What's new

KasperskyOS Community Edition 1.1

Print Support Send link Get as PDF

Methods of KasperskyOS core endpoints

From the perspective of the Kaspersky Security Module, the KasperskyOS kernel is a container of components that provide endpoints. The list of kernel components is provided in the Core.edl file located in the sysroot-*-kos/include/kl/core directory of the KasperskyOS SDK. This directory also contains the CDL and IDL files for the formal specification of the kernel.

Methods of core endpoints can be divided into secure methods and potentially dangerous methods. Potentially dangerous methods could be used by a cybercriminal in a compromised solution component to cause a denial of service, set up covert data transfer, or hijack an I/O device. Secure methods cannot be used for these purposes.

Access to methods of core endpoints must be restricted as much as possible by the solution security policy (according to the least privilege principle). For that, the following requirements must be fulfilled:

Access to a secure method must be granted only to the solution components that require this method.
Access to a potentially dangerous method must be granted only to the trusted solution components that require this method.
Access to a potentially dangerous method must be granted to untrusted solution components that require this method only if the verifiable access conditions limit the possibilities of malicious use of this method, or if the impact from malicious use of this method is acceptable from a security perspective.
For example, an untrusted component may be allowed to use a limited set of I/O ports that do not allow this component to take control of I/O devices. In another example, covert data transfer between untrusted components may be acceptable from a security perspective.

In this section

Virtual memory endpoint

Synchronization endpoint

File system endpoints

Time endpoint

Hardware abstraction layer endpoint

XHCI controller management endpoint

Audit endpoint

Profiling endpoint

I/O memory management endpoint

Connections endpoint

Power management endpoint

Notifications endpoint

Method	Method purpose and parameters	Potential danger of the method
`Allocate`	Purpose Allocates a virtual memory region (reserves and optionally maps it to physical memory). Parameters [in] `addr` – preferred base address of the virtual memory region, or `0` for the base address to be selected automatically. [in] `size` – size of the virtual memory region in bytes. [in] `flags` – flags defining the parameters of the virtual memory region and its allocation. [out] `va` – base address of the allocated virtual memory region. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`Commit`	Purpose Maps the virtual memory region (or part of it) reserved by the `Allocate` method to physical memory. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [in] `flags` – flags defining the parameters of the virtual memory region. [out] `rc` – return code.	Lets you exhaust RAM.
`Decommit`	Purpose Cancels mapping of the virtual memory region to physical memory. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [out] `rc` – return code.	N/A
`Protect`	Purpose Modifies the access rights to the virtual memory region. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [in] `flags` – flags defining the access rights to the virtual memory region. [out] `rc` – return code.	N/A
`Free`	Purpose Frees up the virtual memory region. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [out] `rc` – return code.	N/A
`Query`	Purpose Lets you get information about a virtual memory page. Parameters [in] `va` – address included in the virtual memory page. [out] `info` – sequence containing information about a virtual memory page. [out] `rc` – return code.	N/A
`MdlCreate`	Purpose Creates an MDL buffer. Parameters [in] `size` – size of the MDL buffer in bytes. [in] `prot` – flags defining the access rights to the MDL buffer. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`MdlCreateFromVm`	Purpose Creates an MDL buffer from physical memory that is mapped to the defined virtual memory region and maps the created MDL buffer to this region. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the MDL buffer in bytes. [in] `flags` – flags defining the access rights to the MDL buffer. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`MdlGetSize`	Purpose Gets the size of the MDL buffer. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [out] `size` – size of the MDL buffer in bytes. [out] `rc` – return code.	N/A
`MdlMap`	Purpose Maps an MDL buffer to a virtual memory region. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [in] `offset` – offset (in bytes) in the MDL buffer where mapping should start. [in] `length` – size (in bytes) of the part of the MDL buffer that needs to be mapped. [in] `hint` – preferred base address of the virtual memory region, or `0` for the base address to be selected automatically. [in] `prot` – flags defining the access rights to the virtual memory region. [out] `address` – base address of the virtual memory region. [out] `rc` – return code.	Allows the following: Create shared memory for interprocess communication concealed from the security module if multiple processes own the handles of one MDL buffer (the handle permissions masks must allow mapping of the MDL buffer). Exhaust the kernel memory by creating a multitude of objects within it.
`MdlClone`	Purpose Creates an MDL buffer based on an existing one. The MDL buffer is created from the same regions of physical memory as the original buffer. Parameters [in] `originHandle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the original MDL buffer. [in] `offset` – offset (in bytes) in the original MDL buffer where duplication should start. [in] `length` – size of the part of the original MDL buffer that needs to be duplicated. [out] `cloneHandle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the created MDL buffer. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.

