mirror of
https://github.com/JKornev/hidden
synced 2024-06-30 19:02:03 +00:00
98014e750e
- Fixed BSOD on driver deinitialization step - Fixed resources leak in the reg filter - Fixed path normalization function - Added support for inherit type in predefined process monitor configs - Added support for opening protected processes by subsystem - Added tests for protected processes and other little fixes
27 lines
657 B
C
27 lines
657 B
C
#pragma once
|
|
|
|
#include <Ntddk.h>
|
|
|
|
typedef struct _ProcessTableEntry {
|
|
HANDLE processId;
|
|
|
|
BOOLEAN excluded;
|
|
ULONG inheritExclusion;
|
|
|
|
BOOLEAN protected;
|
|
ULONG inheritProtection;
|
|
|
|
BOOLEAN subsystem;
|
|
BOOLEAN inited;
|
|
|
|
} ProcessTableEntry, *PProcessTableEntry;
|
|
|
|
NTSTATUS InitializeProcessTable(VOID(*InitProcessEntryCallback)(PProcessTableEntry, PCUNICODE_STRING, HANDLE));
|
|
VOID DestroyProcessTable();
|
|
|
|
BOOLEAN AddProcessToProcessTable(PProcessTableEntry entry);
|
|
BOOLEAN RemoveProcessFromProcessTable(PProcessTableEntry entry);
|
|
BOOLEAN GetProcessInProcessTable(PProcessTableEntry entry);
|
|
BOOLEAN UpdateProcessInProcessTable(PProcessTableEntry entry);
|
|
|