phnatinl.h File Reference

Go to the source code of this file.

Functions
FORCEINLINE NTSTATUS	PhGetProcessBasicInformation (_In_ HANDLE ProcessHandle, _Out_ PPROCESS_BASIC_INFORMATION BasicInformation)
	Gets basic information for a process.
FORCEINLINE NTSTATUS	PhGetProcessExtendedBasicInformation (_In_ HANDLE ProcessHandle, _Out_ PPROCESS_EXTENDED_BASIC_INFORMATION ExtendedBasicInformation)
	Gets extended basic information for a process.
FORCEINLINE NTSTATUS	PhGetProcessTimes (_In_ HANDLE ProcessHandle, _Out_ PKERNEL_USER_TIMES Times)
	Gets time information for a process.
FORCEINLINE NTSTATUS	PhGetProcessSessionId (_In_ HANDLE ProcessHandle, _Out_ PULONG SessionId)
	Gets a process' session ID.
FORCEINLINE NTSTATUS	PhGetProcessIsWow64 (_In_ HANDLE ProcessHandle, _Out_ PBOOLEAN IsWow64)
	Gets whether a process is running under 32-bit emulation.
FORCEINLINE NTSTATUS	PhGetProcessPeb32 (_In_ HANDLE ProcessHandle, _Out_ PVOID *Peb32)
	Gets a process' WOW64 PEB address.
FORCEINLINE NTSTATUS	PhGetProcessIsBeingDebugged (_In_ HANDLE ProcessHandle, _Out_ PBOOLEAN IsBeingDebugged)
	Gets whether a process is being debugged.
FORCEINLINE NTSTATUS	PhGetProcessDebugObject (_In_ HANDLE ProcessHandle, _Out_ PHANDLE DebugObjectHandle)
	Gets a handle to a process' debug object.
FORCEINLINE NTSTATUS	PhGetProcessIoPriority (_In_ HANDLE ProcessHandle, _Out_ PULONG IoPriority)
	Gets a process' I/O priority.
FORCEINLINE NTSTATUS	PhGetProcessPagePriority (_In_ HANDLE ProcessHandle, _Out_ PULONG PagePriority)
	Gets a process' page priority.
FORCEINLINE NTSTATUS	PhGetProcessCycleTime (_In_ HANDLE ProcessHandle, _Out_ PULONG64 CycleTime)
	Gets a process' cycle count.
FORCEINLINE NTSTATUS	PhGetProcessConsoleHostProcessId (_In_ HANDLE ProcessHandle, _Out_ PHANDLE ConsoleHostProcessId)
FORCEINLINE NTSTATUS	PhSetProcessAffinityMask (_In_ HANDLE ProcessHandle, _In_ ULONG_PTR AffinityMask)
	Sets a process' affinity mask.
FORCEINLINE NTSTATUS	PhGetThreadBasicInformation (_In_ HANDLE ThreadHandle, _Out_ PTHREAD_BASIC_INFORMATION BasicInformation)
	Gets basic information for a thread.
FORCEINLINE NTSTATUS	PhGetThreadIoPriority (_In_ HANDLE ThreadHandle, _Out_ PULONG IoPriority)
	Gets a thread's I/O priority.
FORCEINLINE NTSTATUS	PhGetThreadPagePriority (_In_ HANDLE ThreadHandle, _Out_ PULONG PagePriority)
	Gets a thread's page priority.
FORCEINLINE NTSTATUS	PhGetThreadCycleTime (_In_ HANDLE ThreadHandle, _Out_ PULONG64 CycleTime)
	Gets a thread's cycle count.
FORCEINLINE NTSTATUS	PhSetThreadAffinityMask (_In_ HANDLE ThreadHandle, _In_ ULONG_PTR AffinityMask)
	Sets a thread's affinity mask.
FORCEINLINE NTSTATUS	PhGetJobBasicAndIoAccounting (_In_ HANDLE JobHandle, _Out_ PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION BasicAndIoAccounting)
FORCEINLINE NTSTATUS	PhGetJobBasicLimits (_In_ HANDLE JobHandle, _Out_ PJOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimits)
FORCEINLINE NTSTATUS	PhGetJobExtendedLimits (_In_ HANDLE JobHandle, _Out_ PJOBOBJECT_EXTENDED_LIMIT_INFORMATION ExtendedLimits)
FORCEINLINE NTSTATUS	PhGetJobBasicUiRestrictions (_In_ HANDLE JobHandle, _Out_ PJOBOBJECT_BASIC_UI_RESTRICTIONS BasicUiRestrictions)
FORCEINLINE NTSTATUS	PhGetTokenSessionId (_In_ HANDLE TokenHandle, _Out_ PULONG SessionId)
	Gets a token's session ID.
FORCEINLINE NTSTATUS	PhGetTokenElevationType (_In_ HANDLE TokenHandle, _Out_ PTOKEN_ELEVATION_TYPE ElevationType)
	Gets a token's elevation type.
FORCEINLINE NTSTATUS	PhGetTokenIsElevated (_In_ HANDLE TokenHandle, _Out_ PBOOLEAN Elevated)
	Gets whether a token is elevated.
FORCEINLINE NTSTATUS	PhGetTokenStatistics (_In_ HANDLE TokenHandle, _Out_ PTOKEN_STATISTICS Statistics)
	Gets a token's statistics.
FORCEINLINE NTSTATUS	PhGetTokenSource (_In_ HANDLE TokenHandle, _Out_ PTOKEN_SOURCE Source)
	Gets a token's source.
FORCEINLINE NTSTATUS	PhGetTokenLinkedToken (_In_ HANDLE TokenHandle, _Out_ PHANDLE LinkedTokenHandle)
	Gets a handle to a token's linked token.
FORCEINLINE NTSTATUS	PhGetTokenIsVirtualizationAllowed (_In_ HANDLE TokenHandle, _Out_ PBOOLEAN IsVirtualizationAllowed)
	Gets whether virtualization is allowed for a token.
FORCEINLINE NTSTATUS	PhGetTokenIsVirtualizationEnabled (_In_ HANDLE TokenHandle, _Out_ PBOOLEAN IsVirtualizationEnabled)
	Gets whether virtualization is enabled for a token.
FORCEINLINE NTSTATUS	PhGetEventBasicInformation (_In_ HANDLE EventHandle, _Out_ PEVENT_BASIC_INFORMATION BasicInformation)
FORCEINLINE NTSTATUS	PhGetMutantBasicInformation (_In_ HANDLE MutantHandle, _Out_ PMUTANT_BASIC_INFORMATION BasicInformation)
FORCEINLINE NTSTATUS	PhGetMutantOwnerInformation (_In_ HANDLE MutantHandle, _Out_ PMUTANT_OWNER_INFORMATION OwnerInformation)
FORCEINLINE NTSTATUS	PhGetSectionBasicInformation (_In_ HANDLE SectionHandle, _Out_ PSECTION_BASIC_INFORMATION BasicInformation)
FORCEINLINE NTSTATUS	PhGetSemaphoreBasicInformation (_In_ HANDLE SemaphoreHandle, _Out_ PSEMAPHORE_BASIC_INFORMATION BasicInformation)
FORCEINLINE NTSTATUS	PhGetTimerBasicInformation (_In_ HANDLE TimerHandle, _Out_ PTIMER_BASIC_INFORMATION BasicInformation)