Method	Method purpose and parameters	Potential danger of the method
`RegisterPort`	Purpose Registers I/O ports. Parameters [in] `base` – base address of the I/O ports. [in] `size` – width of the address range for I/O ports. [out] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the I/O ports. [out] `rc` – return code.	Allows the following: Hijack I/O ports (it is recommended to monitor the base address and width of the address range for I/O ports). Exhaust the kernel memory by creating a multitude of objects within it.
`RegisterMmio`	Purpose Registers an MMIO memory region. Parameters [in] `base` – base address of the MMIO memory region. [in] `size` – size of the MMIO memory region in bytes. [out] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MMIO memory region. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`RegisterDma`	Purpose Creates an DMA buffer. Parameters [in] `size` – size of the DMA buffer in bytes. [in] `flags` – flags defining the DMA parameters. [in] `order` – parameter defining the minimum number of memory pages (2^order) in a block. [out] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`RegisterIrq`	Purpose Registers an interrupt. Parameters [in] `irq` – interrupt number. [out] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`MapMem`	Purpose Maps an MMIO memory region to a virtual memory region. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MMIO memory region. [in] `prot` – flags defining the access rights to the virtual memory region. [in] `attr` – flags defining the parameters of the virtual memory region (for example, use of caching). [out] `address` – base address of the virtual memory region. [out] `mapping` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the virtual memory region. [out] `rc` – return code.	Allows the following: Take control of a device when mapping an MMIO memory region to a virtual memory region (it is recommended to monitor the base address and size of the MMIO memory region when the `RegisterMmio` method is called). Create shared memory for interprocess communication concealed from the security module if multiple processes own the handles of one MMIO memory region (the handle permissions masks must allow mapping of the MMIO memory region). Exhaust the kernel memory by creating a multitude of objects within it.
`PermitPort`	Purpose Opens access to I/O ports. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the I/O ports. [out] `access` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used to access I/O ports. [out] `rc` – return code.	Allows the following: Take control of a device (it is recommended to monitor the base address and width of the address range for I/O ports when the `RegisterPort` method is called). Exhaust the kernel memory by creating a multitude of objects within it.
`AttachIrq`	Purpose Attaches an interrupt to the handle used by the interrupt handler. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt. [in] `flags` – flags indicating characteristics of the interrupt. [out] `delivery` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used by the interrupt handler. [out] `rc` – return code.	Allows the following: Take CPU time from all other threads, including from other processes (the thread that attached to the interrupt will become a real-time thread). Make it impossible to terminate a process from another process (the process whose thread was attached to the interrupt cannot be terminated from another process). Stop the operating system (if an unhandled exception occurs in the thread handling an interrupt, the operating system stops). Create malicious interrupt handling, such as incorrect handling or delayed handling (it is recommended to monitor the interrupt number when the `RegisterIrq` method is called). Attach to an interrupt that is already attached to the interrupt handler in another process for the purpose of blocking handling of this interrupt. Exhaust the kernel memory by creating a multitude of objects within it.
`AttachIrqEx`	Purpose Attaches an interrupt to the handle used by the interrupt handler. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt. [in] `flags` – flags indicating characteristics of the interrupt. [in] `futexPtr` – pointer to futex. [out] `delivery` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used by the interrupt handler. [out] `rc` – return code.	Allows the following: Take CPU time from all other threads, including from other processes (the thread that attached to the interrupt will become a real-time thread). Make it impossible to terminate a process from another process (the process whose thread was attached to the interrupt cannot be terminated from another process). Stop the operating system (if an unhandled exception occurs in the thread handling an interrupt, the operating system stops). Create malicious interrupt handling, such as incorrect handling or delayed handling (it is recommended to monitor the interrupt number when the `RegisterIrq` method is called). Attach to an interrupt that is already attached to the interrupt handler in another process for the purpose of blocking handling of this interrupt. Exhaust the kernel memory by creating a multitude of objects within it.
`DetachIrq`	Purpose Detaches an interrupt from the handle used by the interrupt handler. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt. [out] `rc` – return code.	N/A
`EnableIrq`	Purpose Resumes interrupt handling. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt. [out] `rc` – return code.	N/A
`DisableIrq`	Purpose Blocks interrupt handling. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt. [out] `rc` – return code.	Lets you block interrupt handling in another process.
`ModifyDma`	Purpose Modifies DMA parameters. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer. [in] `flags` – flags defining the DMA parameters. [out] `rc` – return code.	N/A
`MapDma`	Purpose Maps an DMA buffer to a virtual memory region. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer. [in] `offset` – offset (in bytes) in the DMA buffer where mapping should start. [in] `length` – size (in bytes) of the part of the DMA buffer that needs to be mapped. [in] `hint` – preferred base address of the virtual memory region, or `0` for the base address to be selected automatically. [in] `prot` – flags defining the access rights to the virtual memory region. [out] `address` – base address of the virtual memory region. [out] `mapping` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the virtual memory region. [out] `rc` – return code.	Allows the following: Create shared memory for interprocess communication concealed from the security module if multiple processes own the handles of one DMA buffer (the handle permissions masks must allow mapping of the DMA buffer). Exhaust the kernel memory by creating a multitude of objects within it.
`DmaGetInfo`	Purpose Lets you get information about a DMA buffer. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer. [out] `flags` – flags indicating the DMA parameters. [out] `order` – parameter indicating the minimum number of memory pages (2^order) in a block. [out] `size` – size of the DMA buffer in bytes. [out] `count` – number of blocks. [out] `frames` – sequence containing information about blocks. [out] `rc` – return code.	N/A
`DmaGetPhysInfo`	Purpose Lets you get information about the physical memory that was used to create a DMA buffer. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer. [out] `count` – number of continuous regions of physical memory. [out] `frames` – sequence containing information about continuous regions of physical memory. [out] `rc` – return code.	N/A
`BeginDma`	Purpose Opens access to a DMA buffer for a device. Parameters [in] `resource` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer. [out] `iomapping` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the kernel object that is used to map a DMA buffer to the range of IOMMU addresses used by a device. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.

