| 97 | } |
| 98 | |
| 99 | NTSTATUS NtDebugActiveProcess( |
| 100 | _In_ HANDLE ProcessHandle, |
| 101 | _In_ HANDLE DebugObjectHandle |
| 102 | ) |
| 103 | /*++ |
| 104 | Routine Description: |
| 105 | Attach a debug object to a process. |
| 106 | Arguments: |
| 107 | ProcessHandle - Handle to a process to be debugged |
| 108 | DebugObjectHandle - Handle to a debug object |
| 109 | Return Value: |
| 110 | NTSTATUS - Status of call. |
| 111 | --*/ |
| 112 | { |
| 113 | NTSTATUS status; |
| 114 | KPROCESSOR_MODE PreviousMode; |
| 115 | PDEBUG_OBJECT DebugObject; |
| 116 | PEPROCESS Process, CurrentProcess; |
| 117 | PETHREAD LastThread = nullptr; |
| 118 | |
| 119 | PreviousMode = ExGetPreviousMode(); |
| 120 | // �õ������Խ��̵�eprocess |
| 121 | status = ObReferenceObjectByHandle(ProcessHandle, |
| 122 | PROCESS_SUSPEND_RESUME, |
| 123 | *PsProcessType, |
| 124 | PreviousMode, |
| 125 | (PVOID*)&Process, |
| 126 | nullptr); |
| 127 | if (!NT_SUCCESS(status)) { |
| 128 | return status; |
| 129 | } |
| 130 | |
| 131 | CurrentProcess = PsGetCurrentProcess(); |
| 132 | |
| 133 | // |
| 134 | // Don't let us debug ourselves or the system process. |
| 135 | // |
| 136 | if (Process == CurrentProcess || Process == PsInitialSystemProcess) { |
| 137 | ObDereferenceObject(Process); |
| 138 | return STATUS_ACCESS_DENIED; |
| 139 | } |
| 140 | |
| 141 | /*if (PreviousMode == UserMode) { |
| 142 | ObDereferenceObject(Process); |
| 143 | return STATUS_PROCESS_IS_PROTECTED; |
| 144 | }*/ |
| 145 | |
| 146 | // �õ����Ծ�������ĵ��Զ���DebugObject |
| 147 | status = ObReferenceObjectByHandle(DebugObjectHandle, |
| 148 | DEBUG_OBJECT_ADD_REMOVE_PROCESS, |
| 149 | *DbgkDebugObjectType, |
| 150 | PreviousMode, |
| 151 | (PVOID*)&DebugObject, |
| 152 | nullptr); |
| 153 | |
| 154 | if (NT_SUCCESS(status)) { |
| 155 | // |
| 156 | // We will be touching process address space. Block process rundown. |
nothing calls this directly
no test coverage detected