Function Documentation

FORCEINLINE NTSTATUS PhGetEventBasicInformation	(	_In_ HANDLE	EventHandle,
		_Out_ PEVENT_BASIC_INFORMATION	BasicInformation
	)

Definition at line 838 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetJobBasicAndIoAccounting	(	_In_ HANDLE	JobHandle,
		_Out_ PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION	BasicAndIoAccounting
	)

Definition at line 527 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetJobBasicLimits	(	_In_ HANDLE	JobHandle,
		_Out_ PJOBOBJECT_BASIC_LIMIT_INFORMATION	BasicLimits
	)

Definition at line 543 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetJobBasicUiRestrictions	(	_In_ HANDLE	JobHandle,
		_Out_ PJOBOBJECT_BASIC_UI_RESTRICTIONS	BasicUiRestrictions
	)

Definition at line 575 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetJobExtendedLimits	(	_In_ HANDLE	JobHandle,
		_Out_ PJOBOBJECT_EXTENDED_LIMIT_INFORMATION	ExtendedLimits
	)

Definition at line 559 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetMutantBasicInformation	(	_In_ HANDLE	MutantHandle,
		_Out_ PMUTANT_BASIC_INFORMATION	BasicInformation
	)

Definition at line 854 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetMutantOwnerInformation	(	_In_ HANDLE	MutantHandle,
		_Out_ PMUTANT_OWNER_INFORMATION	OwnerInformation
	)

Definition at line 870 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessBasicInformation	(	_In_ HANDLE	ProcessHandle,
		_Out_ PPROCESS_BASIC_INFORMATION	BasicInformation
	)

Gets basic information for a process.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
BasicInformation	A variable which receives the information.