Method	Method purpose and parameters	Potential danger of the method
`Create`	Purpose Creates a thread. Parameters [out] `tid` – thread ID (TID). [in] `priority` – value defining the thread priority. [in] `stackSize` – size of the stack for the thread, or `0` for the default size. [in] `routine` – pointer to the function that will be executed when creating the thread. [in] `context` – pointer to the function that will be executed in the thread context. [in] `context2` – pointer to the parameters that will be passed to the function defined through the `context` parameter. [in] `flags` – flags defining the parameters for creating the thread. [out] `rc` – return code.	Allows the following: Create a real-time thread that takes up all the CPU time from other threads, including from other processes (it is recommended to monitor thread creation parameters). Create a multitude of threads (including with high priority) to reduce the CPU time available to the threads of other processes (it is recommended to monitor thread priority). Exhaust the RAM. Exhaust the kernel memory by creating a multitude of objects within it.
`Suspend`	Purpose Blocks a thread. Parameters [in] `tid` – thread ID (TID). [out] `rc` – return code.	Lets you lock a standard thread that has captured the synchronization entity expected by the real-time thread in whose context the interrupt is being handled. This could stop the handling of this interrupt by other processes.
`Resume`	Purpose Resumes a thread. Parameters [in] `tid` – thread ID (TID). [out] `rc` – return code.	N/A
`Terminate`	Purpose Terminates a thread. Parameters [in] `tid` – thread ID (TID). [in] `zombie` – fictitious parameter. [in] `code` – thread exit code. [out] `rc` – return code.	N/A
`Exit`	Purpose Terminates the current thread. Parameters [in] `zombie` – fictitious parameter. [in] `code` – thread exit code. [out] `rc` – return code.	N/A
`Wait`	Purpose Locks the current thread until the defined thread is terminated. Parameters [in] `tid` – thread ID (TID). [in] `msec` – thread termination timeout (in milliseconds). [out] `code` – thread exit code. [out] `rc` – return code.	N/A
`SetPriority`	Purpose Defines the priority of a thread. Parameters [in] `tid` – thread ID (TID). [in] `priority` – value defining the thread priority. [out] `rc` – return code.	Allows the priority of a thread to be elevated to reduce the CPU time available to all other threads, including from other processes. It is recommended to monitor thread priority.
`GetTcb`	Purpose Allows access to the local memory of the current thread (TLS of the current thread). Parameters [out] `va` – pointer to the local memory of the current thread. [out] `rc` – return code.	N/A
`SetTls`	Purpose Defines the base address of the local memory of the current thread (TLS of the current thread). Parameters [in] `va` – pointer to the local memory of the current thread. [out] `rc` – return code.	N/A
`Sleep`	Purpose Locks the current thread for the specified duration. Parameters [in] `mdelay` – thread lockout duration (in milliseconds). [out] `rc` – return code.	N/A
`GetInfo`	Purpose Lets you get information about a thread. Parameters [in] `tid` – thread ID (TID). [out] `info` – structure containing information about the thread. [out] `rc` – return code.	N/A
`DetachIrq`	Purpose Detaches the current thread from the interrupt handled in its context. Parameters [out] `rc` – return code.	N/A
`GetAffinity`	Purpose Lets you get a thread affinity mask. Parameters [in] `tid` – thread ID (TID). [out] `mask` – thread affinity mask. [out] `rc` – return code.	N/A
`SetAffinity`	Purpose Defines a thread affinity mask. Parameters [in] `tid` – thread ID (TID). [in] `mask` – thread affinity mask. [out] `rc` – return code.	N/A
`SetSchedPolicy`	Purpose Defines the thread scheduler class. Parameters [in] `tid` – thread ID (TID). [in] `policy` – value defining the thread scheduler class. [in] `priority` – value defining the thread priority. [in] `param` – union containing parameters of a thread scheduler class. [out] `rc` – return code.	Allows the following: Convert a thread into a real-time thread that takes up all the CPU time from all other threads, including from other processes (it is recommended to monitor the thread scheduler class). Elevate the priority of a thread to reduce the CPU time available to all other threads, including from other processes (it is recommended to monitor thread priority).
`GetSchedPolicy`	Purpose Lets you get information about the thread scheduler class. Parameters [in] `tid` – thread ID (TID). [out] `policy` – value indicating the thread scheduler class. [out] `priority` – value indicating the thread priority. [out] `param` – union containing parameters of a thread scheduler class. [out] `rc` – return code.	N/A

