider thread.

Parameters
ProviderThreadA pointer to a provider thread object.
FunctionThe provider function.
ObjectA pointer to an object to pass to the provider function. The object must be managed by the reference-counting system.
RegistrationA variable which receives registration information for the provider.
Remarks
The provider is initially disabled. Call PhSetEnabledProvider() to enable it.

Definition at line 328 of file provider.c.

PHLIBAPI PPH_STRING NTAPI PhResolveDevicePrefix ( _In_ PPH_STRING  Name)

Resolves a NT path into a Win32 path.

Parameters
NameA string containing the path to resolve.
Returns
A pointer to a string containing the Win32 path. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 5428 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhResumeProcess ( _In_ HANDLE  ProcessHandle)

Resumes a process' threads.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_SUSPEND_RESUME access.

Definition at line 353 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhResumeThread ( _In_ HANDLE  ThreadHandle,
_Out_opt_ PULONG  PreviousSuspendCount 
)

Resumes a thread.

Parameters
ThreadHandleA handle to a thread. The handle must have THREAD_SUSPEND_RESUME access.
PreviousSuspendCountA variable which receives the number of times the thread had been suspended.

Definition at line 425 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSeekFileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ PLARGE_INTEGER  Offset,
_In_ PH_SEEK_ORIGIN  Origin 
)

Definition at line 1133 of file iosup.c.

PHLIBAPI VOID NTAPI PhSetEnabledProvider ( _Inout_ PPH_PROVIDER_REGISTRATION  Registration,
_In_ BOOLEAN  Enabled 
)

Sets whether a provider is enabled.

Parameters
RegistrationA pointer to the registration object for a provider.
EnabledTRUE if the provider is enabled, otherwise FALSE.

Definition at line 489 of file provider.c.

PHLIBAPI VOID NTAPI PhSetFileDialogFileName ( _In_ PVOID  FileDialog,
_In_ PWSTR  FileName 
)

Sets the file name of a file dialog.

Parameters
FileDialogThe file dialog.
FileNameThe new file name.

Definition at line 4161 of file support.c.

PHLIBAPI VOID NTAPI PhSetFileDialogFilter ( _In_ PVOID  FileDialog,
_In_ PPH_FILETYPE_FILTER  Filters,
_In_ ULONG  NumberOfFilters 
)

Sets the file type filter for a file dialog.

Parameters
FileDialogThe file dialog.
FiltersA pointer to an array of file type structures.
NumberOfFiltersThe number of file types.

Definition at line 4059 of file support.c.

PHLIBAPI VOID NTAPI PhSetFileDialogOptions ( _In_ PVOID  FileDialog,
_In_ ULONG  Options 
)

Sets the options for a file dialog.

Parameters
FileDialogThe file dialog.
OptionsA combination of flags specifying the options.
  • PH_FILEDIALOG_CREATEPROMPT A prompt for creation will be displayed when the selected item does not exist. This is only valid for Save dialogs.
  • PH_FILEDIALOG_PATHMUSTEXIST The selected item must be in an existing folder. This is enabled by default.
  • PH_FILEDIALOG_FILEMUSTEXIST The selected item must exist. This is enabled by default and is only valid for Open dialogs.
  • PH_FILEDIALOG_SHOWHIDDEN Items with the System and Hidden attributes will be displayed.
  • PH_FILEDIALOG_NODEREFERENCELINKS Shortcuts will not be followed, allowing .lnk files to be opened.
  • PH_FILEDIALOG_OVERWRITEPROMPT An overwrite prompt will be displayed if an existing item is selected. This is enabled by default and is only valid for Save dialogs.
  • PH_FILEDIALOG_DEFAULTEXPANDED The file dialog should be expanded by default (i.e. the folder browser should be displayed). This is only valid for Save dialogs.

Definition at line 3979 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhSetFileSize ( _In_ HANDLE  FileHandle,
_In_ PLARGE_INTEGER  Size 
)

Definition at line 2541 of file native.c.

