#ifndef _NTPSAPI_H
// Processes
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHubThis function is documented in Windows SDK.
Handle to process opened with PROCESS_QUERY_INFORMATION access.
See PROCESS_INFORMATION_CLASS.
Buffer for results.
Length of buffer. See PROCESS_INFORMATION_CLASS for additional information.
Number of bytes needed, if ProcessInformationLength was too small.
NtCreateProcessNtOpenProcessNtSetInformationProcessPROCESS_INFORMATION_CLASS