RtlQueryPackageIdentity
NTSTATUS __stdcall RtlQueryPackageIdentity(
VOID *TokenObject,
WCHAR *PackageFullName,
UINT64 *PackageSize,
WCHAR *AppId,
UINT64 *AppIdSize,
UINT8 *Packaged){
NTSTATUS result;
UINT64 *v7;
result = RtlQueryPackageIdentityEx(TokenObject, PackageFullName, PackageSize, AppId, AppIdSize, v7);
if( result >= 0 )
{
if( Packaged )
*Packaged = 0;
}
return result;
}Referenced by:
EtwpApplyPackageIdFilter
EtwpQueryTokenPackageInfo
ExpGetProcessInformation
PfSnCheckModernApp
PopEtGetProcessSidAndPackageIdentity