PPH_GET_CLIENT_ID_NAME NTAPI PhSetHandleClientIdFunction ( _In_ PPH_GET_CLIENT_ID_NAME  GetClientIdName)

Definition at line 115 of file hndlinfo.c.

PHLIBAPI VOID NTAPI PhSetIntervalProviderThread ( _Inout_ PPH_PROVIDER_THREAD  ProviderThread,
_In_ ULONG  Interval 
)

Sets the run interval for a provider thread.

Parameters
ProviderThreadA pointer to a provider thread object.
IntervalThe interval between each run, in milliseconds.

Definition at line 298 of file provider.c.

PHLIBAPI NTSTATUS NTAPI PhSetObjectSecurity ( _In_ HANDLE  Handle,
_In_ SECURITY_INFORMATION  SecurityInformation,
_In_ PSECURITY_DESCRIPTOR  SecurityDescriptor 
)

Definition at line 282 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetProcessDepStatus ( _In_ HANDLE  ProcessHandle,
_In_ ULONG  DepStatus 
)

Definition at line 1639 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetProcessDepStatusInvasive ( _In_ HANDLE  ProcessHandle,
_In_ ULONG  DepStatus,
_In_opt_ PLARGE_INTEGER  Timeout 
)

Definition at line 1659 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetProcessExecuteFlags ( _In_ HANDLE  ProcessHandle,
_In_ ULONG  ExecuteFlags 
)

Sets a process' no-execute status.

Parameters
ProcessHandleA handle to a process.
ExecuteFlagsThe new no-execute flags.
Remarks
This function requires a valid KProcessHacker handle.

Definition at line 1626 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetProcessIoPriority ( _In_ HANDLE  ProcessHandle,
_In_ ULONG  IoPriority 
)

Sets a process' I/O priority.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_SET_INFORMATION access.
IoPriorityThe new I/O priority.

Definition at line 1592 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetProcessModuleLoadCount ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_In_ ULONG  LoadCount 
)

Sets the load count of a process module.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_VM_READ and PROCESS_VM_WRITE access.
BaseAddressThe base address of a module.
LoadCountThe new load count of the module.
Return values
STATUS_DLL_NOT_FOUNDThe module was not found.

Definition at line 3671 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetProcessModuleLoadCount32 ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_In_ ULONG  LoadCount 
)

Sets the load count of a 32-bit process module.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_VM_READ and PROCESS_VM_WRITE access.
BaseAddressThe base address of a module.
LoadCountThe new load count of the module.
Return values
STATUS_DLL_NOT_FOUNDThe module was not found.
STATUS_NOT_SUPPORTEDThe process is not running under WOW64.
Remarks
Do not use this function under a 32-bit environment.

Definition at line 4059 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhSetServiceDelayedAutoStart ( _In_ SC_HANDLE  ServiceHandle,
_In_ BOOLEAN  DelayedAutoStart 
)

Definition at line 269 of file svcsup.c.

PHLIBAPI NTSTATUS NTAPI PhSetThreadContext ( _In_ HANDLE  ThreadHandle,
_In_ PCONTEXT  Context 
)

Sets the processor context of a thread.

Parameters
ThreadHandleA handle to a thread. The handle must have THREAD_SET_CONTEXT access.
ContextThe new context structure.

Definition at line 463 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetThreadIoPriority ( _In_ HANDLE  ThreadHandle,
_In_ ULONG  IoPriority 
)

Sets a thread's I/O priority.

Parameters
ThreadHandleA handle to a thread. The handle must have THREAD_SET_LIMITED_INFORMATION access.
IoPriorityThe new I/O priority.

Definition at line 2033 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetTokenIsVirtualizationEnabled ( _In_ HANDLE  TokenHandle,
_In_ BOOLEAN  IsVirtualizationEnabled 
)

Sets whether virtualization is enabled for a token.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_WRITE access.
IsVirtualizationEnabledA boolean indicating whether virtualization is to be enabled for the token.