Method	Method purpose and parameters	Potential danger of the method
`Copy`	Purpose Creates a handle based on an existing one. Parameters [in] `inHandle` – value whose binary representation consists of multiple fields, including an original handle field and an original handle permissions mask field. [in] `newRightsMask` – permissions mask of the created handle. [in] `copyBadge` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the resource transfer context object. [out] `outHandle` – value whose binary representation consists of multiple fields, including a field for the created handle and a field for the permissions mask of the created handle. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`CreateUserObject`	Purpose Creates a handle for a user resource. Parameters [in] `type` – handle type. [in] `rights` – permissions mask of the created handle. [in] `context` – pointer to the context of the user resource. [in] `ipcChannel` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is the server IPC handle of the IPC channel associated with the user resource. [out] `riid` – ID of the endpoint (RIID) associated with the user resource. [in] `handle` – value whose binary representation consists of multiple fields, including a field for the created handle and a field for the permissions mask of the created handle. The handle identifies the user resource. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`Close`	Purpose Deletes a handle. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a field for the deleted handle and a field for the permissions mask of the deleted handle. [out] `rc` – return code.	N/A
`Connect`	Purpose Creates and connects the client-, server-, and listener IPC handles. Parameters [in] `server` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the server process. [in] `srListener` – listener IPC handle that was already created by the previous method call, or the value `0xFFFFFFFF` to create the listener IPC handle. [in] `client` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the client process. [out] `outSrListerner` – the created listener IPC handle. [out] `outSrEndpoint` – server IPC handle. [out] `outClEndpoint` – client IPC handle. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`Disconnect`	Purpose Disconnects the client- and server IPC handles. Parameters [in] `client` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is the client IPC handle. [out] `rc` – return code.	N/A
`SecurityConnect`	Purpose Creates a handle and connects it to a security interface. Parameters [out] `client` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used to query the security module through the security interface. [out] `rc` – return code.	Allows a multitude of possible kernel process handle values to be used up.
`SecurityDisconnect`	Purpose Disconnects a handle from a security interface. Parameters [in] `client` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used to query the security module through the security interface. [out] `rc` – return code.	N/A
`UidAlloc`	Purpose Allocates a unique ID value. This method is used for backward compatibility because handles are currently being used instead of unique IDs. Parameters [out] `uid` – unique ID value. [out] `rc` – return code.	Allows a multitude of possible unique ID values to be used up.
`UidFree`	Purpose Frees the value of a unique ID. (This value must be freed so that it can be available for re-use.) This method is used for backward compatibility because handles are currently being used instead of unique IDs. Parameters [in] `uid` – unique ID value. [out] `rc` – return code.	Allows a unique ID value used by another process to be freed.
`GetSidByHandle`	Purpose Lets you receive a security ID (SID) based on a handle. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. [out] `sid` – security ID (SID). [out] `rc` – return code.	N/A
`Revoke`	Purpose Deletes a handle and revokes its descendants. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. [out] `rc` – return code.	N/A
`RevokeSubtree`	Purpose Revokes the handles that make up the inheritance subtree of the specified handle. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handles forming the inheritance subtree of this handle are revoked. [in] `badge` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the resource transfer context object that defines the inheritance subtree to revoke. The root node of this subtree is the handle that was generated by the transfer of the handle that is defined through the `handle` parameter and is associated with the resource transfer context object. [out] `rc` – return code.	N/A
`CreateBadge`	Purpose Creates a resource transfer context object and configures a notification mechanism for monitoring the life cycle of this object. Parameters [in] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [in] `notifyContext` – ID of the "resource–event mask" entry in the notification receiver. [in] `badgeContext` – pointer to the resource transfer context. [out] `badge` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the resource transfer context object. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.

