Notify routine called on new process execution. @param Process - The EPROCESS structure of the new/terminating process. @param ProcessId - The new child's process ID. @param CreateInfo - Information about the process being created. */
| 401 | @param CreateInfo - Information about the process being created. |
| 402 | */ |
| 403 | VOID |
| 404 | ImageHistoryFilter::CreateProcessNotifyRoutine ( |
| 405 | _In_ PEPROCESS Process, |
| 406 | _In_ HANDLE ProcessId, |
| 407 | _In_ PPS_CREATE_NOTIFY_INFO CreateInfo |
| 408 | ) |
| 409 | { |
| 410 | UNREFERENCED_PARAMETER(Process); |
| 411 | // |
| 412 | // If a new process is being created, add it to the history of processes. |
| 413 | // |
| 414 | if (CreateInfo) |
| 415 | { |
| 416 | ImageHistoryFilter::AddProcessToHistory(ProcessId, CreateInfo); |
| 417 | DBGPRINT("ImageHistoryFilter!CreateProcessNotifyRoutine: Registered process 0x%X.", ProcessId); |
| 418 | } |
| 419 | else |
| 420 | { |
| 421 | DBGPRINT("ImageHistoryFilter!CreateProcessNotifyRoutine: Terminating process 0x%X.", ProcessId); |
| 422 | // |
| 423 | // Set the process as "terminated". |
| 424 | // |
| 425 | ImageHistoryFilter::TerminateProcessInHistory(ProcessId); |
| 426 | } |
| 427 | } |
| 428 | |
| 429 | /** |
| 430 | Retrieve the full image file name for a process. |
nothing calls this directly
no outgoing calls
no test coverage detected