2016-07-21 23:02:31 +00:00
|
|
|
#pragma once
|
|
|
|
|
|
|
|
#include <Ntddk.h>
|
2021-08-21 20:21:18 +00:00
|
|
|
#include "Helper.h"
|
2016-07-21 23:02:31 +00:00
|
|
|
|
2016-10-10 21:37:28 +00:00
|
|
|
typedef struct _ProcessTableEntry {
|
2021-08-21 20:21:18 +00:00
|
|
|
HANDLE processId;
|
2016-08-27 20:18:54 +00:00
|
|
|
|
2021-08-21 20:21:18 +00:00
|
|
|
BOOLEAN excluded;
|
|
|
|
ULONG inheritExclusion;
|
2016-08-27 20:18:54 +00:00
|
|
|
|
2021-08-21 20:21:18 +00:00
|
|
|
BOOLEAN protected;
|
|
|
|
ULONG inheritProtection;
|
2016-08-27 20:18:54 +00:00
|
|
|
|
2021-08-21 20:21:18 +00:00
|
|
|
BOOLEAN hidden;
|
2021-08-24 20:25:12 +00:00
|
|
|
BOOLEAN postponeHiding;
|
2021-08-21 20:21:18 +00:00
|
|
|
ULONG inheritStealth;
|
|
|
|
PEPROCESS reference;
|
|
|
|
HANDLE_TABLE_ENTRY cidEntryBackup;
|
|
|
|
PHANDLE_TABLE_ENTRY cidEntry;
|
2021-07-25 20:15:08 +00:00
|
|
|
|
2021-08-21 20:21:18 +00:00
|
|
|
BOOLEAN subsystem;
|
|
|
|
BOOLEAN inited;
|
2016-10-10 21:37:28 +00:00
|
|
|
|
2016-07-21 23:02:31 +00:00
|
|
|
} ProcessTableEntry, *PProcessTableEntry;
|
|
|
|
|
|
|
|
NTSTATUS InitializeProcessTable(VOID(*InitProcessEntryCallback)(PProcessTableEntry, PCUNICODE_STRING, HANDLE));
|
2021-07-30 00:06:02 +00:00
|
|
|
VOID ClearProcessTable(VOID(*CleanupCallback)(PProcessTableEntry));
|
|
|
|
VOID EnumProcessTable(VOID(*EnumCallback)(PProcessTableEntry));
|
2016-07-21 23:02:31 +00:00
|
|
|
|
2016-10-18 21:28:55 +00:00
|
|
|
// Important notice:
|
|
|
|
// Keep in mind that internal sync mechanisms removed from functions below (including DestroyProcessTable)
|
|
|
|
// because in some situations we need to perform two operation under one lock, for instance we should
|
|
|
|
// perform GetProcessInProcessTable and UpdateProcessInProcessTable under one lock. So in this case all
|
|
|
|
// functions, excluding InitializeProcessTable, should be synced manualy from external code
|
|
|
|
|
2016-07-21 23:02:31 +00:00
|
|
|
BOOLEAN AddProcessToProcessTable(PProcessTableEntry entry);
|
2021-08-15 00:18:23 +00:00
|
|
|
BOOLEAN RemoveProcessFromProcessTable(HANDLE ProcessId);
|
|
|
|
PProcessTableEntry GetProcessInProcessTable(HANDLE ProcessId);
|