Notify routine called when a new image is loaded into a process. Adds the image to the corresponding process history element. @param FullImageName - A PUNICODE_STRING that identifies the executable image file. Might be NULL. @param ProcessId - The process ID where this image is being mapped. @param ImageInfo - Structure containing a variety of properties about the image being loaded. */
| 515 | @param ImageInfo - Structure containing a variety of properties about the image being loaded. |
| 516 | */ |
| 517 | VOID |
| 518 | ImageHistoryFilter::LoadImageNotifyRoutine( |
| 519 | _In_ PUNICODE_STRING FullImageName, |
| 520 | _In_ HANDLE ProcessId, |
| 521 | _In_ PIMAGE_INFO ImageInfo |
| 522 | ) |
| 523 | { |
| 524 | NTSTATUS status; |
| 525 | PPROCESS_HISTORY_ENTRY currentProcessHistory; |
| 526 | PIMAGE_LOAD_HISTORY_ENTRY newImageLoadHistory; |
| 527 | |
| 528 | UNREFERENCED_PARAMETER(ImageInfo); |
| 529 | |
| 530 | currentProcessHistory = NULL; |
| 531 | newImageLoadHistory = NULL; |
| 532 | status = STATUS_SUCCESS; |
| 533 | |
| 534 | if (ImageHistoryFilter::destroying) |
| 535 | { |
| 536 | return; |
| 537 | } |
| 538 | |
| 539 | // |
| 540 | // Acquire a shared lock to iterate processes. |
| 541 | // |
| 542 | FltAcquirePushLockShared(&ImageHistoryFilter::ProcessHistoryLock); |
| 543 | |
| 544 | // |
| 545 | // Iterate histories for a match. |
| 546 | // |
| 547 | if (ImageHistoryFilter::ProcessHistoryHead) |
| 548 | { |
| 549 | currentProcessHistory = ImageHistoryFilter::ProcessHistoryHead; |
| 550 | do |
| 551 | { |
| 552 | if (currentProcessHistory->ProcessId == ProcessId && currentProcessHistory->ProcessTerminated == FALSE) |
| 553 | { |
| 554 | break; |
| 555 | } |
| 556 | currentProcessHistory = RCAST<PPROCESS_HISTORY_ENTRY>(currentProcessHistory->ListEntry.Blink); |
| 557 | } while (currentProcessHistory && currentProcessHistory != ImageHistoryFilter::ProcessHistoryHead); |
| 558 | } |
| 559 | |
| 560 | // |
| 561 | // This might happen if we load on a running machine that already has processes. |
| 562 | // |
| 563 | if (currentProcessHistory == NULL || currentProcessHistory == ImageHistoryFilter::ProcessHistoryHead) |
| 564 | { |
| 565 | DBGPRINT("ImageHistoryFilter!LoadImageNotifyRoutine: Failed to find PID 0x%X in history.", ProcessId); |
| 566 | status = STATUS_NOT_FOUND; |
| 567 | goto Exit; |
| 568 | } |
| 569 | |
| 570 | // |
| 571 | // Allocate space for the new image history entry. |
| 572 | // |
| 573 | newImageLoadHistory = RCAST<PIMAGE_LOAD_HISTORY_ENTRY>(ExAllocatePoolWithTag(PagedPool, sizeof(IMAGE_LOAD_HISTORY_ENTRY), IMAGE_HISTORY_TAG)); |
| 574 | if (newImageLoadHistory == NULL) |
nothing calls this directly
no test coverage detected