Method ImageHistoryFilter

PeaceMaker Kernel/ImageHistoryFilter.cpp:21–63

Register the necessary notify routines. @param Detector - Detection instance used to analyze untrusted operations. @param InitializeStatus - Status of initialization. */

	@param InitializeStatus - Status of initialization.
*/
ImageHistoryFilter::ImageHistoryFilter (
	_In_ PDETECTION_LOGIC Detector,
	_Out_ NTSTATUS* InitializeStatus
	)
{
	//
	// Set the create process notify routine.
	//
	*InitializeStatus = PsSetCreateProcessNotifyRoutineEx(ImageHistoryFilter::CreateProcessNotifyRoutine, FALSE);
	if (NT_SUCCESS(*InitializeStatus) == FALSE)
	{
		DBGPRINT("ImageHistoryFilter!ImageHistoryFilter: Failed to register create process notify routine with status 0x%X.", *InitializeStatus);
		return;
	}
	
	//
	// Set the load image notify routine.
	//
	*InitializeStatus = PsSetLoadImageNotifyRoutine(ImageHistoryFilter::LoadImageNotifyRoutine);
	if (NT_SUCCESS(*InitializeStatus) == FALSE)
	{
		DBGPRINT("ImageHistoryFilter!ImageHistoryFilter: Failed to register load image notify routine with status 0x%X.", *InitializeStatus);
		return;
	}

	FltInitializePushLock(&ImageHistoryFilter::ProcessHistoryLock);

	ImageHistoryFilter::ProcessHistoryHead = RCAST<PPROCESS_HISTORY_ENTRY>(ExAllocatePoolWithTag(PagedPool, sizeof(PROCESS_HISTORY_ENTRY), PROCESS_HISTORY_TAG));
	if (ImageHistoryFilter::ProcessHistoryHead == NULL)
	{
		DBGPRINT("ImageHistoryFilter!ImageHistoryFilter: Failed to allocate the process history head.");
		*InitializeStatus = STATUS_NO_MEMORY;
		return;
	}
	memset(ImageHistoryFilter::ProcessHistoryHead, 0, sizeof(PROCESS_HISTORY_ENTRY));
	InitializeListHead(RCAST<PLIST_ENTRY>(ImageHistoryFilter::ProcessHistoryHead));
	this->ProcessHistorySize = 0;

	//
	// Set the detector.
	//
	ImageHistoryFilter::detector = Detector;
}

/**
	Clean up the process history linked-list.