Undocumented functions of NTDLL

2OO1, 6 March


PROCESS_INFORMATION_CLASS
PROCESS_INFORMATION_CLASS

typedef enum _PROCESS_INFORMATION_CLASS {




    ProcessBasicInformation,
    ProcessQuotaLimits,
    ProcessIoCounters,
    ProcessVmCounters,
    ProcessTimes,
    ProcessBasePriority,
    ProcessRaisePriority,
    ProcessDebugPort,
    ProcessExceptionPort,
    ProcessAccessToken,
    ProcessLdtInformation,
    ProcessLdtSize,
    ProcessDefaultHardErrorMode,
    ProcessIoPortHandlers,
    ProcessPooledUsageAndLimits,
    ProcessWorkingSetWatch,
    ProcessUserModeIOPL,
    ProcessEnableAlignmentFaultFixup,
    ProcessPriorityClass,
    ProcessWx86Information,
    ProcessHandleCount,
    ProcessAffinityMask,
    ProcessPriorityBoost,
    MaxProcessInfoClass


} PROCESS_INFORMATION_CLASS, *PPROCESS_INFORMATION_CLASS;



Enumeration type PROCESS_INFORMATION_CLASS is used in a calls to NtQueryInformationProcess and NtSetInformationProcess. Structures for sending or receiving data are accessable below, separatelly for target information class.


Action
 : Query
Buffer size
 : 0x018
Structure
 : PROCESS_BASIC_INFORMATION
Action
 : Query, Set
Buffer size
 : 0x020
Structure
 : QUOTA_LIMITS
Action
 : Query
Buffer size
 : ???
Structure
 : IO_COUNTERS
Action
 : Query
Buffer size
 : 0x02C
Structure
 : VM_COUNTERS
Action
 : Query
Buffer size
 : 0x020
Structure
 : KERNEL_USER_TIMES
Action
 : Set
Buffer size
 : 0x004
Buffer
 : KPRIORITY
Comment
 : Sets process' Base Priority.
Action
 : Set
Buffer size
 : 0x004
Buffer
 : KPRIORITY
Comment
 : Sets process' Raise Priority.
Action
 : Query, Set
Buffer size
 : 0x004
Buffer
 : HANDLE
Comment
 : Queries and sets process' Debug Port. See also NtCreatePort.
Action
 : Set
Buffer size
 : 0x004
Buffer
 : HANDLE
Comment
 : Sets process' Exception Port. See also NtCreatePort.
Action
 : Set
Buffer size
 : 0x008
Structure
 : PROCESS_ACCESS_TOKEN
Action
 : Query
Buffer size
 : ???
Structure
 : LDT_ENTRY

Action
 : Set
Buffer size
 : 0x010
Structure
 : LDT_ENTRY
Action
 : Set
Buffer size
 : 0x004
Buffer
 : ULONG
Comment
 : Sets process' Local Description Table size. See also NtSetLdtEntries function.
Action
 : Query, Set
Buffer size
 : 0x004
Buffer
 : ULONG
Comment
 : ???
Action
 : Set
Buffer size
 : ???
Structure
 : ???
Action
 : Query
Buffer size
 : 0x024
Structure
 : POOLED_USAGE_AND_LIMITS
Action
 : Query
Buffer size
 : ???
Structure
 : PROCESS_WS_WATCH_INFORMATION

Action
 : Set
Buffer size
 : ???
Structure
 :
Action
 : Set
Buffer size
 : ???
Structure
 :
Action
 : Set
Buffer size
 : 0x001
Buffer
 : BOOLEAN
Comment
 : If set, enables automatic fixup of memory dissaligments.
Action
 : Set
Buffer size
 : 0x002
Buffer
 : WORD
Comment
 : Sets process' Priority Class.
Action
 : Query
Buffer size
 : 0x004
Buffer
 : ULONG
Comment
 : ???
Action
 : Query
Buffer size
 : 0x004
Buffer
 : ULONG
Comment
 : Retrives Handle's count for process.
Action
 : Set
Buffer size
 : 0x0
Buffer
 : KAFFINITY
Comment
 : Sets process' Affinity Mask.
Action
 : Query, Set
Buffer size
 : 0x004
Buffer
 : KPRIORITY
Comment
 : Queries and sets process' Priority Boost.



Documented by:
Tomasz Nowak
Sven B. Schreiber



Requirements:
Library: ntdll.lib


See also:
NtQueryInformationProcess
NtSetInformationProcess