11 OUT PVOID SystemInformation,
12 IN ULONG SystemInformationLength,
13 OUT PULONG ReturnLength OPTIONAL
21 IN PVOID SystemInformation,
22 IN ULONG SystemInformationLength
30 IN PROCESSINFOCLASS ProcessInformationClass,
31 OUT PVOID ProcessInformation,
32 IN ULONG ProcessInformationLength,
33 IN PULONG ReturnLength
40 IN HANDLE ThreadHandle,
41 IN THREADINFOCLASS ThreadInformationClass,
42 OUT PVOID ThreadInformation,
43 IN ULONG ThreadInformationLength,
44 OUT PULONG ReturnLength OPTIONAL
56 OUT PULONG ResultLength
79 IN PEPROCESS FromProcess,
81 IN PEPROCESS ToProcess,
84 IN KPROCESSOR_MODE PreviousMode,
85 OUT PSIZE_T NumberOfBytesCopied
114 typedef VOID( NTAPI *PKNORMAL_ROUTINE )
121 typedef VOID( NTAPI* PKKERNEL_ROUTINE)
130 typedef VOID( NTAPI *PKRUNDOWN_ROUTINE )( PRKAPC Apc );
139 IN PKKERNEL_ROUTINE KernelRoutine,
140 IN PKRUNDOWN_ROUTINE RundownRoutine,
142 IN KPROCESSOR_MODE ApcMode,
166 BOOLEAN MappedAsImage,
167 USHORT DirectoryEntry,
NTKERNELAPI BOOLEAN NTAPI KeInsertQueueApc(PKAPC Apc, PVOID SystemArgument1, PVOID SystemArgument2, KPRIORITY Increment)
NTSYSAPI PVOID NTAPI PsGetProcessWow64Process(IN PEPROCESS Process)
Definition: NativeStructs.h:301
NTKERNELAPI NTSTATUS NTAPI MmCopyVirtualMemory(IN PEPROCESS FromProcess, IN PVOID FromAddress, IN PEPROCESS ToProcess, OUT PVOID ToAddress, IN SIZE_T BufferSize, IN KPROCESSOR_MODE PreviousMode, OUT PSIZE_T NumberOfBytesCopied)
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T StackZeroBits
Definition: Private.h:115
typedef NTSTATUS(NTAPI *fnNtCreateThreadEx)(OUT PHANDLE hThread
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID lpParameter
Definition: Private.h:115
NTSYSAPI PVOID NTAPI PsGetCurrentProcessWow64Process()
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread(IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
NTSYSAPI PVOID NTAPI RtlImageDirectoryEntryToData(PVOID ImageBase, BOOLEAN MappedAsImage, USHORT DirectoryEntry, PULONG Size)
NTSYSAPI NTSTATUS NTAPI ZwQueryVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID Buffer, IN ULONG Length, OUT PULONG ResultLength)
PKNORMAL_ROUTINE * NormalRoutine
Definition: Imports.h:124
PVOID SystemArgument1
Definition: Imports.h:117
NTSYSAPI PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader(PVOID Base)
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T IN SIZE_T IN SIZE_T SizeOfStackReserve
Definition: Private.h:115
IN ACCESS_MASK IN PVOID IN HANDLE ProcessHandle
Definition: Private.h:115
NTSTATUS NTAPI ZwCreateThreadEx(OUT PHANDLE hThread, IN ACCESS_MASK DesiredAccess, IN PVOID ObjectAttributes, IN HANDLE ProcessHandle, IN PVOID lpStartAddress, IN PVOID lpParameter, IN ULONG Flags, IN SIZE_T StackZeroBits, IN SIZE_T SizeOfStackCommit, IN SIZE_T SizeOfStackReserve, IN PNT_PROC_THREAD_ATTRIBUTE_LIST AttributeList)
Definition: Private.c:240
Definition: NativeStructs.h:387
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID lpStartAddress
Definition: Private.h:115
PKNORMAL_ROUTINE PVOID * NormalContext
Definition: Imports.h:124
NTSYSAPI BOOLEAN NTAPI PsIsProtectedProcess(IN PEPROCESS Process)
NTSYSAPI PPEB NTAPI PsGetProcessPeb(IN PEPROCESS Process)
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG Flags
Definition: Private.h:115
NTSYSAPI NTSTATUS NTAPI ZwSetSystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength)
typedef VOID(NTAPI *PKNORMAL_ROUTINE)(PVOID NormalContext
NTKERNELAPI BOOLEAN NTAPI KeTestAlertThread(IN KPROCESSOR_MODE AlertMode)
NTKERNELAPI VOID NTAPI KeInitializeApc(IN PKAPC Apc, IN PKTHREAD Thread, IN KAPC_ENVIRONMENT ApcStateIndex, IN PKKERNEL_ROUTINE KernelRoutine, IN PKRUNDOWN_ROUTINE RundownRoutine, IN PKNORMAL_ROUTINE NormalRoutine, IN KPROCESSOR_MODE ApcMode, IN PVOID NormalContext)
IN ACCESS_MASK IN PVOID ObjectAttributes
Definition: Private.h:115
NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL)
enum _KAPC_ENVIRONMENT KAPC_ENVIRONMENT
enum _MEMORY_INFORMATION_CLASS MEMORY_INFORMATION_CLASS
enum _SYSTEM_INFORMATION_CLASS SYSTEM_INFORMATION_CLASS
PVOID PVOID SystemArgument2
Definition: Imports.h:117
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, IN PULONG ReturnLength)
IN ACCESS_MASK DesiredAccess
Definition: Private.h:115
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T IN SIZE_T SizeOfStackCommit
Definition: Private.h:115