* @brief ClickableTab::AddAssociatedElement - Track associated widgets to hide/show on state changes. * @param widget - The widget associated with th

Small wrapper around the DeviceIoControl call to the driver. @param IOCTLCode - The IOCTL code to pass to the driver. @param Input - The input buffe

Get the pointer to the filters used by this filesystem filter. Useful if you want to add/remove filters. */

Walk the stack of the current thread and resolve the module associated with the return addresses. @param ResolvedStack - Caller-supplied array of ret

Add a filter to the linked list of filters. @param MatchString - The string to filter with. @param OperationFlag - Specifies what operations this fi

Check if a string contains any filtered phrases. @param StrToCmp - The string to search. @param OperationFlag - Specify FILTER_FLAG_X's to match cer

Print stack history. @param StackHistory - The history to display. @param StackHistorySize - The size of the StackHistory array. */

Report a filter violation. @param DetectionSource - The filter type that was violated. @param CallerProcessId - The process ID of the caller that vi

Audit a stack history for invalid code. @param DetectionSource - The filter we are checking the stack of. @param SourceProcessId - The source of the

Get the alert queue for this detection logic instance. @return The Alert Queue. */

Get the dynamic sizes in a process entry from the driver. @param ProcessId - The target process ID. @param EpochExecutionTime - The time the target

Push an alert to the queue. @param Alert - The alert to push. @return Whether or not pushing the alert was successful. */

Request detailed information on a process. @param ProcessId - The subject process. @param EpochExecutionTime - The time the process was executed (in

Request a list of filters with a constant size of 10. Grab more by using the SkipCount argument. @param Type - The type of filters to grab. @param S

* @brief ClickableTab::SwapActiveState - Swap the "state" of the tab. If was clicked, remove underline, otherwise add underline. */

* @brief MainWindow::AddFilterSummary - Add a filter to the filters table. * @param FilterInfo - The filter to add. * @param FilterType - The type o

Check if an operation is on a remote process. This is called by suspicious operation callbacks such as Thread Creation. @param DetectionSource - The

Establish communication with the driver. @return Whether or not we successfully connected to the driver. */

Get the filters present in the linked-list. @param SkipFilters - The number of filters to skip. @param Filters - The output array. @param FilterSiz

Pop an alert from the queue of alerts. Follows FI-FO. @return The first in queued alert. */

Create and push a stack violation alert. @param DetectionSource - The filter we are checking the stack of. @param ViolatingAddress - If the origin o

Query if there are alerts queued. @return Whether or not alerts are queued. */

Remove a filter from the linked list of filters. @param FilterId - The unique filter ID of the filter to delete. @return Whether or not deletion was

Request detailed information on an image. @param ProcessId - The subject process. @param EpochExecutionTime - The time the process was executed (in

Request a summary of the most recent processes up to RequestCount. @param SkipCount - How many processes to "skip" in iteration. @param RequestCount

Search the current process to see if any modules contain the address. @param Address - The address to search for. @param StackReturnInfo - The struc

Restore filters from the registry. @return Whether or not the restoration was successful. */

Save the current filters to the registry for persistence. @return Whether or not the save was successful. */

Destroy the CustomFilters class by clearing the filters linked list and deleting the associated lock. */

* @brief MainWindow::AddAlertSummary - Add an alert to the table of alerts. * @param Alert - The alert to add. */

Register a filter with the driver. @param Type - The filter type. @param Flags - The filter flags (EXECUTE/DELETE/WRITE/ETC). @param Content - The

* @brief MainWindow::AddProcessSummary - Add a process to the processes table. * @param ProcessSummary - The process to add. */

Validate a user-mode pointer. @param DetectionSource - The filter we are checking the stack of. @param UserPtr - The pointer to check. @param Sourc

* @brief AddFilterWindow::ClearStates - Clear previously entered input. */

Delete a filter. @param Filter - The filter to delete. @return Whether or not the filter was deleted. */

Display an alert. Supports the various alert types. @param Alert - Alert to display. */

Free a previously pop'd alert. @param Alert - The alert to free. */

* @brief ConfigParser::GetConfigFalsePositives - Parse false positive strings from the config. * @return False positives. */

* @brief ConfigParser::GetConfigFilters - Parse filters from the config. * @return Parsed filter info. */

Get global sizes from the kernel @return The various sizes of data stored in the kernel. */

Get the summary for MaxProcessSummaries processes starting from the top of list + SkipCount. @param SkipCount - How many processes to skip in the lis

* @brief MainWindow::ImportConfigFilters - One-time config filter import. */

Check if the memory pointed by address is executable. @param Address - The address to check. @return Whether or not the memory is executable. */

