Add PhSetProcessEmptyWorkingSet
@@ -170,6 +170,9 @@ PhGetProcessPeb32(
if (NT_SUCCESS(status))
{
+ if (!wow64)
+ return STATUS_UNSUCCESSFUL;
+
*Peb32 = (PVOID)wow64;
}
@@ -193,6 +196,9 @@ PhGetProcessPeb(
if (NT_SUCCESS(status))
{
+ if (!basicInfo.PebBaseAddress)
+ return STATUS_UNSUCCESSFUL;
+
*PebBaseAddress = (PVOID)basicInfo.PebBaseAddress;
}
@@ -583,6 +589,26 @@ PhSetProcessQuotaLimits(
);
}
+FORCEINLINE
+NTSTATUS
+PhSetProcessEmptyWorkingSet(
+ _In_ HANDLE ProcessHandle
+ )
+{
+ QUOTA_LIMITS_EX quotaLimits;
+
+ memset(&quotaLimits, 0, sizeof(QUOTA_LIMITS_EX));
+ quotaLimits.MinimumWorkingSetSize = SIZE_MAX;
+ quotaLimits.MaximumWorkingSetSize = SIZE_MAX;
+
+ return NtSetInformationProcess(
+ ProcessHandle,
+ ProcessQuotaLimits,
+ &quotaLimits,
+ sizeof(QUOTA_LIMITS_EX)
+ );
+}
+
FORCEINLINE
NTSTATUS
PhGetProcessAffinityMask(
@@ -652,10 +678,9 @@ PhGetProcessGroupInformation(
&returnLength
);
- // (int)(status + 0x80000000) < 0 || status == STATUS_BUFFER_TOO_SMALL
if (NT_SUCCESS(status) || status == STATUS_BUFFER_TOO_SMALL)
{
- *GroupCount = (USHORT)returnLength >> 1;
+ *GroupCount = (USHORT)returnLength / sizeof(USHORT); // (USHORT)returnLength >> 1
}
return status;
@@ -1808,18 +1833,15 @@ PhGetTokenMandatoryPolicy(
_Out_ PTOKEN_MANDATORY_POLICY MandatoryPolicy
)
{
- NTSTATUS status;
ULONG returnLength;
- status = NtQueryInformationToken(
+ return NtQueryInformationToken(
TokenHandle,
TokenMandatoryPolicy,
MandatoryPolicy,
sizeof(TOKEN_MANDATORY_POLICY),
&returnLength
);
-
- return status;
}
FORCEINLINE
@@ -1885,7 +1907,6 @@ PhGetTokenAppContainerNumber(
);
}
-
FORCEINLINE
NTSTATUS
PhGetEventBasicInformation(
