| 443 | |
| 444 | |
| 445 | std::wstring CKernelNotifyTable::GetSingleNotifyInfo(CallbackInfo& info) { |
| 446 | CString text; |
| 447 | CString s; |
| 448 | |
| 449 | s.Format(L"0x%p", info.Routine); |
| 450 | s += L"\t"; |
| 451 | text += s; |
| 452 | |
| 453 | switch (info.Type) |
| 454 | { |
| 455 | case CallbackType::CreateProcessNotify: |
| 456 | s = L"CreateProcess"; |
| 457 | break; |
| 458 | case CallbackType::CreateThreadNotify: |
| 459 | s = L"CreateThread"; |
| 460 | break; |
| 461 | |
| 462 | case CallbackType::LoadImageNotify: |
| 463 | s = L"LoadImage"; |
| 464 | break; |
| 465 | |
| 466 | case CallbackType::ProcessObPostOperationNotify: |
| 467 | s = L"Process ObPostOperation"; |
| 468 | break; |
| 469 | |
| 470 | case CallbackType::ProcessObPreOperationNotify: |
| 471 | s = L"Process ObPreOperation"; |
| 472 | break; |
| 473 | |
| 474 | case CallbackType::ThreadObPostOperationNotify: |
| 475 | s = L"Thread ObPostOperation"; |
| 476 | break; |
| 477 | |
| 478 | case CallbackType::ThreadObPreOperationNotify: |
| 479 | s = L"Thread ObPreOperation"; |
| 480 | break; |
| 481 | |
| 482 | case CallbackType::RegistryNotify: |
| 483 | s = L"Registry Notify"; |
| 484 | break; |
| 485 | } |
| 486 | s += L"\t"; |
| 487 | text += s; |
| 488 | |
| 489 | s = info.Company.c_str(); |
| 490 | s += L"\t"; |
| 491 | text += s; |
| 492 | |
| 493 | s = Helpers::StringToWstring(info.Module).c_str(); |
| 494 | s += L"\t"; |
| 495 | text += s; |
| 496 | |
| 497 | text += L"\r\n"; |
| 498 | |
| 499 | return text.GetString(); |
| 500 | } |
| 501 | |
| 502 | LRESULT CKernelNotifyTable::OnNotifyCopy(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) { |