Method	Method purpose and parameters	Potential danger of the method
`Create`	Purpose Creates a process. Parameters [in] `name` – process name. [in] `eiid` – process class name. [in] `path` – name of the executable file in ROMFS. [in] `stackSize` – size of the process stack in bytes. [in] `priority` – value defining the priority of the initial thread. [in] `flags` – flags defining the parameters for creating the process. [out] `child` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the created process. [out] `rc` – return code.	Allows the following: Create a process that will be privileged from the perspective of the solution security policy (indicating the name of the process class with privileges). Reserve a process name so that another process with this name cannot be created. Create a process that will cause the operating system to stop if an unhandled exception occurs. Load code from an executable file into process memory for subsequent execution of that code. Exhaust RAM by creating a multitude of processes. Exhaust the kernel memory by creating a multitude of objects within it.
`LoadSeg`	Purpose Loads a program image segment into process memory from the MDL buffer. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `mdl` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer containing the program image segment. [in] `segAttr` – structure containing the parameters for loading a program image segment. [out] `rc` – return code. [out] `retaddr` – base address of the process virtual memory region where the program image segment is loaded.	Allows code to be loaded into process memory for subsequent execution of that code.
`SetEntry`	Purpose Defines a process entry point. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `entry` – entry point of the initial thread of the process. [out] `rc` – return code.	Creates conditions for executing code loaded into process memory.
`LoadElfSyms`	Purpose Loads the character table and string table from MDL buffers into process memory. MDL buffers contain a character table and string table from non-loadable segments of the ELF file. These tables are necessary for receiving stack backtrace data (information about call stacks). Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `relocBase` – base address for loading the program image. [in] `symMdl` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer containing the character table. [in] `symSegAttr` – structure containing the parameters for loading the character table. [in] `symSize` – size of the character table in bytes. [in] `strMdl` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer containing the string table. [in] `strSegAttr` – structure containing the parameters for loading the string table. [in] `strSize` – size of the string table in bytes. [out] `rc` – return code.	N/A
`SetEnv`	Purpose Loads the parameters of a process into its memory. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `env` – sequence containing process parameters. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`FreeSelfEnv`	Purpose Frees the memory of the current process occupied by parameters that were loaded by the `SetEnv` method. Parameters [out] `rc` – return code.	N/A
`Resume`	Purpose Starts a process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [out] `rc` – return code.	Allows the following: Execute code loaded into process memory. Start a multitude of previously created processes to reduce the computing resources available to other processes (it is recommended to monitor the priority of the initial thread when the `Create` method is called).
`Exit`	Purpose Terminates the current process. Parameters [in] `status` – exit code of the current process. [out] `rc` – return code.	N/A
`Terminate`	Purpose Terminates a process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [out] `rc` – return code.	Allows another process to be terminated if its handle is available. (The handle permissions mask must allow termination of the process.)
`GetExitInfo`	Purpose Lets you get information about a terminated process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the terminated process. [out] `status` – process exit code. [out] `info` – union containing information about the terminated process. [out] `rc` – return code.	N/A
`GetThreadContext`	Purpose Lets you receive the context of a thread that is part of a process that has been frozen due to an unhandled exception. When a process is frozen, execution of the process stops but its resources are not freed. Therefore, data on this process can be collected. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process that is in a frozen state. [in] `index` – thread index. It is used to enumerate threads. Enumeration starts with zero. A thread in which an unhandled exception occurred has a zero index. [out] `context` – sequence containing the thread context. [out] `rc` – return code.	Lets you disrupt isolation of a process that has been frozen due to an unhandled exception. For example, the received thread context can contain the values of variables.
`GetNextVmRegion`	Purpose Lets you get information about the virtual memory region belonging to a process that has been frozen due to an unhandled exception. When a process is frozen, execution of the process stops but its resources are not freed. Therefore, data on this process can be collected. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process that is in a frozen state. [in] `after` – address that is followed by the virtual memory region. [out] `next` – base address of the virtual memory region. [out] `size` – size of the virtual memory region in bytes. [out] `flags` – flags indicating the parameters of the virtual memory region. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer mapped to a virtual memory region. [out] `rc` – return code.	Lets you disrupt isolation of a process that has been frozen due to an unhandled exception. Process isolation is disrupted due to the opened access to the process memory region.
`TerminateAfterFreezing`	Purpose Terminates a process that has been frozen due to an unhandled exception. When a process is frozen, execution of the process stops but its resources are not freed. Therefore, data on this process can be collected. A frozen process cannot be restarted. It can only be terminated. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process that is in a frozen state. [out] `rc` – return code.	Allows termination of a process that has been frozen due to an unhandled exception. This will not allow collection of data about this process for diagnostic purposes.
`GetName`	Purpose Lets you get the name of the current process. Parameters [out] `name` – process name. [out] `rc` – return code.	N/A
`GetPath`	Purpose Lets you get the name of the executable file that was used to start the current process. Parameters [out] `path` – name of the executable file in ROMFS. [out] `rc` – return code.	N/A
`GetInitialThreadPriority`	Purpose Lets you get the priority of the initial thread of a process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [out] `priority` – value indicating the priority of the initial thread. [out] `rc` – return code.	N/A
`SetInitialThreadPriority`	Purpose Defines the priority of the initial thread of a process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `priority` – value defining the priority of the initial thread. [out] `rc` – return code.	Allows the priority of the initial thread of a process to be elevated to reduce the CPU time available to all other threads, including from other processes. It is recommended to monitor the priority of an initial thread.
`GetTasksList`	Purpose Lets you get information about existing processes. Parameters [out] `notice` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver that is configured to receive notifications regarding the termination of processes. [out] `strings` – sequence containing the parameters of processes. [out] `sids` – sequence containing the security IDs of processes (the SID of each process). [out] `count` – number of processes. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`SetInitialThreadSchedPolicy`	Purpose Defines the scheduler class and priority of the initial thread of a process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `policy` – value defining the scheduler class of the initial thread. [in] `priority` – value defining the priority of the initial thread. [in] `params` – union containing parameters of the scheduler class of the initial thread. [out] `rc` – return code.	Allows the following: Convert the initial thread of a process into a real-time thread that takes up all the CPU time from all other threads, including from other processes (it is recommended to monitor the scheduler class of an initial thread). Elevate the priority of the initial thread of a process to reduce the CPU time available to all other threads, including from other processes (it is recommended to monitor initial thread priority).
`ReseedAslr`	Purpose Defines the initial vector in the random number generator for ASLR support. Affects the results from calling the `Allocate` method of the virtual memory endpoint in the context of the defined process. Parameters [in] `task` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the process. [in] `seed` – sequence containing the initial vector for random number generation. [out] `rc` – return code.	N/A

