RtlImpersonateSelf - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
/**
* The RtlImpersonateSelf routine begins impersonation of the security context of the calling process on the current thread.
*
* \param ImpersonationLevel The SECURITY_IMPERSONATION_LEVEL at which to impersonate.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
RtlImpersonateSelf(
_In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
);
View code on GitHubImpersonates a copy of the current process's token on the current thread.
ImpersonationLevel - the impersonation level to use.The function opens the current process token via NtOpenProcessTokenEx, duplicates it via NtDuplicateToken, and then impersonates it via NtSetInformationThread with ThreadImpersonationToken.
To reset impersonation, use NtSetInformationThread with ThreadImpersonationToken info class and a NULL token handle.