PsQueryProcessAttributesByToken

VOID __stdcall PsQueryProcessAttributesByToken(VOID *Token, UINT8 *SystemAppIdentifier, UINT8 *PackagedApplication){
  if( SystemAppIdentifier )
    *SystemAppIdentifier = SeSecurityAttributePresent(
                             Token,
                             (_UNICODE_STRING *)&PspSysAppIdClaim,
                             (_UNICODE_STRING *)PackagedApplication);
  if( PackagedApplication )
    *PackagedApplication = SeSecurityAttributePresent(
                             Token,
                             (_UNICODE_STRING *)&PspPackagedAppClaim,
                             (_UNICODE_STRING *)PackagedApplication);
}

Referenced by: