| 740 | } |
| 741 | |
| 742 | NTSTATUS RemoveSystemNotify(_In_ PVOID context) { |
| 743 | auto notify = (NotifyData*)context; |
| 744 | NTSTATUS status = STATUS_SUCCESS; |
| 745 | switch (notify->Type) |
| 746 | { |
| 747 | case NotifyType::LoadImageNotify: |
| 748 | { |
| 749 | status = PsRemoveLoadImageNotifyRoutine(reinterpret_cast<PLOAD_IMAGE_NOTIFY_ROUTINE>(notify->Address)); |
| 750 | if (!NT_SUCCESS(status)) { |
| 751 | LogError("failed to remove image load callbacks (status=%08X)\n", status); |
| 752 | } |
| 753 | break; |
| 754 | } |
| 755 | |
| 756 | case NotifyType::CreateProcessNotify: |
| 757 | { |
| 758 | // PsSetCreateProcessNotifyRoutineEx2 |
| 759 | PPsSetCreateProcessNotifyRoutineEx2 pPsSetCreateProcessNotifyRoutineEx2 = nullptr; |
| 760 | pPsSetCreateProcessNotifyRoutineEx2 = (PPsSetCreateProcessNotifyRoutineEx2)khook::GetApiAddress(L"PsSetCreateProcessNotifyRoutineEx2"); |
| 761 | if (nullptr != pPsSetCreateProcessNotifyRoutineEx2) |
| 762 | status = pPsSetCreateProcessNotifyRoutineEx2(0, notify->Address, TRUE); |
| 763 | if (status == STATUS_PROCEDURE_NOT_FOUND||!NT_SUCCESS(status)) { |
| 764 | status = PsSetCreateProcessNotifyRoutineEx(reinterpret_cast<PCREATE_PROCESS_NOTIFY_ROUTINE_EX>(notify->Address), TRUE); |
| 765 | } |
| 766 | if (status == STATUS_PROCEDURE_NOT_FOUND) { |
| 767 | status = PsSetCreateProcessNotifyRoutine(reinterpret_cast<PCREATE_PROCESS_NOTIFY_ROUTINE>(notify->Address), TRUE); |
| 768 | } |
| 769 | break; |
| 770 | } |
| 771 | |
| 772 | case NotifyType::CreateThreadNotify: |
| 773 | { |
| 774 | status = PsRemoveCreateThreadNotifyRoutine(reinterpret_cast<PCREATE_THREAD_NOTIFY_ROUTINE>(notify->Address)); |
| 775 | break; |
| 776 | } |
| 777 | case NotifyType::ThreadObjectNotify: |
| 778 | { |
| 779 | RemoveObCallbackNotify(*PsThreadType, notify->Offset, notify->Address); |
| 780 | break; |
| 781 | } |
| 782 | case NotifyType::ProcessObjectNotify: |
| 783 | { |
| 784 | RemoveObCallbackNotify(*PsProcessType, notify->Offset, notify->Address); |
| 785 | break; |
| 786 | } |
| 787 | |
| 788 | case NotifyType::RegistryNotify: |
| 789 | { |
| 790 | status = CmUnRegisterCallback(notify->Cookie); |
| 791 | break; |
| 792 | } |
| 793 | default: |
| 794 | break; |
| 795 | } |
| 796 | |
| 797 | return status; |
| 798 | } |
| 799 |
no test coverage detected