Windows内核进程&线程函数大全

1.    PEPROCESS NTAPI PsGetCurrentProcess
2.    HANDLE NTAPI PsGetCurrentProcessId(VOID)    
3.    variable PsGetCurrentThreadId
4.    define PsGetCurrentThread()/ GetCurrentThreadId
5.    function PsGetCurrentProcessWin32Process(VOID)
6.    function PsGetCurrentProcessId(VOID)
7.    function PsGetCurrentProcessSessionId(VOID)
8.    function PsGetProcessExitTime(VOID)
9.    function PsGetCurrentProcessWin32Process(VOID)
10.    function PsGetCurrentProcessSessionId(VOID)
11.    function PsGetCurrentThreadWin32Thread(VOID)
12.    function PsGetCurrentThreadProcessId(VOID)
13.    function PsGetCurrentThreadTeb(VOID)
14.    function PsGetCurrentProcessId(VOID)
15.    function PsGetCurrentThreadProcess(VOID)
16.    function PsGetCurrentThreadStackLimit(VOID)
17.    function PsGetCurrentThreadStackBase(VOID)
18.    function PsGetCurrentThreadTeb(VOID)
19.    function PsGetCurrentThreadWin32Thread(VOID)
20.    function PsGetCurrentThreadId(VOID)
21.    function PsGetCurrentThreadProcessId(VOID)
22.    function PsGetCurrentThreadPreviousMode(VOID)
23.    function PsGetJobUIRestrictionsClass(PEJOB Job)
24.    function PsGetJobLock(PEJOB Job)
25.    function PsGetJobSessionId(PEJOB Job)
26.    function PsGetProcessInheritedFromUniqueProcessId(PEPROCESS Process)
27.    function PsGetProcessWin32Process(PEPROCESS Process)
28.    function PsGetProcessPeb(PEPROCESS Process)
29.    function PsGetProcessImageFileName(PEPROCESS Process)
30.    function PsGetProcessSecurityPort(PEPROCESS Process)
31.    function PsGetProcessPriorityClass(PEPROCESS Process)
32.    function PsGetProcessExitProcessCalled(PEPROCESS Process)
33.    function PsGetProcessJob(PEPROCESS Process)
34.    function PsGetProcessExitStatus(PEPROCESS Process)
35.    function PsGetProcessCreateTimeQuadPart(PEPROCESS Process)
36.    function PsGetProcessId(PEPROCESS Process)
37.    function PsGetProcessDebugPort(PEPROCESS Process)
38.    function PsGetProcessSectionBaseAddress(PEPROCESS Process)
39.    function PsGetProcessWin32WindowStation(PEPROCESS Process)
40.    function PsGetNextProcess(IN PEPROCESS OldProcess)

