Undocumented functions of NTDLL

2OOO, 13 November

NTSYSAPI 
NTSTATUS
NTAPI


NtOpenProcess(



  OUT PHANDLE             ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN PCLIENT_ID           ClientId );

AccessMask

• PROCESS_TERMINATE
• PROCESS_CREATE_THREAD
• PROCESS_SET_SESSIONID
• PROCESS_VM_OPERATION
• PROCESS_VM_READ
• PROCESS_VM_WRITE
• PROCESS_DUP_HANDLE
• PROCESS_CREATE_PROCESS
• PROCESS_SET_QUOTA
• PROCESS_SET_INFORMATION
• PROCESS_QUERY_INFORMATION
• PROCESS_ALL_ACCESS

ObjectAttributes

For standard processes, all fields of ObjectAttributes should be NULL.

ClientId

Process id and thread id must be fill with valid values. 

Documented by:

Tomasz Nowak

Library: ntdll.lib

NtCreateProcess

NtTerminateProcess