| 979 | } |
| 980 | |
| 981 | VOID |
| 982 | ImageHistoryFilter::PopulateImageDetailedRequest( |
| 983 | _Inout_ PIMAGE_DETAILED_REQUEST ImageDetailedRequest |
| 984 | ) |
| 985 | { |
| 986 | NTSTATUS status; |
| 987 | PPROCESS_HISTORY_ENTRY currentProcessHistory; |
| 988 | PIMAGE_LOAD_HISTORY_ENTRY currentImageEntry; |
| 989 | ULONG i; |
| 990 | |
| 991 | i = 0; |
| 992 | |
| 993 | if (ImageHistoryFilter::destroying) |
| 994 | { |
| 995 | return; |
| 996 | } |
| 997 | |
| 998 | // |
| 999 | // Acquire a shared lock to iterate processes. |
| 1000 | // |
| 1001 | FltAcquirePushLockShared(&ImageHistoryFilter::ProcessHistoryLock); |
| 1002 | |
| 1003 | if (ImageHistoryFilter::ProcessHistoryHead) |
| 1004 | { |
| 1005 | currentProcessHistory = RCAST<PPROCESS_HISTORY_ENTRY>(ImageHistoryFilter::ProcessHistoryHead->ListEntry.Blink); |
| 1006 | while (currentProcessHistory && currentProcessHistory != ImageHistoryFilter::ProcessHistoryHead) |
| 1007 | { |
| 1008 | if (ImageDetailedRequest->ProcessId == currentProcessHistory->ProcessId && |
| 1009 | ImageDetailedRequest->EpochExecutionTime == currentProcessHistory->EpochExecutionTime) |
| 1010 | { |
| 1011 | // |
| 1012 | // Iterate the images for basic information. |
| 1013 | // |
| 1014 | FltAcquirePushLockShared(¤tProcessHistory->ImageLoadHistoryLock); |
| 1015 | |
| 1016 | // |
| 1017 | // The head isn't an element so skip it. |
| 1018 | // |
| 1019 | currentImageEntry = RCAST<PIMAGE_LOAD_HISTORY_ENTRY>(currentProcessHistory->ImageLoadHistory->ListEntry.Flink); |
| 1020 | while (currentImageEntry != currentProcessHistory->ImageLoadHistory) |
| 1021 | { |
| 1022 | if (i == ImageDetailedRequest->ImageIndex) |
| 1023 | { |
| 1024 | if (currentImageEntry->ImageFileName.Buffer) |
| 1025 | { |
| 1026 | status = RtlStringCbCopyUnicodeString(RCAST<NTSTRSAFE_PWSTR>(ImageDetailedRequest->ImagePath), MAX_PATH * sizeof(WCHAR), ¤tImageEntry->ImageFileName); |
| 1027 | if (NT_SUCCESS(status) == FALSE) |
| 1028 | { |
| 1029 | DBGPRINT("ImageHistoryFilter!PopulateImageDetailedRequest: Failed to copy the image file name of an image with status 0x%X and source size %i.", status, currentImageEntry->ImageFileName.Length); |
| 1030 | break; |
| 1031 | } |
| 1032 | } |
| 1033 | |
| 1034 | // |
| 1035 | // Copy the stack history. |
| 1036 | // |
| 1037 | ImageDetailedRequest->StackHistorySize = (ImageDetailedRequest->StackHistorySize > currentImageEntry->CallerStackHistorySize) ? currentImageEntry->CallerStackHistorySize : ImageDetailedRequest->StackHistorySize; |
| 1038 | memcpy(ImageDetailedRequest->StackHistory, currentImageEntry->CallerStackHistory, ImageDetailedRequest->StackHistorySize * sizeof(STACK_RETURN_INFO)); |