41.    function PsGetProcessSessionId(IN PEPROCESS Process)
42.    function PsGetProcessSessionIdEx(IN PEPROCESS Process)
43.    function PsGetThreadProcess(_In_ PETHREAD Thread)
44.    function PsGetThreadWin32Thread(_In_ PETHREAD Thread)
45.    function PsGetThreadHardErrorsAreDisabled(_In_ PETHREAD Thread)
46.    function PsGetThreadId(_In_ PETHREAD Thread)
47.    function PsGetProcessExitProcessCalled(_In_ PEPROCESS Process)
48.    function PsGetProcessExitStatus(_In_ PEPROCESS Process)
49.    function PsGetProcessSecurityPort(_In_ PEPROCESS Process)
50.    function PsGetThreadTeb(_In_ PETHREAD Thread)
51.    function PsGetProcessWin32WindowStation(_In_ PEPROCESS Process)
52.    function PsGetProcessInheritedFromUniqueProcessId(_In_ PEPROCESS Process)
53.    function PsGetThreadProcess(_In_ PETHREAD Thread)
54.    function PsGetProcessSessionId(_In_ PEPROCESS Process)
55.    function PsGetProcessWin32Process(_In_ PEPROCESS Process)
56.    function PsGetThreadFreezeCount(_In_ PETHREAD Thread)
57.    function PsGetThreadProcess(_In_ PETHREAD Thread)
58.    function PSGetPropertyDescriptionListFromString(LPCWSTR, REFIID, void **)
59.    function PSGetPropertyDescription(REFPROPERTYKEY, REFIID, void **)
60.    function PsGetThreadFreezeCount(IN PETHREAD Thread)
61.    function PsGetThreadTeb(IN PETHREAD Thread)
62.    function PsGetThreadId(IN PETHREAD Thread)
63.    function PsGetThreadHardErrorsAreDisabled(IN PETHREAD Thread)
64.    function PsGetThreadSessionId(IN PETHREAD Thread)
65.    function PsGetThreadWin32Thread(IN PETHREAD Thread)
66.    function PsGetThreadProcessId(IN PETHREAD Thread)
67.    function PsGetThreadProcess(IN PETHREAD Thread)
68.    function PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion(_Out_ HANDLE *OutProcessId)
69.    function PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
70.    function PSGetPropertyKeyFromName(PCWSTR name, PROPERTYKEY *key)
71.    function PSGetPropertySystem(REFIID riid, void **obj)
72.    define PsGetVersion(a, b, c, d)
73.    function PSGetPropertyDescription(REFPROPERTYKEY propkey, REFIID riid, void **ppv)
74.    function PSGetPropertyDescriptionListFromString(LPCWSTR proplist, REFIID riid, void **ppv)
75.    function PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
76.    function PsGetNextProcessThread(IN PEPROCESS Process, IN PETHREAD Thread OPTIONAL)
77.    function PsGetContextThread(IN PETHREAD Thread, IN OUT PCONTEXT ThreadContext, IN KPROCESSOR_MODE PreviousMode)
78.    function PsGetVersion(OUT PULONG MajorVersion OPTIONAL, OUT PULONG MinorVersion OPTIONAL, OUT PULONG BuildNumber OPTIONAL, OUT PUNICODE_STRING CSDVersion OPTIONAL)
79.    function PsGetVersion(OUT PULONG MajorVersion OPTIONAL, OUT PULONG MinorVersion OPTIONAL, OUT PULONG BuildNumber OPTIONAL, OUT PUNICODE_STRING CSDVersion OPTIONAL)
80.    function ID3D10Device::PSGetShader([out] ID3D10PixelShader **ppPixelShader)

• PsGetCurrentProcess/IoGetCurrentProcess

PEPROCESS NTAPI IoGetCurrentProcess    (VOID)
{
    /* Return the current thread's process */
    return (PEPROCESS)PsGetCurrentThread()->Tcb.ApcState.Process;
}

• PsGetCurrentProcessId

HANDLE NTAPI PsGetCurrentProcessId(VOID)
{
    return (HANDLE)PsGetCurrentProcess()->UniqueProcessId;
}

• GetCurrentThreadId

DWORD WINAPI GetCurrentThreadId(VOID)
{
    return HandleToUlong(NtCurrentTeb()->ClientId.UniqueThread);
}

#define NtCurrentTeb(void)       NtXCurrentTeb

• PsGetCurrentProcessSessionId

ULONG NTAPI PsGetCurrentProcessSessionId    (    VOID         )    
{
    return MmGetSessionId(PsGetCurrentProcess());
}

ULONG NTAPI MmGetSessionId(    IN PEPROCESS Process)
{
    PMM_SESSION_SPACE SessionGlobal;

    /* The session leader is always session zero */
    if (Process->Vm.Flags.SessionLeader == 1) return 0;

    /* Otherwise, get the session global, and read the session ID from it */
    SessionGlobal = (PMM_SESSION_SPACE)Process->Session;
    if (!SessionGlobal) return 0;
    return SessionGlobal->SessionId;
}