Undocumented functions of NTDLL

2OOO, 2 December

typedef struct _RTL_USER_PROCESS_INFORMATION {


  ULONG                   Size;
  HANDLE                  ProcessHandle;
  HANDLE                  ThreadHandle;
  CLIENT_ID               ClientId;
  SECTION_IMAGE_INFORMATION ImageInformation;



} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;

Size
Size of structure, in bytes.

ProcessHandle
HANDLE to newly created Process object.

ThreadHandle
HANDLE to Thread object representing main thread in process.

ClientId
Unique Id of process and thread.

ImageInformation
Some information from PE header. Created in result of call NtQuerySection with SectionImageInformation class.