#ifndef _NTRTL_H

/**
 * The RtlNormalizeProcessParams routine converts the embedded pointers in a process parameters block from relative offsets to absolute addresses.
 *
 * \param ProcessParameters A pointer to the process parameters block to normalize.
 * \return A pointer to the normalized process parameters block.
 * \remarks Mutates selected parameter string pointers between base-relative offsets and absolute addresses, using flag bit 0x1 to avoid applying the transformation twice. Both return NULL for NULL input. Environment is not one of the string pointers converted by these routines; do not blindly rebase every pointer field.
 */
NTSYSAPI
PRTL_USER_PROCESS_PARAMETERS
NTAPI
RtlNormalizeProcessParams(
    _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters
    );

#endif
View code on GitHub