#ifndef _NTRTL_H

// rev
/**
 * The RtlValidProcessProtection function validates the process protection level.
 *
 * \param ProcessProtection Pointer to a PS_PROTECTION structure describing the protection.
 * \return TRUE if the protection level is valid, FALSE otherwise.
 * \remarks Validates an encoded PS_PROTECTION value against the supported combinations; it does not validate that a particular process has that protection. The observed accepted bytes are 0, 8, 18, 33, 49, 65, 81, 82, 97, 98, 114 and 129. Treat this list as build-specific, not a portable authorization policy.
 */
NTSYSAPI
BOOLEAN
NTAPI
RtlValidProcessProtection(
    _In_ PS_PROTECTION ProcessProtection
    );

#endif
View code on GitHub