#ifndef _NTRTL_H
#if (PHNT_VERSION >= PHNT_WINDOWS_10)

/**
 * The RtlQueryPackageClaims routine retrieves the package claims associated with a token, including the package full name, application identifier, and attributes.
 *
 * \param TokenHandle A handle to the token to query.
 * \param PackageFullName An optional buffer that receives the package full name.
 * \param PackageSize An optional pointer to the size, in bytes, of the PackageFullName buffer; updated with the required or written size.
 * \param AppId An optional buffer that receives the application identifier.
 * \param AppIdSize An optional pointer to the size, in bytes, of the AppId buffer; updated with the required or written size.
 * \param DynamicId An optional pointer to a variable that receives the dynamic package identifier.
 * \param PkgClaim An optional pointer to a PS_PKG_CLAIM structure that receives the package claim.
 * \param AttributesPresent An optional pointer to a variable that receives the mask of attributes present.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSAPI
NTSTATUS
NTAPI
RtlQueryPackageClaims(
    _In_ HANDLE TokenHandle,
    _Out_writes_bytes_to_opt_(*PackageSize, *PackageSize) PWSTR PackageFullName,
    _Inout_opt_ PSIZE_T PackageSize,
    _Out_writes_bytes_to_opt_(*AppIdSize, *AppIdSize) PWSTR AppId,
    _Inout_opt_ PSIZE_T AppIdSize,
    _Out_opt_ PGUID DynamicId,
    _Out_opt_ PPS_PKG_CLAIM PkgClaim,
    _Out_opt_ PULONG64 AttributesPresent
    );

#endif
#endif
View code on GitHub

NtDoc

Queries package identity and claim information for a token.

Parameters

TokenHandle - a handle to a token or one of the supported pseudo-handles (see below). The handle must grant TOKEN_QUERY access.
PackageFullName - an optional pointer to user-allocated buffer that receives the full name of the package.
PackageSize - an optional pointer to a variable that specifies the size of the PackageFullName buffer in bytes and receives the number of bytes written.
AppId - an optional pointer to user-allocated buffer that receives the relative application user model ID of the package.
AppIdSize - an optional pointer to a variable that specifies the size of the AppId buffer in bytes and receives the number of bytes written.
DynamicId - an optional pointer to a variable that receives the dynamic ID of the application.
PkgClaim - an optional pointer to a variable that receives package claim flags.
AttributesPresent - an optional pointer to a variable that receives a bit mask of package-related security attributes present in the token.

Pseudo-handles

This function supports the following pseudo-handle values:

NtCurrentProcessToken - performs the query on the primary token of the calling process.
NtCurrentThreadToken - performs the query on the impersonation token of the calling thread. The function fails if the thread is not impersonating.
NtCurrentThreadEffectiveToken - performs the query on the impersonation token of the calling thread, if present. Otherwise, the function uses the primary token of the calling process.

Notable return values

STATUS_NOT_FOUND - the token doesn't have package identity attributes.

Implementation details

This function calls NtQuerySecurityAttributesToken and reads the values of the WIN://SYSAPPID and WIN://PKG attributes. When the caller request the list of present attributes, it also checks for the presence of WP://SKUID and XBOX://LI.

Remarks

Alternatively to using NtQuerySecurityAttributesToken, you can also enumerate all security attributes via NtQueryInformationToken with TokenSecurityAttributes and retrieve the values from there.

Required OS version

This function was introduced in Windows 10 TH1 (1507).

RtlQueryPackageClaims - NtDoc