I need to write code for a driver. I need to get information about all the mitigation policies of a process. This is how I get the process handle :
`HANDLE h_process{};
OBJECT_ATTRIBUTES obj_attr{};
CLIENT_ID client_id{.UniqueProcess = ULongToHandle(process_id), .UniqueThread = nullptr};

InitializeObjectAttributes(&obj_attr, nullptr, OBJ_KERNEL_HANDLE, nullptr, nullptr)

NTSTATUS status = ZwOpenProcess(&h_process, PROCESS_QUERY_LIMITED_INFORMATION, &obj_attr, &client_id);`

As I understand it, it is possible to get policy information using this function:
NTSTATUS WINAPI ZwQueryInformationProcess( _In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength );

But I don’t understand what structure I should give to **ProcessInformation **field.
Could you please help me.

The only thing I’ve found on the subject is this article:
https://ntdoc.m417z.com/process_mitigation_policy_information
They suggest to use the union of the structures of all policies:
typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION { PROCESS_MITIGATION_POLICY Policy; union { PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy; PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy; PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy; PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy; PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy; PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy; PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy; PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy; PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy; PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY SystemCallFilterPolicy; PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy; PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy; PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy; PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY UserShadowStackPolicy; PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY RedirectionTrustPolicy; PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY UserPointerAuthPolicy; PROCESS_MITIGATION_SEHOP_POLICY SEHOPPolicy; }; } PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION;

But if I pass it to ProcessInformation, I get the status 0xC00000BB (The request is not supported.).

I also tryed to pass a single policy structure (**PROCESS_MITIGATION_DEP_POLICY ** for example), but then I get status 0xC0000004(The specified information record length does not match the length that is required for the specified information class.).

If I try to get the requested structure size, I always get 0x0
NTSTATUS status = ZwQueryInformationProcess(h_process, ProcessMitigationPolicy, &policy_struct, sizeof(PROCESS_MITIGATION_POLICY_INFORMATION), &ret); if (!NT_SUCCESS(status)) { logger::printLog<logger::LogLevel::Warning>("Failed to check " "PROCESS_MITIGATION_DEP_POLICY. Status: 0x%X, Ret: 0x%Xn", status, ret); return; }