WRK-NtOpenProcess 的流程草图~

NTSTATUS

NtOpenProcess (

__out PHANDLE ProcessHandle,

__in ACCESS_MASK DesiredAccess,

__in POBJECT_ATTRIBUTES ObjectAttributes,

__in_opt PCLIENT_ID ClientId

)

/*++

Routine Description:

This function opens a handle to a process object with the specified

desired access.

The object is located either by name, or by locating a thread whose

Client ID matches the specified Client ID and then opening that thread's

process.

Arguments:

ProcessHandle - Supplies a pointer to a variable that will receive

the process object handle.

DesiredAccess - Supplies the desired types of access for the process

object.

ObjectAttributes - Supplies a pointer to an object attributes structure.

If the ObjectName field is specified, then ClientId must not be

specified.

ClientId - Supplies a pointer to a ClientId that if supplied

specifies the thread whose process is to be opened. If this

argument is specified, then ObjectName field of the ObjectAttributes

structure must not be specified.

Return Value:

NTSTATUS - Status of call

--*/