Definition at line 2383 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhSetTokenPrivilege ( _In_ HANDLE  TokenHandle,
_In_opt_ PWSTR  PrivilegeName,
_In_opt_ PLUID  PrivilegeLuid,
_In_ ULONG  Attributes 
)

Modifies a token privilege.

Parameters
TokenHandleA handle to a token. The handle must have TOKEN_ADJUST_PRIVILEGES access.
PrivilegeNameThe name of the privilege to modify. If this parameter is NULL, you must specify a LUID in the PrivilegeLuid parameter.
PrivilegeLuidThe LUID of the privilege to modify. If this parameter is NULL, you must specify a name in the PrivilegeName parameter.
AttributesThe new attributes of the privilege.

Definition at line 2312 of file native.c.

PHLIBAPI BOOLEAN NTAPI PhSetTokenPrivilege2 ( _In_ HANDLE  TokenHandle,
_In_ LONG  Privilege,
_In_ ULONG  Attributes 
)

Definition at line 2362 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSetTokenSessionId ( _In_ HANDLE  TokenHandle,
_In_ ULONG  SessionId 
)

Definition at line 2286 of file native.c.

PHLIBAPI VOID NTAPI PhShellExecute ( _In_ HWND  hWnd,
_In_ PWSTR  FileName,
_In_opt_ PWSTR  Parameters 
)

Opens a file or location through the shell.

Parameters
hWndThe window to display user interface components on.
FileNameA file name or location.
ParametersThe parameters to pass to the executed application.

Definition at line 3184 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhShellExecuteEx ( _In_opt_ HWND  hWnd,
_In_ PWSTR  FileName,
_In_opt_ PWSTR  Parameters,
_In_ ULONG  ShowWindowType,
_In_ ULONG  Flags,
_In_opt_ ULONG  Timeout,
_Out_opt_ PHANDLE  ProcessHandle 
)

Opens a file or location through the shell.

Parameters
hWndThe window to display user interface components on.
FileNameA file name or location.
ParametersThe parameters to pass to the executed application.
ShowWindowTypeA value specifying how to show the application.
FlagsA combination of the following:
  • PH_SHELL_EXECUTE_ADMIN Execute the application elevated.
  • PH_SHELL_EXECUTE_PUMP_MESSAGES Waits on the application while pumping messages, if Timeout is specified.
TimeoutThe number of milliseconds to wait on the application, or 0 to return immediately after the application is started.
ProcessHandleA variable which receives a handle to the new process.

Definition at line 3219 of file support.c.

PHLIBAPI VOID NTAPI PhShellExploreFile ( _In_ HWND  hWnd,
_In_ PWSTR  FileName 
)

Opens Windows Explorer with a file selected.

Parameters
hWndA handle to the parent window.
FileNameA file name.

Definition at line 3275 of file support.c.

PHLIBAPI VOID NTAPI PhShellOpenKey ( _In_ HWND  hWnd,
_In_ PPH_STRING  KeyName 
)

Opens a key in the Registry Editor.

Parameters
hWndA handle to the parent window.
KeyNameThe key name to open.

Definition at line 3387 of file support.c.

PHLIBAPI VOID NTAPI PhShellProperties ( _In_ HWND  hWnd,
_In_ PWSTR  FileName 
)

Shows properties for a file.

Parameters
hWndA handle to the parent window.
FileNameA file name.

Definition at line 3311 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhShowConfirmMessage ( _In_ HWND  hWnd,
_In_ PWSTR  Verb,
_In_ PWSTR  Object,
_In_opt_ PWSTR  Message,
_In_ BOOLEAN  Warning 
)

Displays a confirmation message.

