| 103 | } |
| 104 | |
| 105 | void OnThreadNotify(_In_ HANDLE ProcessId, _In_ HANDLE ThreadId, _In_ BOOLEAN Create) { |
| 106 | auto size = sizeof(FullItem<ThreadCreateExitInfo>); |
| 107 | auto info = (FullItem<ThreadCreateExitInfo>*)ExAllocatePoolWithTag(PagedPool, size, SYSMON_TAG); |
| 108 | if (info == nullptr) { |
| 109 | KdPrint((SYSMON_PREFIX "Failed to allocate memory\n")); |
| 110 | return; |
| 111 | } |
| 112 | auto& item = info->Data; |
| 113 | //KeQuerySystemTimePrecise(&item.Time); |
| 114 | item.Size = sizeof(item); |
| 115 | item.Type = Create ? ItemType::ThreadCreate : ItemType::ThreadExit; |
| 116 | item.ProcessId = HandleToULong(ProcessId); |
| 117 | item.ThreadId = HandleToUlong(ThreadId); |
| 118 | |
| 119 | PushItem(&info->Entry); |
| 120 | |
| 121 | if (Create) { |
| 122 | KdPrint(("�̴߳���: PID= %ld,TID= %ld\n", ProcessId, ThreadId)); |
| 123 | } |
| 124 | else { |
| 125 | KdPrint(("�߳��˳�: PID= %ld,TID= %ld\n", ProcessId, ThreadId)); |
| 126 | } |
| 127 | } |
| 128 | |
| 129 | void OnImageLoadNotify(_In_opt_ PUNICODE_STRING FullImageName, _In_ HANDLE ProcessId, _In_ PIMAGE_INFO ImageInfo) { |
| 130 | if (ProcessId == nullptr) { // kernel image |
nothing calls this directly
no test coverage detected