UpdateProcThreadAttribute

Updates the specified attribute in a list of attributes for process and thread creation.

Syntax

BOOL UpdateProcThreadAttribute(
         LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
         DWORD dwFlags,
         DWORD_PTR Attribute,
         PVOID lpValue,
         SIZE_T cbSize,
         PVOID lpPreviousValue,
         PSIZE_T lpReturnSize
)  

Parameters

lpAttributeList
Type: LPPROC_THREAD_ATTRIBUTE_LIST 

[in, out] A pointer to an attribute list created by the InitializeProcThreadAttributeList function.

dwFlags
Type: DWORD 

[in] This parameter is reserved and must be zero.

Attribute
Type: DWORD_PTR 

[in] The attribute key to update in the attribute list. This parameter can be one of the following values.

lpValue
Type: PVOID 

[in, optional] A pointer to the attribute value. This value should persist until the attribute is destroyed using the DeleteProcThreadAttributeList function.

cbSize
Type: SIZE_T 

[in] The size of the attribute value specified by the lpValue parameter.

lpPreviousValue
Type: PVOID 

[out, optional] This parameter is reserved and must be NULL.

lpReturnSize
Type: PSIZE_T 

[in, optional] This parameter is reserved and must be NULL.

Return value

Type: BOOL 

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks

An attribute list is an opaque structure that consists of a series of key/value pairs, one for each attribute. A process can update only the attribute keys described in this topic.

The DWORD or DWORD64 pointed to by lpValue can be one or more of the following values:

• PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)Enables data execution prevention (DEP) for the child process. For more information, see Data Execution Prevention.
  
• PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)Enables DEP-ATL thunk emulation for the child process. DEP-ATL thunk emulation causes the system to intercept NX faults that originate from the Active Template Library (ATL) thunk layer. This value can be specified only with PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE.
  
• PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)Enables structured exception handler overwrite protection (SEHOP) for the child process. SEHOP blocks exploits that use the structured exception handler (SEH) overwrite technique.
  

Note

The following values are not supported until Windows 8 and Windows Server 2012.

• The force Address Space Layout Randomization (ASLR) policy, if enabled, forcibly rebases images that are not dynamic base compatible by acting as though an image base collision happened at load time. If relocations are required, images that do not have a base relocation section will not be loaded.
  The following mitigation options are available for mandatory ASLR policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000001 << 8)
• PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_OFF (0x00000002 << 8)

• PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS (0x00000003 << 8)

• The heap terminate on corruption policy, if enabled, causes the heap to terminate if it becomes corrupt. Note that ‘always off’ does not override the default opt-in for binaries with current subsystem versions set in the image header. Heap terminate on corruption is user mode enforced.
  The following mitigation options are available for heap terminate on corruption policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON (0x00000001 << 12)

• PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_OFF (0x00000002 << 12)

• The bottom-up randomization policy, which includes stack randomization options, causes a random location to be used as the lowest user address.
  The following mitigation options are available for the bottom-up randomization policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00000001 << 16)

• PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00000002 << 16)

• The high-entropy bottom-up randomization policy, if enabled, causes up to 1TB of bottom-up variance to be used. Note that high-entropy bottom-up randomization is effective if and only if bottom-up ASLR is also enabled; high-entropy bottom-up randomization is only meaningful for native 64-bit processes.
  The following mitigation options are available for the high-entropy bottom-up randomization policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON (0x00000001 << 20)

• PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_OFF (0x00000002 << 20)

• The strict handle checking enforcement policy, if enabled, causes an exception to be raised immediately on a bad handle reference. If this policy is not enabled, a failure status will be returned from the handle reference instead.
  The following mitigation options are available for the strict handle checking enforcement policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON (0x00000001 << 24)

• PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_OFF (0x00000002 << 24)

• The Win32k system call disable policy, if enabled, prevents a process from making Win32k calls.
  The following mitigation options are available for the Win32k system call disable policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON (0x00000001 << 28)

• PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_OFF (0x00000002 << 28)

• The Extension Point Disable policy, if enabled, prevents certain built-in third party extension points from being used. For example, window hooks are not enabled, App_InitDLLs aren’t loaded, and certain win32k accessibility extension points aren’t enabled. This is used to prevent legacy extension point DLLs from being loaded into a process that doesn’t use them.
  The following mitigation options are available for the extension point disable policy:
  
• PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON (0x00000001 << 32)
• PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_OFF (0x00000002 << 32)

Requirements

Header: Declared in processthreadsapi.h.

Library: Use kernelx.lib.