Parameters
hWndThe owner window of the message box.
VerbA verb describing the operation, e.g. "terminate".
ObjectThe object of the operation, e.g. "the process".
MessageA message describing the operation.
WarningTRUE to display the confirmation message as a warning, otherwise FALSE.
Returns
TRUE if the user wishes to continue, otherwise FALSE.

Definition at line 524 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhShowContinueStatus ( _In_ HWND  hWnd,
_In_opt_ PWSTR  Message,
_In_ NTSTATUS  Status,
_In_opt_ ULONG  Win32Result 
)

Displays an error message for a NTSTATUS value or Win32 error code, and allows the user to cancel the current operation.

Parameters
hWndThe owner window of the message box.
MessageA message describing the operation that failed.
StatusA NTSTATUS value, or 0 if there is none.
Win32ResultA Win32 error code, or 0 if there is none.
Returns
TRUE if the user wishes to continue with the current operation, otherwise FALSE.

Definition at line 472 of file support.c.

PHLIBAPI BOOLEAN NTAPI PhShowFileDialog ( _In_ HWND  hWnd,
_In_ PVOID  FileDialog 
)

Shows a file dialog to the user.

Parameters
hWndA handle to the parent window.
FileDialogThe file dialog.
Returns
TRUE if the user selected a file, FALSE if the user cancelled the operation or an error occurred.

Definition at line 3845 of file support.c.

PHLIBAPI INT NTAPI PhShowMessage ( _In_ HWND  hWnd,
_In_ ULONG  Type,
_In_ PWSTR  Format,
  ... 
)

Displays a message box.

Parameters
hWndThe owner window of the message box.
TypeThe type of message box to display.
FormatA format string.
Returns
The user's response.

Definition at line 355 of file support.c.

PHLIBAPI INT NTAPI PhShowMessage_V ( _In_ HWND  hWnd,
_In_ ULONG  Type,
_In_ PWSTR  Format,
_In_ va_list  ArgPtr 
)

Definition at line 369 of file support.c.

PHLIBAPI VOID NTAPI PhShowStatus ( _In_ HWND  hWnd,
_In_opt_ PWSTR  Message,
_In_ NTSTATUS  Status,
_In_opt_ ULONG  Win32Result 
)

Displays an error message for a NTSTATUS value or Win32 error code.

Parameters
hWndThe owner window of the message box.
MessageA message describing the operation that failed.
StatusA NTSTATUS value, or 0 if there is none.
Win32ResultA Win32 error code, or 0 if there is none.

Definition at line 423 of file support.c.

PHLIBAPI PPH_STRING NTAPI PhSidToStringSid ( _In_ PSID  Sid)

Gets a SDDL string representation of a SID.

Parameters
SidA SID to query.
Returns
A pointer to a string containing the SDDL representation of the SID. You must free the string using PhDereferenceObject() when you no longer need it. If an error occurs, the function returns NULL.

Definition at line 477 of file lsa.c.

PHLIBAPI VOID NTAPI PhStartProviderThread ( _Inout_ PPH_PROVIDER_THREAD  ProviderThread)

Starts a provider thread.

Parameters
ProviderThreadA pointer to a provider thread object.

Definition at line 244 of file provider.c.

PHLIBAPI _Callback_ PPH_STRING NTAPI PhStdGetClientIdName ( _In_ PCLIENT_ID  ClientId)

Definition at line 487 of file hndlinfo.c.

PHLIBAPI VOID NTAPI PhStopProviderThread ( _Inout_ PPH_PROVIDER_THREAD  ProviderThread)

Stops a provider thread.

Parameters
ProviderThreadA pointer to a provider thread object.

Definition at line 270 of file provider.c.

PHLIBAPI NTSTATUS NTAPI PhSuspendProcess ( _In_ HANDLE  ProcessHandle)

Suspends a process' threads.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_SUSPEND_RESUME access.

