On 04/09/2019 02:29 PM, Derek Lesho wrote:
> Signed-off-by: Derek Lesho <dereklesho52@Gmail.com>
> ---
>  dlls/ntoskrnl.exe/ntoskrnl.c        | 20 ++++++++++++++++++++
>  dlls/ntoskrnl.exe/ntoskrnl.exe.spec |  2 +-
>  2 files changed, 21 insertions(+), 1 deletion(-)
>
> diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c
> index f5dee07e2f..770bdfd4fa 100644
> --- a/dlls/ntoskrnl.exe/ntoskrnl.c
> +++ b/dlls/ntoskrnl.exe/ntoskrnl.c
> @@ -3245,6 +3245,26 @@ NTSTATUS WINAPI PsLookupProcessByProcessId(HANDLE processid, PEPROCESS *process)
>  }
> 
> 
> +/*****************************************************
> + *           PsLookupThreadByThreadId   (NTOSKRNL.EXE.@)
> + */
> +NTSTATUS WINAPI PsLookupThreadByThreadId(HANDLE threadid, PETHREAD *thread)
> +{
> +    NTSTATUS status;
> +    HANDLE hThread = OpenThread( THREAD_ALL_ACCESS, FALSE, HandleToUlong(threadid) );
> +
> +    if (!hThread)
> +        return STATUS_INVALID_PARAMETER;
> +
> +    status = kernel_object_from_handle( hThread, PsThreadType, (void**)thread );
> +
> +    ObReferenceObject( *thread );
> +
> +    NtClose( hThread );
> +    return status;
> +}
> +
> +
>  /*****************************************************
>   *           IoSetThreadHardErrorMode  (NTOSKRNL.EXE.@)
>   */
> diff --git a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec
> index 43f47470a9..601506246e 100644
> --- a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec
> +++ b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec
> @@ -913,7 +913,7 @@
>  @ stub PsJobType
>  @ stdcall PsLookupProcessByProcessId(ptr ptr)
>  @ stub PsLookupProcessThreadByCid
> -@ stub PsLookupThreadByThreadId
> +@ stdcall PsLookupThreadByThreadId(ptr ptr)
>  @ extern PsProcessType
>  @ stub PsReferenceImpersonationToken
>  @ stub PsReferencePrimaryToken
>

Can we have tests for this function?

And while you're at it, can you add it to the public header?