Method	Method purpose and parameters	Potential danger of the method
`Open`	Purpose Opens a file. Parameters [in] `name` – name of the file. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the opened file. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`Close`	Purpose Closes a file. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the opened file. [out] `rc` – return code.	N/A
`Read`	Purpose Reads data from a file. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the opened file. [in] `sectorNumber` – data block number. Enumeration starts with zero. [out] `read` – size of the read data in bytes. [out] `data` – sequence containing the read data. [out] `rc` – return code.	N/A
`GetSize`	Purpose Lets you get the size of a file. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the opened file. [out] `size` – file size in bytes. [out] `rc` – return code.	N/A
`GetId`	Purpose Lets you get the unique ID of a file. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the opened file. [out] `id` – unique ID of the file. [out] `rc` – return code.	N/A
`Count`	Purpose Lets you get the number of files in the file system. Parameters [out] `count` – number of files in the file system. [out] `rc` – return code.	N/A
`GetInfo`	Purpose Lets you get the name and unique ID of a file based on the file index. Parameters [in] `index` – file index. Enumeration starts with zero. [in] `nameLenMax` – buffer size for saving the file name. [out] `name` – name of the file. [out] `id` – unique ID of the file. [out] `rc` – return code.	N/A
`GetFsSize`	Purpose Lets you get the size of the file system. Parameters [out] `fsSize` – size of the file system in bytes. [out] `rc` – return code.	N/A

