<div dir="ltr">I have taken Jacek's advice and have split up my previous patchset into three smaller ones, this being the first.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 17, 2019 at 3:41 PM Derek Lesho <<a href="mailto:dereklesho52@gmail.com">dereklesho52@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Signed-off-by: Derek Lesho <dereklesho52@Gmail.com><br>
---<br>
dlls/ntoskrnl.exe/ntoskrnl.c | 18 ++++++++++++++++++<br>
dlls/ntoskrnl.exe/ntoskrnl.exe.spec | 2 +-<br>
dlls/ntoskrnl.exe/tests/driver.c | 18 ++++++++++++++++++<br>
include/ddk/ntifs.h | 1 +<br>
4 files changed, 38 insertions(+), 1 deletion(-)<br>
<br>
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c<br>
index 3789abda35..0ab150ea65 100644<br>
--- a/dlls/ntoskrnl.exe/ntoskrnl.c<br>
+++ b/dlls/ntoskrnl.exe/ntoskrnl.c<br>
@@ -3233,6 +3233,24 @@ NTSTATUS WINAPI PsLookupProcessByProcessId(HANDLE processid, PEPROCESS *process)<br>
}<br>
<br>
<br>
+/*****************************************************<br>
+ * PsLookupThreadByThreadId (NTOSKRNL.EXE.@)<br>
+ */<br>
+NTSTATUS WINAPI PsLookupThreadByThreadId(HANDLE threadid, PETHREAD *thread)<br>
+{<br>
+ NTSTATUS status;<br>
+ HANDLE hThread = OpenThread( THREAD_ALL_ACCESS, FALSE, HandleToUlong(threadid) );<br>
+<br>
+ if (!hThread)<br>
+ return STATUS_INVALID_PARAMETER;<br>
+<br>
+ status = ObReferenceObjectByHandle( hThread, THREAD_ALL_ACCESS, PsThreadType, KernelMode, (void**)thread, NULL );<br>
+<br>
+ NtClose( hThread );<br>
+ return status;<br>
+}<br>
+<br>
+<br>
/*****************************************************<br>
* IoSetThreadHardErrorMode (NTOSKRNL.EXE.@)<br>
*/<br>
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec<br>
index 141c8aa639..f965ff55ec 100644<br>
--- a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec<br>
+++ b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec<br>
@@ -914,7 +914,7 @@<br>
@ stub PsJobType<br>
@ stdcall PsLookupProcessByProcessId(ptr ptr)<br>
@ stub PsLookupProcessThreadByCid<br>
-@ stub PsLookupThreadByThreadId<br>
+@ stdcall PsLookupThreadByThreadId(ptr ptr)<br>
@ extern PsProcessType<br>
@ stub PsReferenceImpersonationToken<br>
@ stub PsReferencePrimaryToken<br>
diff --git a/dlls/ntoskrnl.exe/tests/driver.c b/dlls/ntoskrnl.exe/tests/driver.c<br>
index c3839da3bf..4b846869fc 100644<br>
--- a/dlls/ntoskrnl.exe/tests/driver.c<br>
+++ b/dlls/ntoskrnl.exe/tests/driver.c<br>
@@ -29,6 +29,7 @@<br>
#include "winternl.h"<br>
#include "winioctl.h"<br>
#include "ddk/ntddk.h"<br>
+#include "ddk/ntifs.h"<br>
#include "ddk/wdm.h"<br>
<br>
#include "driver.h"<br>
@@ -1167,6 +1168,22 @@ static void test_resource(void)<br>
ok(status == STATUS_SUCCESS, "got status %#x\n", status);<br>
}<br>
<br>
+static void test_lookup_thread(void)<br>
+{<br>
+ NTSTATUS status;<br>
+ PETHREAD thread = NULL;<br>
+<br>
+ status = PsLookupThreadByThreadId(PsGetCurrentThreadId(), &thread);<br>
+ ok(!status, "PsLookupThreadByThreadId failed: %#x\n", status);<br>
+ ok((PKTHREAD)thread == KeGetCurrentThread(), "thread != KeGetCurrentThread\n");<br>
+<br>
+ if (thread)<br>
+ ObDereferenceObject(thread);<br>
+<br>
+ status = PsLookupThreadByThreadId(NULL, &thread);<br>
+ ok(status == STATUS_INVALID_PARAMETER, "PsLookupThreadByThreadId returned %#x\n", status);<br>
+}<br>
+<br>
static NTSTATUS main_test(DEVICE_OBJECT *device, IRP *irp, IO_STACK_LOCATION *stack, ULONG_PTR *info)<br>
{<br>
ULONG length = stack->Parameters.DeviceIoControl.OutputBufferLength;<br>
@@ -1210,6 +1227,7 @@ static NTSTATUS main_test(DEVICE_OBJECT *device, IRP *irp, IO_STACK_LOCATION *st<br>
test_lookaside_list();<br>
test_ob_reference(test_input->path);<br>
test_resource();<br>
+ test_lookup_thread();<br>
<br>
/* print process report */<br>
if (winetest_debug)<br>
diff --git a/include/ddk/ntifs.h b/include/ddk/ntifs.h<br>
index abe357fbc9..9b57ae7ad7 100644<br>
--- a/include/ddk/ntifs.h<br>
+++ b/include/ddk/ntifs.h<br>
@@ -131,6 +131,7 @@ typedef struct _FS_FILTER_CALLBACKS<br>
<br>
BOOLEAN WINAPI FsRtlIsNameInExpression(PUNICODE_STRING, PUNICODE_STRING, BOOLEAN, PWCH);<br>
NTSTATUS WINAPI ObQueryNameString(PVOID,POBJECT_NAME_INFORMATION,ULONG,PULONG);<br>
+NTSTATUS WINAPI PsLookupThreadByThreadId(HANDLE,PETHREAD*);<br>
void WINAPI PsRevertToSelf(void);<br>
<br>
#endif<br>
-- <br>
2.20.1<br>
<br>
</blockquote></div>