21 lines
830 B
C++
21 lines
830 B
C++
#include "DriverCommon.h"
|
|
|
|
VOID ProcessNotifyCallbackEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo) {
|
|
UNREFERENCED_PARAMETER(Process);
|
|
UNREFERENCED_PARAMETER(ProcessId);
|
|
|
|
if (CreateInfo != NULL) {
|
|
if (KeGetCurrentIrql() > APC_LEVEL) return;
|
|
|
|
HANDLE ParentId = CreateInfo->CreatingThreadId.UniqueProcess;
|
|
if (!ParentId) return;
|
|
|
|
ULONG RuleCode = 0;
|
|
if (EvaluateProcessRule(ParentId, CreateInfo->ImageFileName, CreateInfo->CommandLine, &RuleCode)) {
|
|
CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
|
|
if (CreateInfo->ImageFileName) {
|
|
SendMessageToUser(RuleCode, (ULONG)(ULONG_PTR)ParentId, CreateInfo->ImageFileName->Buffer, CreateInfo->ImageFileName->Length);
|
|
}
|
|
}
|
|
}
|
|
} |