Method	Method purpose and parameters	Potential danger of the method
`GetEnv`	Purpose Lets you get the value of a HAL parameter. Parameters [in] `name` – name of the parameter. [out] `value` – value of the parameter. [out] `rc` – return code.	Lets you get values of HAL parameters that could contain critical system information.
`GetPrivReg`	Purpose Lets you get the value of a privileged register. Parameters [in] `reg` – name of the register. [out] `val` – value of the register. [out] `rc` – return code.	Lets you set up a data transfer channel with a process that has access to the `SetPrivReg` or `SetPrivRegRange` method. It is recommended to monitor the name of a register.
`SetPrivReg`	Purpose Sets the value of a privileged register. Parameters [in] `reg` – name of the register. [in] `val` – value of the register. [out] `rc` – return code.	Allows the following: Set the value of a privileged register. Set up a data transfer channel with a process that has access to the `GetPrivReg` or `GetPrivRegRange` method. It is recommended to monitor the name of a register.
`GetPrivRegRange`	Purpose Lets you get the value of a privileged register. Parameters [in] `regRange` – name of the registers range. [in] `offset` – register offset in the registers range. [out] `val` – value of the register. [out] `rc` – return code.	Lets you set up a data transfer channel with a process that has access to the `SetPrivReg` or `SetPrivRegRange` method. It is recommended to monitor the name of the registers range and the register offset in this range.
`SetPrivRegRange`	Purpose Sets the value of a privileged register. Parameters [in] `regRange` – name of the registers range. [in] `offset` – register offset in the registers range. [in] `val` – value of the register. [out] `rc` – return code.	Allows the following: Set the value of a privileged register. Set up a data transfer channel with a process that has access to the `GetPrivReg` or `GetPrivRegRange` method. It is recommended to monitor the name of the registers range and the register offset in this range.
`FlushCache`	Purpose Clears the processor cache. Parameters [in] `type` – value defining the cache type (data cache, instructions cache, or joint data and instructions cache). [in] `va` – base address of the virtual memory region. The cache corresponding to this region is cleared. [in] `size` – size of the virtual memory region. The cache corresponding to this region is cleared. [out] `rc` – return code.	Allows the processor cache to be cleared.
`DebugWrite`	Purpose Puts data into the diagnostic output that is written, for example, to a COM port or USB port (version 3.0 or later, with DbC support). Parameters [in] `data` – sequence containing the data to be put into the diagnostic output. [out] `rc` – return code.	Lets you populate diagnostic output with fictitious (uninformative) data.

Method	Method purpose and parameters	Potential danger of the method
`CreateUser`	Purpose Assigns user code profiling. Profiling generates statistics on the execution of user code in the context of the defined thread. These statistics show how many times the user code from different sections of the defined virtual address range was triggered during the profiling period. Parameters [in] `tid` – thread ID (TID). [in] `from` – starting address of the virtual address range for which the statistics are being gathered. [in] `to` – end address of the virtual address range for which the statistics are being gathered. [in] `scale` – value defining the granularity for dividing user code within the virtual address range defined through the `from` and `to` parameters. The address range will be divided into the specific number of sections according to this value. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`DestroyUser`	Purpose Cancels user code profiling. Parameters [in] `tid` – thread ID (TID). [out] `rc` – return code.	N/A
`CreateKernel`	Purpose Assigns kernel code profiling. Profiling results in statistics on kernel code execution. These statistics show how many times the kernel code was triggered from different sections of the memory address range of the process that called this method. The range of virtual addresses occupied by kernel code are identical for all processes. Kernel code execution statistics are gathered in the aggregate and not within the context of one process or thread. Parameters [out] `from` – starting address of the virtual address range for which the statistics are being gathered. [out] `to` – end address of the virtual address range for which the statistics are being gathered. [out] `scale` – value indicating the granularity for dividing kernel code within the virtual address range corresponding to the `from` and `to` parameters. The address range will be divided into the specific number of sections defined by this value. [out] `size` – size of data containing the statistics in bytes. [out] `rc` – return code.	N/A
`DestroyKernel`	Purpose Cancels kernel code profiling. Parameters [out] `rc` – return code.	N/A
`StartKernel`	Purpose Starts kernel code profiling. Parameters [out] `rc` – return code.	N/A
`StopKernel`	Purpose Stops kernel code profiling. Parameters [out] `rc` – return code.	N/A
`GetKernelData`	Purpose Lets you get data containing the kernel code execution statistics received during profiling. Parameters [in] `buf` – pointer to the buffer used to save data containing kernel code execution statistics. [out] `rc` – return code.	N/A
`GetCoverageData`	Purpose Lets you get information about kernel code coverage. Parameters [in] `index` – index for enumerating object files containing instrumented code for gathering coverage data. Enumeration starts with zero. [out] `buf` – sequence containing information about the code coverage of an object file (in `gcda` format). [out] `size` – size (in bytes) of data containing information about the code coverage of an object file. [out] `name` – path to the `*.gcda` file that was assigned during compilation. [out] `rc` – return code.	N/A
`FlushGcov`	Purpose Output of data on kernel code coverage in `gcda` format via UART. Parameters [out] `rc` – return code.	N/A
`FlushGcovFile`	Purpose Output of data on code coverage in `gcda` format via UART. Parameters [in] `name` – path to the `*.gcda` file that was assigned during compilation. [in] `buf` – pointer to the buffer containing information about code coverage in `gcda` format. [in] `size` – size of data containing code coverage information. [out] `rc` – return code.	N/A
`GetCounters`	Purpose Lets you get the values of performance counters. Parameters [in] `prefix` – prefix for names of performance counters. [in] `names` – sequence containing the names of performance counters. [out] `values` – sequence containing the values of performance counters. [out] `rc` – return code.	N/A