Definition at line 333 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhSuspendThread ( _In_ HANDLE  ThreadHandle,
_Out_opt_ PULONG  PreviousSuspendCount 
)

Suspends a thread.

Parameters
ThreadHandleA handle to a thread. The handle must have THREAD_SUSPEND_RESUME access.
PreviousSuspendCountA variable which receives the number of times the thread had been suspended.

Definition at line 409 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhTerminateProcess ( _In_ HANDLE  ProcessHandle,
_In_ NTSTATUS  ExitStatus 
)

Terminates a process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_TERMINATE access.
ExitStatusA status value that indicates why the process is being terminated.

Definition at line 303 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhTerminateThread ( _In_ HANDLE  ThreadHandle,
_In_ NTSTATUS  ExitStatus 
)

Terminates a thread.

Parameters
ThreadHandleA handle to a thread. The handle must have THREAD_TERMINATE access.
ExitStatusA status value that indicates why the thread is being terminated.

Definition at line 375 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhTransceiveNamedPipe ( _In_ HANDLE  FileHandle,
_In_opt_ HANDLE  Event,
_In_opt_ PIO_APC_ROUTINE  ApcRoutine,
_In_opt_ PVOID  ApcContext,
_Out_ PIO_STATUS_BLOCK  IoStatusBlock,
_In_reads_bytes_(InputBufferLength) PVOID  InputBuffer,
_In_ ULONG  InputBufferLength,
_Out_writes_bytes_(OutputBufferLength) PVOID  OutputBuffer,
_In_ ULONG  OutputBufferLength 
)

Definition at line 372 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhUnloadDllProcess ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_In_opt_ PLARGE_INTEGER  Timeout 
)

Causes a process to unload a DLL.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ and PROCESS_VM_WRITE access.
BaseAddressThe base address of the DLL to unload.
TimeoutThe timeout, in milliseconds, for the process to unload the DLL.

Definition at line 1891 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhUnloadDriver ( _In_opt_ PVOID  BaseAddress,
_In_opt_ PWSTR  Name 
)

Unloads a driver.

Parameters
BaseAddressThe base address of the driver. This parameter can be NULL if a value is specified in Name.
NameThe base name of the driver. This parameter can be NULL if a value is specified in BaseAddress and KProcessHacker is loaded.
Return values
STATUS_INVALID_PARAMETER_MIXBoth BaseAddress and Name were null, or Name was not specified and KProcessHacker is not loaded.
STATUS_OBJECT_NAME_NOT_FOUNDThe driver could not be found.

Definition at line 3227 of file native.c.

PHLIBAPI NTSTATUS NTAPI PhUnloadMappedArchive ( _Inout_ PPH_MAPPED_ARCHIVE  MappedArchive)

Definition at line 166 of file maplib.c.

PHLIBAPI NTSTATUS NTAPI PhUnloadMappedImage ( _Inout_ PPH_MAPPED_IMAGE  MappedImage)

Definition at line 163 of file mapimg.c.

NTSTATUS NTAPI PhUnloadRemoteMappedImage ( _Inout_ PPH_REMOTE_MAPPED_IMAGE  RemoteMappedImage)

Definition at line 536 of file mapimg.c.

PHLIBAPI NTSTATUS NTAPI PhUnlockFileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ PLARGE_INTEGER  Position,
_In_ PLARGE_INTEGER  Length 
)

Definition at line 1209 of file iosup.c.

PHLIBAPI VOID NTAPI PhUnregisterProvider ( _Inout_ PPH_PROVIDER_REGISTRATION  Registration)

Unregisters a provider.

Parameters
RegistrationA pointer to the registration object for a provider.
Remarks
The provider function may still be in execution once this function returns.

Definition at line 360 of file provider.c.

PHLIBAPI VOID NTAPI PhUpdateDosDevicePrefixes ( VOID  )

Updates the DOS device names array.

Definition at line 5366 of file native.c.