Check if the queue of alerts is empty. @return Whether or not the alerts queue is empty. */

* @brief MainWindow::NotifyTabClick - Swap the active tab when a click is detected. * @param tab - The tab to swap to. */

Pop a queued alert from the Alerts queue. @return An allocated pointer to the alert or NULL if unable to pop an alert. Caller must free to prevent le

Populate a request for detailed information on a process. @param ProcessDetailedRequest - The request to populate. */

Populate a process sizes request. @param ProcesSizesRequest - The request to populate. */

* @brief InvestigateProcessWindow::RefreshWidgets - Update the standard tables. */

* @brief ClickableTab::SetCustomText - Set custom text for the tab, but store the previous text. * @param newText - The new custom text to set. */

* @brief DetailedAlertWindow::UpdateDisplayAlert - Update the window to display alert details based on AlertInfo. * @param AlertInfo - The new alert

* @brief InvestigateProcessWindow::UpdateNewProcess - Set the investigator to display another process. * @param detailedProcessInformation - The new

Update the process to protect. @param NewProcessId - The new process to protect from tampering. */

* @brief InvestigateProcessWindow::on_ImagesTable_cellClicked - Grab the stack for the new image. * @param row - Row of the image selected. * @param

Clear the queue of alerts. */

Deconstruct class members. */

Free data members that were dynamically allocated. */

Deconstruct the IOCTLCommunication class. */

Clean up the process history linked-list. */

Free data members that were dynamically allocated. */

Destruct tamper guard members. */

Teardown dynamic components of the thread filter. */

* @brief InvestigateProcessWindow::AddProcessInfoItem - Add a header item to the process info table. * @param HeaderName - Header name. */

Increment process thread count by one and retrieve the latest value. @param ProcessId - The process ID of the target process. @param ThreadCount - T

Add a process to the linked-list of process history objects. This function attempts to add a history object regardless of failures. @param ProcessId

Initialize basic members of the AlertQueue class. */

Function that decides whether or not to block a registry operation. @param KeyObject - The registry key of the operation. @param ValueName - The nam

* @brief ConfigParser::ConfigParser - Read the config file. * @param ConfigFile - The config file to parse. */

Notify routine called on new process execution. @param Process - The EPROCESS structure of the new/terminating process. @param ProcessId - The new c

Initialize class members. */

Initialize the mini-filter driver. DriverObject - The driver's object. RegistryPath - The path to the driver's registry entry. */

Initializes the necessary components of the filesystem filter. @param DriverObject - The object of the driver necessary for mini-filter initializatio

This function handles unloading the mini-filter. @param Flags - Flags indicating whether or not this is a mandatory unload. */

Retrieve the full image file name for a process. @param ProcessId - The process to get the name of. @param ProcessImageFileName - PUNICODE_STRING to

Return the string filters used in the registry filter. @return String filters for registry operations. */

Query a thread's start address for validation. @param ThreadId - The target thread's ID. @return The start address of the target thread. */

This function is called when an instance is being deleted. FltObjects - Objects related to the filter, instance, and its associated volume. Flags -

This function determines whether or not the mini-filter should attach to the volume. FltObjects - Objects related to the filter, instance, and its as

This function is called at the end of an instance teardown. FltObjects - Objects related to the filter, instance, and its associated volume. Flags -

This function is called at the start of an instance teardown. FltObjects - Objects related to the filter, instance, and its associated volume. Flags

This function is called prior to a create operation. Data - The data associated with the current operation. FltObjects - Objects related to the filt

This function is called prior to a set information operation. Data - The data associated with the current operation. FltObjects - Objects related to

This function is called prior to a write operation. Data - The data associated with the current operation. FltObjects - Objects related to the filte

Default constructor. */

Construct the IOCTLCommunication class by initializing the driver object and detector. @param DriverObject - The driver's object. @param RegistryPat

Handle basic create / close of device, always return success with no change. @param DeviceObject - The driver's device object. @param Irp - The curr

Handle IO controls for communication with the PeaceMaker user-mode interface. @param DeviceObject - The driver's device object. @param Irp - The cur

Register the necessary notify routines. @param Detector - Detection instance used to analyze untrusted operations. @param InitializeStatus - Status

* @brief MainWindow::InitializeAlertsTable - Initialize the table used for alerts. */

* @brief MainWindow::InitializeCommonTable - Common initialization across all tables. * @param table */

* @brief DetailedAlertWindow::InitializeCommonTable - Common initialization across all tables. * @param table */

* @brief InvestigateProcessWindow::InitializeCommonTable - Common initialization across all tables. * @param table */

Initialize the driver object to support IOCTL communication. */