Increment process thread count by one and retrieve the latest value. @param ProcessId - The process ID of the target process. @param ThreadCount - The resulting thread count. @return Whether or not the process was found. */
| 933 | @return Whether or not the process was found. |
| 934 | */ |
| 935 | BOOLEAN |
| 936 | ImageHistoryFilter::AddProcessThreadCount ( |
| 937 | _In_ HANDLE ProcessId, |
| 938 | _Inout_ ULONG* ThreadCount |
| 939 | ) |
| 940 | { |
| 941 | PPROCESS_HISTORY_ENTRY currentProcessHistory; |
| 942 | BOOLEAN foundProcess; |
| 943 | |
| 944 | foundProcess = FALSE; |
| 945 | |
| 946 | if (ImageHistoryFilter::destroying) |
| 947 | { |
| 948 | return foundProcess; |
| 949 | } |
| 950 | |
| 951 | // |
| 952 | // Acquire a shared lock to iterate processes. |
| 953 | // |
| 954 | FltAcquirePushLockShared(&ImageHistoryFilter::ProcessHistoryLock); |
| 955 | |
| 956 | if (ImageHistoryFilter::ProcessHistoryHead) |
| 957 | { |
| 958 | currentProcessHistory = RCAST<PPROCESS_HISTORY_ENTRY>(ImageHistoryFilter::ProcessHistoryHead->ListEntry.Blink); |
| 959 | while (currentProcessHistory && currentProcessHistory != ImageHistoryFilter::ProcessHistoryHead) |
| 960 | { |
| 961 | if (ProcessId == currentProcessHistory->ProcessId && |
| 962 | currentProcessHistory->ProcessTerminated == FALSE) |
| 963 | { |
| 964 | currentProcessHistory->ProcessThreadCount++; |
| 965 | *ThreadCount = currentProcessHistory->ProcessThreadCount; |
| 966 | foundProcess = TRUE; |
| 967 | break; |
| 968 | } |
| 969 | currentProcessHistory = RCAST<PPROCESS_HISTORY_ENTRY>(currentProcessHistory->ListEntry.Blink); |
| 970 | } |
| 971 | } |
| 972 | |
| 973 | // |
| 974 | // Release the lock. |
| 975 | // |
| 976 | FltReleasePushLock(&ImageHistoryFilter::ProcessHistoryLock); |
| 977 | |
| 978 | return foundProcess; |
| 979 | } |
| 980 | |
| 981 | VOID |
| 982 | ImageHistoryFilter::PopulateImageDetailedRequest( |
nothing calls this directly
no outgoing calls
no test coverage detected