Definition at line 20 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessConsoleHostProcessId	(	_In_ HANDLE	ProcessHandle,
		_Out_ PHANDLE	ConsoleHostProcessId
	)

Definition at line 342 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessCycleTime	(	_In_ HANDLE	ProcessHandle,
		_Out_ PULONG64	CycleTime
	)

Gets a process' cycle count.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
CycleTime	A variable which receives the 64-bit cycle time.

Definition at line 316 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessDebugObject	(	_In_ HANDLE	ProcessHandle,
		_Out_ PHANDLE	DebugObjectHandle
	)

Gets a handle to a process' debug object.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_INFORMATION access.
DebugObjectHandle	A variable which receives a handle to the debug object associated with the process. You must close the handle when you no longer need it.

Return values

STATUS_PORT_NOT_SET

The process is not being debugged and has no associated debug object.

Definition at line 234 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessExtendedBasicInformation	(	_In_ HANDLE	ProcessHandle,
		_Out_ PPROCESS_EXTENDED_BASIC_INFORMATION	ExtendedBasicInformation
	)

Gets extended basic information for a process.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
ExtendedBasicInformation	A variable which receives the information.

Definition at line 43 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessIoPriority	(	_In_ HANDLE	ProcessHandle,
		_Out_ PULONG	IoPriority
	)

Gets a process' I/O priority.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
IoPriority	A variable which receives the I/O priority of the process.

Definition at line 258 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessIsBeingDebugged	(	_In_ HANDLE	ProcessHandle,
		_Out_ PBOOLEAN	IsBeingDebugged
	)

Gets whether a process is being debugged.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_INFORMATION access.
IsBeingDebugged	A variable which receives a boolean indicating whether the process is being debugged.

Definition at line 196 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessIsWow64	(	_In_ HANDLE	ProcessHandle,
		_Out_ PBOOLEAN	IsWow64
	)

Gets whether a process is running under 32-bit emulation.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
IsWow64	A variable which receives a boolean indicating whether the process is 32-bit.

Definition at line 127 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessPagePriority	(	_In_ HANDLE	ProcessHandle,
		_Out_ PULONG	PagePriority
	)

Gets a process' page priority.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
PagePriority	A variable which receives the page priority of the process.

Definition at line 282 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessPeb32	(	_In_ HANDLE	ProcessHandle,
		_Out_ PVOID *	Peb32
	)

Gets a process' WOW64 PEB address.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
Peb32	A variable which receives the base address of the process' WOW64 PEB. If the process is 64-bit, the variable receives NULL.

Definition at line 162 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessSessionId	(	_In_ HANDLE	ProcessHandle,
		_Out_ PULONG	SessionId
	)

Gets a process' session ID.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
SessionId	A variable which receives the process' session ID.

Definition at line 92 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetProcessTimes	(	_In_ HANDLE	ProcessHandle,
		_Out_ PKERNEL_USER_TIMES	Times
	)

Gets time information for a process.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_QUERY_LIMITED_INFORMATION access.
Times	A variable which receives the information.

Definition at line 68 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetSectionBasicInformation	(	_In_ HANDLE	SectionHandle,
		_Out_ PSECTION_BASIC_INFORMATION	BasicInformation
	)

Definition at line 886 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetSemaphoreBasicInformation	(	_In_ HANDLE	SemaphoreHandle,
		_Out_ PSEMAPHORE_BASIC_INFORMATION	BasicInformation
	)

Definition at line 902 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetThreadBasicInformation	(	_In_ HANDLE	ThreadHandle,
		_Out_ PTHREAD_BASIC_INFORMATION	BasicInformation
	)

Gets basic information for a thread.

Parameters

ThreadHandle	A handle to a thread. The handle must have THREAD_QUERY_LIMITED_INFORMATION access.
BasicInformation	A variable which receives the information.

Definition at line 397 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetThreadCycleTime	(	_In_ HANDLE	ThreadHandle,
		_Out_ PULONG64	CycleTime
	)

Gets a thread's cycle count.

