#ifndef _NTPSAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Process information structures
//
/**
* The PROCESS_BASIC_INFORMATION structure contains basic information about a process.
*
* \remarks https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess#process_basic_information
*/
typedef struct _PROCESS_BASIC_INFORMATION
{
NTSTATUS ExitStatus; // The exit status of the process. (GetExitCodeProcess)
PPEB PebBaseAddress; // A pointer to the process environment block (PEB) of the process.
KAFFINITY AffinityMask; // The affinity mask of the process. (GetProcessAffinityMask) (deprecated)
KPRIORITY BasePriority; // The base priority of the process. (GetPriorityClass)
HANDLE UniqueProcessId; // The unique identifier of the process. (GetProcessId)
HANDLE InheritedFromUniqueProcessId; // The unique identifier of the parent process.
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
View code on GitHub
This structure defines basic information about the process.
NtQueryInformationProcess
with ProcessBasicInformation
(0)The exit code of the process. If the process has not exited, this field contains STATUS_PENDING
.
The address of the Process Environment Block. See PEB
for more details. To query the address of the 32-bit PEB32
, use ProcessWow64Information
(26).
The bit mask indicating on which processors the threads from the process are allowed to run.
PROCESSINFOCLASS
value of ProcessAffinityMask
(21)The base priority for the threads in the process.
PROCESSINFOCLASS
value of ProcessBasePriority
(5)The PID of the process.
The PID of the process's parent from which it inherits various attributes.