<div dir="ltr"><div dir="ltr">On Tue, Apr 9, 2019 at 7:34 PM Zebediah Figura <<a href="mailto:z.figura12@gmail.com">z.figura12@gmail.com</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 04/09/2019 02:29 PM, Derek Lesho wrote:<br>
> Signed-off-by: Derek Lesho <dereklesho52@Gmail.com><br>
> ---<br>
> dlls/ntoskrnl.exe/ntoskrnl.c | 20 ++++++++++++++++++++<br>
> dlls/ntoskrnl.exe/ntoskrnl.exe.spec | 2 +-<br>
> 2 files changed, 21 insertions(+), 1 deletion(-)<br>
> <br>
> diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c<br>
> index f5dee07e2f..770bdfd4fa 100644<br>
> --- a/dlls/ntoskrnl.exe/ntoskrnl.c<br>
> +++ b/dlls/ntoskrnl.exe/ntoskrnl.c<br>
> @@ -3245,6 +3245,26 @@ NTSTATUS WINAPI PsLookupProcessByProcessId(HANDLE processid, PEPROCESS *process)<br>
> }<br>
> <br>
> <br>
> +/*****************************************************<br>
> + * PsLookupThreadByThreadId (NTOSKRNL.EXE.@)<br>
> + */<br>
> +NTSTATUS WINAPI PsLookupThreadByThreadId(HANDLE threadid, PETHREAD *thread)<br>
> +{<br>
> + NTSTATUS status;<br>
> + HANDLE hThread = OpenThread( THREAD_ALL_ACCESS, FALSE, HandleToUlong(threadid) );<br>
> +<br>
> + if (!hThread)<br>
> + return STATUS_INVALID_PARAMETER;<br>
> +<br>
> + status = kernel_object_from_handle( hThread, PsThreadType, (void**)thread );<br>
> +<br>
> + ObReferenceObject( *thread );<br>
> +<br>
> + NtClose( hThread );<br>
> + return status;<br>
> +}<br>
> +<br>
> +<br>
> /*****************************************************<br>
> * IoSetThreadHardErrorMode (NTOSKRNL.EXE.@)<br>
> */<br>
> diff --git a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec<br>
> index 43f47470a9..601506246e 100644<br>
> --- a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec<br>
> +++ b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec<br>
> @@ -913,7 +913,7 @@<br>
> @ stub PsJobType<br>
> @ stdcall PsLookupProcessByProcessId(ptr ptr)<br>
> @ stub PsLookupProcessThreadByCid<br>
> -@ stub PsLookupThreadByThreadId<br>
> +@ stdcall PsLookupThreadByThreadId(ptr ptr)<br>
> @ extern PsProcessType<br>
> @ stub PsReferenceImpersonationToken<br>
> @ stub PsReferencePrimaryToken<br>
> <br>
<br>
Can we have tests for this function?<br>
<br>
And while you're at it, can you add it to the public header?<br>
<br>
<br></blockquote><div>Sure, will do. I Just based the return value on the MSDN, but I guess it doesn't hurt to check.</div></div></div>