| 24 | } |
| 25 | |
| 26 | PPEB PsGetProcessPeb(IN PEPROCESS Process) |
| 27 | { |
| 28 | UNICODE_STRING funcName; |
| 29 | typedef PPEB(NTAPI* PsGetProcessPeb_t)(PEPROCESS Process); |
| 30 | static PsGetProcessPeb_t fPsGetProcessPeb = NULL; |
| 31 | |
| 32 | if (fPsGetProcessPeb == NULL) |
| 33 | { |
| 34 | RtlInitUnicodeString(&funcName, L"PsGetProcessPeb"); |
| 35 | fPsGetProcessPeb = RCAST<PsGetProcessPeb_t>(MmGetSystemRoutineAddress(&funcName)); |
| 36 | } |
| 37 | |
| 38 | return fPsGetProcessPeb(Process); |
| 39 | } |
| 40 | |
| 41 | NTSTATUS NtQueryInformationProcess(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength) |
| 42 | { |
nothing calls this directly
no outgoing calls
no test coverage detected