Method Refresh

WinArk/KernelNotifyTable.cpp:166–356

}

void CKernelNotifyTable::Refresh() {
#ifdef _WIN64
	static ULONG Max = 64;
#else
	static ULONG Max = 8;
#endif

	ULONG count;
	ProcessNotifyCountData data;

	data.pCount = (PULONG)SymbolHelper::GetKernelSymbolAddressFromName("PspCreateProcessNotifyRoutineCount");
	data.pExCount = (PULONG)SymbolHelper::GetKernelSymbolAddressFromName("PspCreateProcessNotifyRoutineExCount");
	count = DriverHelper::GetProcessNotifyCount(&data);
	NotifyInfo info;
	info.Count = count;
	info.pRoutine = (void*)SymbolHelper::GetKernelSymbolAddressFromName("PspCreateProcessNotifyRoutine");

	m_Table.data.n = 0;
	m_Table.data.info.clear();

	// Enum CreateProcessNotify
	if (count > 0) {
		SIZE_T size = Max * sizeof(void*) + sizeof(ULONG);
		wil::unique_virtualalloc_ptr<> buffer(::VirtualAlloc(nullptr, size, MEM_COMMIT, PAGE_READWRITE));

		KernelCallbackInfo* p = (KernelCallbackInfo*)buffer.get();
		if (p != nullptr) {
			p->Count = count + 1;
			DriverHelper::EnumProcessNotify(&info, p);
			for (int i = 0; i < count; i++) {
				CallbackInfo info;
				info.Routine = p->Address[i];
				info.Type = CallbackType::CreateProcessNotify;
				info.Module = Helpers::GetKernelModuleByAddress((ULONG_PTR)info.Routine);
				std::wstring path = Helpers::StringToWstring(info.Module);
				info.Company = GetCompanyName(path);
				m_Table.data.info.push_back(std::move(info));
			}
		}
	}

	ULONG offset = SymbolHelper::GetKernelStructMemberOffset("_OBJECT_TYPE", "CallbackList");
	KernelNotifyInfo notifyInfo;
	notifyInfo.Type = NotifyType::ProcessObjectNotify;
	notifyInfo.Offset = offset;
	count = DriverHelper::GetObCallbackCount(&notifyInfo);
	if (count > 0) {
		SIZE_T size = Max * sizeof(ObCallbackInfo);
		wil::unique_virtualalloc_ptr<> buffer(::VirtualAlloc(nullptr, size, MEM_COMMIT, PAGE_READWRITE));

		ObCallbackInfo* p = (ObCallbackInfo*)buffer.get();
		if (p != nullptr) {
			DriverHelper::EnumObCallbackNotify(&notifyInfo, p, size);
			for (int i = 0; i < count; i++) {
				CallbackInfo info;
				info.Routine = p[i].PostOperation;
				info.Type = CallbackType::ProcessObPostOperationNotify;
				info.Module = Helpers::GetKernelModuleByAddress((ULONG_PTR)info.Routine);