Parameters

ThreadHandle	A handle to a thread. The handle must have THREAD_QUERY_LIMITED_INFORMATION access.
CycleTime	A variable which receives the 64-bit cycle time.

Definition at line 479 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetThreadIoPriority	(	_In_ HANDLE	ThreadHandle,
		_Out_ PULONG	IoPriority
	)

Gets a thread's I/O priority.

Parameters

ThreadHandle	A handle to a thread. The handle must have THREAD_QUERY_LIMITED_INFORMATION access.
IoPriority	A variable which receives the I/O priority of the thread.

Definition at line 421 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetThreadPagePriority	(	_In_ HANDLE	ThreadHandle,
		_Out_ PULONG	PagePriority
	)

Gets a thread's page priority.

Parameters

ThreadHandle	A handle to a thread. The handle must have THREAD_QUERY_LIMITED_INFORMATION access.
PagePriority	A variable which receives the page priority of the thread.

Definition at line 445 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTimerBasicInformation	(	_In_ HANDLE	TimerHandle,
		_Out_ PTIMER_BASIC_INFORMATION	BasicInformation
	)

Definition at line 918 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenElevationType	(	_In_ HANDLE	TokenHandle,
		_Out_ PTOKEN_ELEVATION_TYPE	ElevationType
	)

Gets a token's elevation type.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
ElevationType	A variable which receives the elevation type.

Definition at line 625 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenIsElevated	(	_In_ HANDLE	TokenHandle,
		_Out_ PBOOLEAN	Elevated
	)

Gets whether a token is elevated.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
Elevated	A variable which receives a boolean indicating whether the token is elevated.

Definition at line 651 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenIsVirtualizationAllowed	(	_In_ HANDLE	TokenHandle,
		_Out_ PBOOLEAN	IsVirtualizationAllowed
	)

Gets whether virtualization is allowed for a token.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
IsVirtualizationAllowed	A variable which receives a boolean indicating whether virtualization is allowed for the token.

Definition at line 775 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenIsVirtualizationEnabled	(	_In_ HANDLE	TokenHandle,
		_Out_ PBOOLEAN	IsVirtualizationEnabled
	)

Gets whether virtualization is enabled for a token.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
IsVirtualizationEnabled	A variable which receives a boolean indicating whether virtualization is enabled for the token.

Definition at line 811 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenLinkedToken	(	_In_ HANDLE	TokenHandle,
		_Out_ PHANDLE	LinkedTokenHandle
	)

Gets a handle to a token's linked token.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
LinkedTokenHandle	A variable which receives a handle to the linked token. You must close the handle using NtClose() when you no longer need it.

Definition at line 739 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenSessionId	(	_In_ HANDLE	TokenHandle,
		_Out_ PULONG	SessionId
	)

Gets a token's session ID.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
SessionId	A variable which receives the session ID.

Definition at line 599 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenSource	(	_In_ HANDLE	TokenHandle,
		_Out_ PTOKEN_SOURCE	Source
	)

Gets a token's source.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY_SOURCE access.
Source	A variable which receives the token's source.

Definition at line 712 of file phnatinl.h.

FORCEINLINE NTSTATUS PhGetTokenStatistics	(	_In_ HANDLE	TokenHandle,
		_Out_ PTOKEN_STATISTICS	Statistics
	)

Gets a token's statistics.

Parameters

TokenHandle	A handle to a token. The handle must have TOKEN_QUERY access.
Statistics	A variable which receives the token's statistics.

Definition at line 686 of file phnatinl.h.

FORCEINLINE NTSTATUS PhSetProcessAffinityMask	(	_In_ HANDLE	ProcessHandle,
		_In_ ULONG_PTR	AffinityMask
	)

Sets a process' affinity mask.

Parameters

ProcessHandle	A handle to a process. The handle must have PROCESS_SET_INFORMATION access.
AffinityMask	The new affinity mask.

Definition at line 375 of file phnatinl.h.

FORCEINLINE NTSTATUS PhSetThreadAffinityMask	(	_In_ HANDLE	ThreadHandle,
		_In_ ULONG_PTR	AffinityMask
	)

Sets a thread's affinity mask.

Parameters

ThreadHandle	A handle to a thread. The handle must have THREAD_SET_LIMITED_INFORMATION access.
AffinityMask	The new affinity mask.

Definition at line 512 of file phnatinl.h.