Method	Method purpose and parameters	Potential danger of the method
`Connect`	Purpose Requests to create an IPC channel with a server for use of the defined endpoint. Parameters [in] `server` – name of the server. [in] `service` – qualified name of the endpoint. [in] `msecs` – timeout for the request to be accepted by the server, in milliseconds. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is the client IPC handle. [out] `id` – endpoint ID. [out] `rc` – return code.	Lets you create a load on a server by sending a large number of requests to create an IPC channel.
`Listen`	Purpose Checks for a client request to create an IPC channel for use of an endpoint. Parameters [in] `filter` – fictitious parameter. [in] `msecs` – client request timeout, in milliseconds. [out] `client` – client name. [out] `service` – qualified name of the endpoint. [out] `rc` – return code.	N/A
`Drop`	Purpose Rejects a client request to create an IPC channel for use of the defined endpoint. Parameters [in] `client` – client name. [in] `service` – qualified name of the endpoint. [out] `rc` – return code.	N/A
`Accept`	Purpose Accepts a client request to create an IPC channel for use of the defined endpoint. Parameters [in] `client` – client name. [in] `service` – qualified name of the endpoint. [in] `id` – endpoint ID. [in] `listener` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is the listener IPC handle. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is the server IPC handle. [out] `rc` – return code.	N/A

Method	Method purpose and parameters	Potential danger of the method
`Create`	Purpose Creates a notification receiver. Parameters [out] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`SubscribeToObject`	Purpose Adds a "resource–event mask" entry to the notification receiver so that it can receive notifications about events that occur with the defined resource and match the defined event mask. Parameters [in] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [in] `object` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the resource. [in] `evMask` – event mask. [in] `evId` – ID of the "resource–event mask" entry. It is used to identify the entry in received notifications. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.
`UnsubscribeFromEvent`	Purpose Deletes notifications matching a "resource–event mask" entry with the defined ID from the notification receiver. Parameters [in] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [in] `evId` – ID of the "resource–event mask" entry. [out] `rc` – return code.	N/A
`UnsubscribeFromObject`	Purpose Deletes notifications matching the defined resource from the notification receiver. Parameters [in] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [in] `object` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the resource. [out] `rc` – return code.	N/A
`GetEvent`	Purpose Extracts notifications from the receiver. Parameters [in] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [in] `mdelay` – timeout for notifications to appear in the receiver, in milliseconds. [out] `evId` – ID of the "resource–event mask" entry matching the resource for which the notifications are extracted. [out] `evMask` – mask of events that occurred with the resource. [out] `rc` – return code.	N/A
`DropAndWake`	Purpose Deletes all "resource–event mask" entries from the defined notification receiver, resumes execution of all threads awaiting an event associated with the defined notification receiver, and (optionally) prohibits the addition of "resource–event mask" entries to the defined notification receiver. Parameters [in] `notify` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the notification receiver. [in] `finish` – value defining whether or not the addition of "resource–event mask" entries will be prohibited (`0` – will not be prohibited, `1` – will be prohibited). [out] `rc` – return code.	N/A
`SetObjectEvent`	Purpose Signals that events from the defined event mask occurred with the defined user resource. Parameters [in] `object` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the user resource. [in] `evMask` – mask of events to be signaled. [out] `rc` – return code.	N/A

Contents