PS_ATTRIBUTE - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers

#ifndef _NTPSAPI_H
// User processes and threads
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// begin_private

typedef struct _PS_ATTRIBUTE
{
    ULONG_PTR Attribute;
    SIZE_T Size;
    union
    {
        ULONG_PTR Value;
        PVOID ValuePtr;
    };
    PSIZE_T ReturnLength;
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;

// end_private
#endif
#endif
View code on GitHub

This structure defines a process or thread creation attribute.

Members

Attribute - a numerical identifier of the type of entry.
Size - the size of the value in bytes.
Value/ValuePtr - the additional input/output data attached to the attribute either in-place or as a pointer to a buffer.
ReturnLength - an optional pointer to a variable that receives the number of bytes that has been written to the buffer (for attributes that return data).

Known attributes

For the list of know attributes, see the documentation of PS_ATTRIBUTE_NUM.

See also

Edit description on GitHub