| 1072 | //} |
| 1073 | |
| 1074 | VOID DbgkCreateThread( |
| 1075 | PETHREAD Thread |
| 1076 | ) { |
| 1077 | PVOID Port; |
| 1078 | DBGKM_APIMSG m; |
| 1079 | PDBGKM_CREATE_THREAD CreateThreadArgs; |
| 1080 | PDBGKM_CREATE_PROCESS CreateProcessArgs; |
| 1081 | PEPROCESS Process; |
| 1082 | PDBGKM_LOAD_DLL LoadDllArgs; |
| 1083 | NTSTATUS status; |
| 1084 | PIMAGE_NT_HEADERS NtHeaders = nullptr; |
| 1085 | PTEB Teb; |
| 1086 | ULONG OldFlags = 0; |
| 1087 | PFILE_OBJECT FileObject; |
| 1088 | OBJECT_ATTRIBUTES ioStatus; |
| 1089 | PVOID Object; |
| 1090 | PETHREAD CurrentThread; |
| 1091 | |
| 1092 | #if defined(_WIN64) |
| 1093 | PVOID Wow64Process = nullptr; |
| 1094 | #endif |
| 1095 | |
| 1096 | PAGED_CODE(); |
| 1097 | |
| 1098 | Process = PsGetCurrentProcessByThread(Thread); |
| 1099 | |
| 1100 | #if defined(_WIN64) |
| 1101 | //Wow64Process = Process->WoW64Process; |
| 1102 | #endif |
| 1103 | |
| 1104 | /*OldFlags = PS_TEST_SET_BITS(&Process->Flags, PS_PROCESS_FLAGS_CREATE_REPORTED | PS_PROCESS_FLAGS_IMAGE_NOTIFY_DONE);*/ |
| 1105 | if ((OldFlags & PS_PROCESS_FLAGS_IMAGE_NOTIFY_DONE) == 0 && (PspNotifyEnableMask&1)) { |
| 1106 | IMAGE_INFO_EX ImageInfoEx; |
| 1107 | PUNICODE_STRING ImageName; |
| 1108 | POBJECT_NAME_INFORMATION FileNameInfo; |
| 1109 | |
| 1110 | // |
| 1111 | // notification of main.exe |
| 1112 | // |
| 1113 | ImageInfoEx.ImageInfo.Properties = 0; |
| 1114 | ImageInfoEx.ImageInfo.ImageAddressingMode = IMAGE_ADDRESSING_MODE_32BIT; |
| 1115 | //ImageInfoEx.ImageInfo.ImageBase = Process->SectionBaseAddress; |
| 1116 | ImageInfoEx.ImageInfo.ImageSize = 0; |
| 1117 | |
| 1118 | __try { |
| 1119 | //NtHeaders = RtlImageNtHeader(Process->SectionBaseAddress); |
| 1120 | if (NtHeaders) { |
| 1121 | #ifdef _WIN64 |
| 1122 | if (Wow64Process != nullptr) { |
| 1123 | ImageInfoEx.ImageInfo.ImageSize = DBGKP_FIELD_FROM_IMAGE_OPTIONAL_HEADER((PIMAGE_NT_HEADERS32)NtHeaders, SizeOfImage); |
| 1124 | } |
| 1125 | else { |
| 1126 | #endif |
| 1127 | ImageInfoEx.ImageInfo.ImageSize = DBGKP_FIELD_FROM_IMAGE_OPTIONAL_HEADER(NtHeaders, SizeOfImage); |
| 1128 | #ifdef _WIN64 |
| 1129 | } |
| 1130 | #endif |
| 1131 | } |
nothing calls this directly
no test coverage detected