CallbackProcess

Control process start and stop operations in Windows and .NET applications

OnThreadHandleOperation event/delegate/callback

Filter:

Pascal    C++ (Lib)    C++ (VCL)    C++ (.NET)    C#    VB.NET   

CallbackProcess     See also    

Overview

This callback is called during process handle creation or duplication.

Declaration

[Pascal]
    property OnThreadHandleOperation : TThreadHandleOperationEvent;
    TCBProcThreadHandleOperationEvent = procedure( Sender : TObject; Duplication: Boolean; ProcessId: LongWord; ThreadId: LongWord; OriginatorProcessId: LongWord; OriginatorThreadId: LongWord; DesiredAccess: ACCESS_MASK; OriginalDesiredAccess: ACCESS_MASK; SourceProcessId: LongWord; TargetProcessId: LongWord; var AllowedAccess: ACCESS_MASK ) of object;

[C++ (Lib)]
    typedef void (*ThreadHandleOperationEvent)( CallbackProcess* Sender, bool Duplication, unsigned long ProcessId, unsigned long ThreadId, unsigned long OriginatorProcessId, unsigned long OriginatorThreadId, ACCESS_MASK DesiredAccess, ACCESS_MASK OriginalDesiredAccess, unsigned long SourceProcessId, unsigned long TargetProcessId, ACCESS_MASK& AllowedAccess );

[C++ (VCL)]
    typedef void __fastcall (__closure *TThreadHandleOperationEvent)( System::TObject* Sender, bool Duplication, unsigned long ProcessId, unsigned long ThreadId, unsigned long OriginatorProcessId, unsigned long OriginatorThreadId, ACCESS_MASK DesiredAccess, ACCESS_MASK OriginalDesiredAccess, unsigned long SourceProcessId, unsigned long TargetProcessId, ACCESS_MASK& AllowedAccess );

[C++ (.NET)]
    public delegate void ThreadHandleOperationEvent( CallbackProcess^ Sender, bool Duplication, UInt32 ProcessId, UInt32 ThreadId, UInt32 OriginatorProcessId, UInt32 OriginatorThreadId, ACCESS_MASK DesiredAccess, ACCESS_MASK OriginalDesiredAccess, UInt32 SourceProcessId, UInt32 TargetProcessId, ACCESS_MASK% AllowedAccess );

[C#]
    delegate void ThreadHandleOperationEvent( CallbackProcess Sender, bool Duplication, UInt32 ProcessId, UInt32 ThreadId, UInt32 OriginatorProcessId, UInt32 OriginatorThreadId, ACCESS_MASK DesiredAccess, ACCESS_MASK OriginalDesiredAccess, UInt32 SourceProcessId, UInt32 TargetProcessId, ACCESS_MASK% AllowedAccess );

[VB.NET]
    Delegate Sub ThreadHandleOperationEvent( ByVal Sender As CallbackProcess, ByVal Duplication As Boolean, ByVal ProcessId As UInt32, ByVal ThreadId As UInt32, ByVal OriginatorProcessId As UInt32, ByVal OriginatorThreadId As UInt32, ByVal DesiredAccess As ACCESS_MASK, ByVal OriginalDesiredAccess As ACCESS_MASK, ByVal SourceProcessId As UInt32, ByVal TargetProcessId As UInt32, ByRef AllowedAccess As ACCESS_MASK )

Parameters

  • Sender - reference to the class that called the delegate/event handler
  • Duplication - Specifies whether the handle is being created or duplicated.
  • ProcessId - ID of the process which handle is being opened/duplicated.
  • ThreadId - ID of the thread which handle is being opened/duplicated.
  • OriginatorProcessId - ID of the process which is performing open/duplicate operation.
  • OriginatorThreadId - ID of the thread which is performing open/duplicate operation.
  • DesiredAccess - An ACCESS_MASK value that specifies the access rights to grant for the handle. Initially this member equals to OriginalDesiredAccess, but it can be modified already by other filters to restrict the access that is granted.
  • OriginalDesiredAccess - An ACCESS_MASK value that specifies the original access that was requested for the handle.
  • SourceProcessId - ID of the process that is the source of the handle. Valid only if the handle is being duplicated.
  • TargetProcessId - ID of the process that is the target of the handle. Valid only if the handle is being duplicated.
  • AllowedAccess - The application can change the access rights of the token as needed and place the returned value in this parameter

Description

The callback is called for thread handle operations, when a handle for a thread is being created or duplicated. The application can analyze the request parameters and later them if needed by placing new access rights to AllowedAccess parameter. For example, to prevent thread termination the handler should remove THREAD_TERMINATE from access flags.

Error handling

See Error handling topic for detailed information about how to report errors, which occur in the event handlers, back to CallbackProcess.

See also

OnProcessCreation     OnProcessHandleOperation

Back to top