| 179 | } |
| 180 | |
| 181 | NTSTATUS DbgkpPostFakeProcessCreateMessages( |
| 182 | _In_ PEPROCESS Process, |
| 183 | _In_ PDEBUG_OBJECT DebugObject, |
| 184 | _In_ PETHREAD* pLastThread |
| 185 | ) |
| 186 | /*++ |
| 187 | Routine Description: |
| 188 | This routine posts the faked initial process create, thread create and mudule load messages |
| 189 | Arguments: |
| 190 | ProcessHandle - Handle to a process to be debugged |
| 191 | DebugObjectHandle - Handle to a debug object |
| 192 | Return Value: |
| 193 | None. |
| 194 | --*/ |
| 195 | { |
| 196 | NTSTATUS status; |
| 197 | KAPC_STATE ApcState; |
| 198 | PETHREAD StartThread, Thread; |
| 199 | PETHREAD LastThread; |
| 200 | |
| 201 | |
| 202 | // �ռ������̴߳�������Ϣ |
| 203 | status = kDbgUtil::g_pDbgkpPostFakeThreadMessages( |
| 204 | Process, |
| 205 | DebugObject, |
| 206 | nullptr, |
| 207 | &Thread, |
| 208 | &LastThread |
| 209 | ); |
| 210 | |
| 211 | if (NT_SUCCESS(status)) { |
| 212 | // |
| 213 | // Attach to the process so we can touch its address space |
| 214 | // |
| 215 | KeStackAttachProcess(Process, &ApcState); |
| 216 | |
| 217 | // �ռ�ģ�鴴������Ϣ |
| 218 | DbgkpPostModuleMessages(Process, Thread, DebugObject); |
| 219 | |
| 220 | KeUnstackDetachProcess(&ApcState); |
| 221 | |
| 222 | ObDereferenceObject(Thread); |
| 223 | } |
| 224 | else { |
| 225 | LastThread = nullptr; |
| 226 | } |
| 227 | |
| 228 | *pLastThread = LastThread; |
| 229 | return status; |
| 230 | } |
| 231 | |
| 232 | VOID DbgkpFreeDebugEvent( |
| 233 | _In_ PDEBUG_EVENT DebugEvent |
no test coverage detected