Export (0) Print
Expand All

ZwOpenProcessTokenEx routine

The ZwOpenProcessTokenEx routine opens the access token associated with a process.

Syntax


NTSTATUS ZwOpenProcessTokenEx(
  _In_   HANDLE ProcessHandle,
  _In_   ACCESS_MASK DesiredAccess,
  _In_   ULONG HandleAttributes,
  _Out_  PHANDLE TokenHandle
);

Parameters

ProcessHandle [in]

Handle to the process whose access token is to be opened. The handle must have PROCESS_QUERY_INFORMATION access. Use the NtCurrentProcess macro, defined in Ntddk.h, to specify the current process.

DesiredAccess [in]

ACCESS_MASK structure specifying the requested types of access to the access token. These requested access types are compared with the token's discretionary access-control list (DACL) to determine which accesses are granted or denied.

HandleAttributes [in]

Attributes for the access token handle. Only OBJ_KERNEL_HANDLE is currently supported. If the caller is not running in the system process context, it must specify OBJ_KERNEL_HANDLE for this parameter.

TokenHandle [out]

Pointer to a caller-allocated variable that receives a handle to the newly opened access token.

Return value

ZwOpenProcessTokenEx returns STATUS_SUCCESS or an appropriate error status. Possible error status codes include the following:

Return codeDescription
STATUS_ACCESS_DENIED

ProcessHandle did not have PROCESS_QUERY_INFORMATION access.

STATUS_INSUFFICIENT_RESOURCES

A new token handle could not be allocated.

STATUS_INVALID_HANDLE

ProcessHandle was not a valid handle.

STATUS_INVALID_PARAMETER

The specified HandleAttributes did not include OBJ_KERNEL_HANDLE.

STATUS_OBJECT_TYPE_MISMATCH

ProcessHandle was not a process handle.

STATUS_PRIVILEGE_NOT_HELD

The caller does not have the privilege (SeSecurityPrivilege) necessary to create a token handle with the access specified in the DesiredAccess parameter.

STATUS_QUOTA_EXCEEDED

The process's memory quota is not sufficient to allocate the token handle.

STATUS_UNSUCCESSFUL

The token handle could not be created.

 

Remarks

ZwOpenProcessTokenEx opens the access token associated with a process and returns a handle for that token.

Any handle obtained by calling ZwOpenProcessTokenEx must eventually be released by calling ZwClose.

Driver routines that run in a process context other than that of the system process must set the OBJ_KERNEL_HANDLE attribute for the HandleAttributes parameter of ZwOpenProcessTokenEx. This restricts the use of the handle returned by ZwOpenProcessTokenEx to processes running in kernel mode. Otherwise, the handle can be accessed by the process in whose context the driver is running.

For more information about security and access control, see the documentation on these topics in the Windows SDK.

Note  If the call to the ZwOpenProcessTokenEx function occurs in user mode, you should use the name "NtOpenProcessTokenEx" instead of "ZwOpenProcessTokenEx".

Requirements

Version

Available in Windows XP and later versions of Windows.

Header

Ntifs.h (include Ntifs.h)

Library

Ntoskrnl.lib

IRQL

PASSIVE_LEVEL

DDI compliance rules

PowerIrpDDis, HwStorPortProhibitedDDIs

See also

ACCESS_MASK
ACL
PsDereferencePrimaryToken
ZwClose
ZwOpenThreadTokenEx

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft