RtlImpersonateSelfEx - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
// private
/**
* The RtlImpersonateSelfEx routine begins impersonation of the calling process's security context on the current thread, with additional access and an optional returned token.
*
* \param ImpersonationLevel The SECURITY_IMPERSONATION_LEVEL at which to impersonate.
* \param AdditionalAccess An optional additional access mask to request on the impersonation token.
* \param ThreadToken An optional pointer to a variable that receives a handle to the impersonation token.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
RtlImpersonateSelfEx(
_In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
_In_opt_ ACCESS_MASK AdditionalAccess,
_Out_opt_ PHANDLE ThreadToken
);
View code on GitHubImpersonates a copy of the current process's token on the current thread.
ImpersonationLevel - the impersonation level to use.AdditionalAccess - an optional additional token access mask to grant on the returned handle.ThreadToken - an optional pointer to a variable that receives a handle to the new token.The function opens the current process token via NtOpenProcessTokenEx, duplicates it via NtDuplicateToken, and then impersonates it via NtSetInformationThread with ThreadImpersonationToken.
To reset impersonation, use NtSetInformationThread with ThreadImpersonationToken info class and a NULL token handle.
To avoid retaining unused resources, call NtClose to close the returned handle when it is no longer required.