PHLIBAPI VOID NTAPI PhUpdateHash ( _Inout_ PPH_HASH_CONTEXT  Context,
_In_reads_bytes_(Length) PVOID  Buffer,
_In_ ULONG  Length 
)

Hashes a block of data.

Parameters
ContextA hashing context structure.
BufferThe block of data.
LengthThe number of bytes in the block.

Definition at line 4446 of file support.c.

PHLIBAPI VOID NTAPI PhUpdateMupDevicePrefixes ( VOID  )

Definition at line 5265 of file native.c.

PHLIBAPI VOID NTAPI PhVerifyFileStream ( _In_ PPH_FILE_STREAM  FileStream)

Verifies that a file stream's position matches the position held by the file object.

Definition at line 623 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWaitForMultipleObjectsAndPump ( _In_opt_ HWND  hWnd,
_In_ ULONG  NumberOfHandles,
_In_ PHANDLE  Handles,
_In_ ULONG  Timeout 
)

Waits on multiple objects while processing window messages.

Parameters
hWndThe window to process messages for, or NULL to process all messages for the current thread.
NumberOfHandlesThe number of handles specified in Handles. This must not be greater than MAXIMUM_WAIT_OBJECTS - 1.
HandlesAn array of handles.
TimeoutThe number of milliseconds to wait on the objects, or INFINITE for no timeout.
Remarks
The wait is always in WaitAny mode.

Definition at line 2226 of file support.c.

PHLIBAPI NTSTATUS NTAPI PhWaitForNamedPipe ( _In_opt_ PUNICODE_STRING  FileSystemName,
_In_ PUNICODE_STRING  Name,
_In_opt_ PLARGE_INTEGER  Timeout,
_In_ BOOLEAN  UseDefaultTimeout 
)

Definition at line 398 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteFileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_reads_bytes_(Length) PVOID  Buffer,
_In_ ULONG  Length 
)

Definition at line 884 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteStringAsUtf8FileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ PPH_STRINGREF  String 
)

Definition at line 1226 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteStringAsUtf8FileStream2 ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ PWSTR  String 
)

Definition at line 1234 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteStringAsUtf8FileStreamEx ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ PWSTR  Buffer,
_In_ SIZE_T  Length 
)

Definition at line 1246 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteStringFormatAsUtf8FileStream ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ _Printf_format_string_ PWSTR  Format,
  ... 
)

Definition at line 1335 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteStringFormatAsUtf8FileStream_V ( _Inout_ PPH_FILE_STREAM  FileStream,
_In_ _Printf_format_string_ PWSTR  Format,
_In_ va_list  ArgPtr 
)

Definition at line 1319 of file iosup.c.

PHLIBAPI NTSTATUS NTAPI PhWriteVirtualMemory ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_In_reads_bytes_(BufferSize) PVOID  Buffer,
_In_ SIZE_T  BufferSize,
_Out_opt_ PSIZE_T  NumberOfBytesWritten 
)

Copies memory from the current process into another process.

Parameters
ProcessHandleA handle to a process. The handle must have PROCESS_VM_WRITE access.
BaseAddressThe address to which memory is to be copied.
BufferA buffer which contains the memory to copy.
BufferSizeThe number of bytes to copy.
NumberOfBytesWrittenA variable which receives the number of bytes copied from the buffer.

Definition at line 536 of file native.c.

Variable Documentation

PPH_OBJECT_TYPE PhFileStreamType

Definition at line 27 of file iosup.c.

ULONG PhMaxSizeUnit

Definition at line 52 of file support.c.

WCHAR* PhServiceErrorControlStrings[4]

Definition at line 70 of file svcsup.c.

WCHAR* PhServiceStartTypeStrings[5]

Definition at line 68 of file svcsup.c.

WCHAR* PhServiceTypeStrings[6]

Definition at line 66 of file svcsup.c.

WCHAR* PhSizeUnitNames[7]

Definition at line 51 of file support.c.