| 6 | ProcessProtectGlobals g_ProtectData; |
| 7 | |
| 8 | OB_PREOP_CALLBACK_STATUS |
| 9 | OnPreOpenProcess(PVOID, POB_PRE_OPERATION_INFORMATION Info) { |
| 10 | if (Info->KernelHandle) |
| 11 | return OB_PREOP_SUCCESS; |
| 12 | |
| 13 | auto process = (PEPROCESS)Info->Object; |
| 14 | auto pid = HandleToUlong(PsGetProcessId(process)); |
| 15 | |
| 16 | AutoLock locker(g_ProtectData.Lock); |
| 17 | bool find = FindProcess(pid); |
| 18 | if (g_ProtectData.Attack && find) { |
| 19 | if (Info->Operation == OB_OPERATION_HANDLE_CREATE) { |
| 20 | Info->Parameters->CreateHandleInformation.DesiredAccess |= (PROCESS_TERMINATE | PROCESS_VM_READ | PROCESS_VM_WRITE); |
| 21 | } |
| 22 | else { |
| 23 | Info->Parameters->DuplicateHandleInformation.DesiredAccess |= (PROCESS_TERMINATE | PROCESS_VM_READ | PROCESS_VM_WRITE); |
| 24 | } |
| 25 | } |
| 26 | else { |
| 27 | if (Info->Operation == OB_OPERATION_HANDLE_CREATE) { |
| 28 | // found in list,remove terminate, read, write accesses |
| 29 | Info->Parameters->CreateHandleInformation.DesiredAccess &= |
| 30 | ~PROCESS_TERMINATE; |
| 31 | Info->Parameters->CreateHandleInformation.DesiredAccess &= |
| 32 | ~PROCESS_VM_READ; |
| 33 | Info->Parameters->CreateHandleInformation.DesiredAccess &= |
| 34 | ~PROCESS_VM_WRITE; |
| 35 | } |
| 36 | else { |
| 37 | // found in list,remove terminate, read, write accesses |
| 38 | Info->Parameters->DuplicateHandleInformation.DesiredAccess &= |
| 39 | ~PROCESS_TERMINATE; |
| 40 | Info->Parameters->DuplicateHandleInformation.DesiredAccess &= |
| 41 | ~PROCESS_VM_READ; |
| 42 | Info->Parameters->DuplicateHandleInformation.DesiredAccess &= |
| 43 | ~PROCESS_VM_WRITE; |
| 44 | } |
| 45 | |
| 46 | } |
| 47 | |
| 48 | |
| 49 | return OB_PREOP_SUCCESS; |
| 50 | } |
| 51 | |
| 52 | bool FindProcess(ULONG pid) { |
| 53 | if (g_ProtectData.PidsCount == 0) |
nothing calls this directly
no test coverage detected