#ifndef _NTRTL_H

/**
 * The RtlDeNormalizeProcessParams routine converts the embedded pointers in a process parameters block from absolute addresses back to relative offsets.
 *
 * \param ProcessParameters A pointer to the process parameters block to de-normalize.
 * \return A pointer to the de-normalized process parameters block.
 * \remarks Mutates selected parameter string pointers between base-relative offsets and absolute addresses, using flag bit 0x1 to avoid applying the transformation twice. Both return NULL for NULL input. Environment is not one of the string pointers converted by these routines; do not blindly rebase every pointer field.
 */
NTSYSAPI
PRTL_USER_PROCESS_PARAMETERS
NTAPI
RtlDeNormalizeProcessParams(
    _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters
    );

#endif
View code on GitHub