| 11 | #include "StackWalker.h" |
| 12 | |
| 13 | typedef class ThreadFilter |
| 14 | { |
| 15 | static PDETECTION_LOGIC Detector; // Detection utility. |
| 16 | static STACK_WALKER Walker; // Stack walking utility. |
| 17 | |
| 18 | static PVOID GetThreadStartAddress( |
| 19 | _In_ HANDLE ThreadId |
| 20 | ); |
| 21 | |
| 22 | static VOID ThreadNotifyRoutine( |
| 23 | HANDLE ProcessId, |
| 24 | HANDLE ThreadId, |
| 25 | BOOLEAN Create |
| 26 | ); |
| 27 | public: |
| 28 | ThreadFilter( |
| 29 | _In_ PDETECTION_LOGIC DetectionLogic, |
| 30 | _Inout_ NTSTATUS* InitializeStatus |
| 31 | ); |
| 32 | ~ThreadFilter(VOID); |
| 33 | |
| 34 | |
| 35 | } THREAD_FILTER, *PTHREAD_FILTER; |
nothing calls this directly
no outgoing calls
no test coverage detected