Process Hacker
process.c File Reference
#include <kph.h>
#include <dyndata.h>

Go to the source code of this file.

Functions

NTSTATUS KpiOpenProcess (__out PHANDLE ProcessHandle, __in ACCESS_MASK DesiredAccess, __in PCLIENT_ID ClientId, __in KPROCESSOR_MODE AccessMode)
 Opens a process.
 
NTSTATUS KpiOpenProcessToken (__in HANDLE ProcessHandle, __in ACCESS_MASK DesiredAccess, __out PHANDLE TokenHandle, __in KPROCESSOR_MODE AccessMode)
 Opens the token of a process.
 
NTSTATUS KpiOpenProcessJob (__in HANDLE ProcessHandle, __in ACCESS_MASK DesiredAccess, __out PHANDLE JobHandle, __in KPROCESSOR_MODE AccessMode)
 Opens the job object of a process.
 
NTSTATUS KpiSuspendProcess (__in HANDLE ProcessHandle, __in KPROCESSOR_MODE AccessMode)
 Suspends a process.
 
NTSTATUS KpiResumeProcess (__in HANDLE ProcessHandle, __in KPROCESSOR_MODE AccessMode)
 Resumes a process.
 
NTSTATUS KphTerminateProcessInternal (__in PEPROCESS Process, __in NTSTATUS ExitStatus)
 Terminates a process using PsTerminateProcess.
 
NTSTATUS KpiTerminateProcess (__in HANDLE ProcessHandle, __in NTSTATUS ExitStatus, __in KPROCESSOR_MODE AccessMode)
 Terminates a process using PsTerminateProcess.
 
NTSTATUS KpiQueryInformationProcess (__in HANDLE ProcessHandle, __in KPH_PROCESS_INFORMATION_CLASS ProcessInformationClass, __out_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength, __out_opt PULONG ReturnLength, __in KPROCESSOR_MODE AccessMode)
 Queries process information.
 
NTSTATUS KpiSetInformationProcess (__in HANDLE ProcessHandle, __in KPH_PROCESS_INFORMATION_CLASS ProcessInformationClass, __in_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength, __in KPROCESSOR_MODE AccessMode)
 Sets process information.
 
BOOLEAN KphAcquireProcessRundownProtection (__in PEPROCESS Process)
 Prevents a process from terminating.
 
VOID KphReleaseProcessRundownProtection (__in PEPROCESS Process)
 Allows a process to terminate.
 

Function Documentation

BOOLEAN KphAcquireProcessRundownProtection ( __in PEPROCESS  Process)

Prevents a process from terminating.

Parameters
ProcessA process object.
Returns
TRUE if the function succeeded, FALSE if the process is currently terminating or the request is not supported.

Definition at line 904 of file process.c.

VOID KphReleaseProcessRundownProtection ( __in PEPROCESS  Process)

Allows a process to terminate.

Parameters
ProcessA process object.

Definition at line 927 of file process.c.

NTSTATUS KphTerminateProcessInternal ( __in PEPROCESS  Process,
__in NTSTATUS  ExitStatus 
)

Terminates a process using PsTerminateProcess.

Parameters
ProcessA process object.
ExitStatusA status value which indicates why the process is being terminated.

Definition at line 386 of file process.c.

NTSTATUS KpiOpenProcess ( __out PHANDLE  ProcessHandle,
__in ACCESS_MASK  DesiredAccess,
__in PCLIENT_ID  ClientId,
__in KPROCESSOR_MODE  AccessMode 
)

Opens a process.

Parameters
ProcessHandleA variable which receives the process handle.
DesiredAccessThe desired access to the process.
ClientIdThe identifier of a process or thread. If UniqueThread is present, the process of the identified thread will be opened. If UniqueProcess is present, the identified process will be opened.
AccessModeThe mode in which to perform access checks.

Definition at line 47 of file process.c.

NTSTATUS KpiOpenProcessJob ( __in HANDLE  ProcessHandle,
__in ACCESS_MASK  DesiredAccess,
__out PHANDLE  JobHandle,
__in KPROCESSOR_MODE  AccessMode 
)

Opens the job object of a process.

Parameters
ProcessHandleA handle to a process.
DesiredAccessThe desired access to the token.
JobHandleA variable which receives the job object handle.
AccessModeThe mode in which to perform access checks.

Definition at line 224 of file process.c.

NTSTATUS KpiOpenProcessToken ( __in HANDLE  ProcessHandle,
__in ACCESS_MASK  DesiredAccess,
__out PHANDLE  TokenHandle,
__in KPROCESSOR_MODE  AccessMode 
)

Opens the token of a process.

Parameters
ProcessHandleA handle to a process.
DesiredAccessThe desired access to the token.
TokenHandleA variable which receives the token handle.
AccessModeThe mode in which to perform access checks.

Definition at line 141 of file process.c.

NTSTATUS KpiQueryInformationProcess ( __in HANDLE  ProcessHandle,
__in KPH_PROCESS_INFORMATION_CLASS  ProcessInformationClass,
__out_bcount(ProcessInformationLength) PVOID  ProcessInformation,
__in ULONG  ProcessInformationLength,
__out_opt PULONG  ReturnLength,
__in KPROCESSOR_MODE  AccessMode 
)

Queries process information.

Parameters
ProcessHandleA handle to a process.
ProcessInformationClassThe type of information to query.
ProcessInformationThe buffer in which the information will be stored.
ProcessInformationLengthThe number of bytes available in ProcessInformation.
ReturnLengthA variable which receives the number of bytes required to be available in ProcessInformation.
AccessModeThe mode in which to perform access checks.

Definition at line 537 of file process.c.

NTSTATUS KpiResumeProcess ( __in HANDLE  ProcessHandle,
__in KPROCESSOR_MODE  AccessMode 
)

Resumes a process.

Parameters
ProcessHandleA handle to a process.
AccessModeThe mode in which to perform access checks.

Definition at line 348 of file process.c.

NTSTATUS KpiSetInformationProcess ( __in HANDLE  ProcessHandle,
__in KPH_PROCESS_INFORMATION_CLASS  ProcessInformationClass,
__in_bcount(ProcessInformationLength) PVOID  ProcessInformation,
__in ULONG  ProcessInformationLength,
__in KPROCESSOR_MODE  AccessMode 
)

Sets process information.

Parameters
ProcessHandleA handle to a process.
ProcessInformationClassThe type of information to set.
ProcessInformationA buffer which contains the information to set.
ProcessInformationLengthThe number of bytes present in ProcessInformation.
AccessModeThe mode in which to perform access checks.

Definition at line 747 of file process.c.

NTSTATUS KpiSuspendProcess ( __in HANDLE  ProcessHandle,
__in KPROCESSOR_MODE  AccessMode 
)

Suspends a process.

Parameters
ProcessHandleA handle to a process.
AccessModeThe mode in which to perform access checks.

Definition at line 311 of file process.c.

NTSTATUS KpiTerminateProcess ( __in HANDLE  ProcessHandle,
__in NTSTATUS  ExitStatus,
__in KPROCESSOR_MODE  AccessMode 
)

Terminates a process using PsTerminateProcess.

Parameters
ProcessHandleA handle to a process.
ExitStatusA status value which indicates why the process is being terminated.
AccessModeThe mode in which to perform access checks.

Definition at line 467 of file process.c.