WRK-NtOpenProcess 的流程草图~

NTSTATUS

NtOpenProcess (

   __out PHANDLE ProcessHandle,

   __in ACCESS_MASK DesiredAccess,

   __in POBJECT_ATTRIBUTES ObjectAttributes,

   __in_opt PCLIENT_ID ClientId

    )

 

/*++

 

Routine Description:

 

   This function opens a handle to a process object with the specified

   desired access.

 

   The object is located either by name, or by locating a thread whose

   Client ID matches the specified Client ID and then opening that thread's

   process.

 

Arguments:

 

   ProcessHandle - Supplies a pointer to a variable that will receive

       the process object handle.

 

   DesiredAccess - Supplies the desired types of access for the process

       object.

 

   ObjectAttributes - Supplies a pointer to an object attributes structure.

       If the ObjectName field is specified, then ClientId must not be

       specified.

 

   ClientId - Supplies a pointer to a ClientId that if supplied

       specifies the thread whose process is to be opened. If this

       argument is specified, then ObjectName field of the ObjectAttributes

       structure must not be specified.

 

Return Value:

 

   NTSTATUS - Status of call

 

--*/