#ifndef _NTPSAPI_H
//
// User processes and threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// begin_private

/**
 * Access flags embedded in a trustlet creation attribute's high byte.
 * The kernel places Trustlet/Ntos/WriteHandle/ReadHandle in bits 0/1/2/3 of this byte.
 * IsTrustletCreateAttributeWellFormed rejects the high four bits; they must remain zero.
 */
typedef union _PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS
{
    UCHAR AccessRights;
    struct
    {
        UCHAR Trustlet : 1;
        UCHAR Ntos : 1;
        UCHAR WriteHandle : 1;
        UCHAR ReadHandle : 1;
        UCHAR Reserved : 4; // Validated as zero, not additional access rights.
    } DUMMYSTRUCTNAME;
} PS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS, *PPS_TRUSTLET_ATTRIBUTE_ACCESSRIGHTS;

// end_private
#endif
#endif
View code on GitHub