#ifndef _NTPSAPI_H
// Processes
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub
This function is documented in Windows SDK.
Handle to process opened with PROCESS_QUERY_INFORMATION
access.
See PROCESS_INFORMATION_CLASS
.
Buffer for results.
Length of buffer. See PROCESS_INFORMATION_CLASS
for additional information.
Number of bytes needed, if ProcessInformationLength
was too small.
NtCreateProcess
NtOpenProcess
NtSetInformationProcess
PROCESS_INFORMATION_CLASS