Populate a request for detailed information on a process. @param ProcessDetailedRequest - The request to populate. */
| 751 | @param ProcessDetailedRequest - The request to populate. |
| 752 | */ |
| 753 | VOID |
| 754 | ImageHistoryFilter::PopulateProcessDetailedRequest ( |
| 755 | _Inout_ PPROCESS_DETAILED_REQUEST ProcessDetailedRequest |
| 756 | ) |
| 757 | { |
| 758 | NTSTATUS status; |
| 759 | PPROCESS_HISTORY_ENTRY currentProcessHistory; |
| 760 | PIMAGE_LOAD_HISTORY_ENTRY currentImageEntry; |
| 761 | ULONG i; |
| 762 | |
| 763 | i = 0; |
| 764 | |
| 765 | if (ImageHistoryFilter::destroying) |
| 766 | { |
| 767 | return; |
| 768 | } |
| 769 | |
| 770 | // |
| 771 | // Acquire a shared lock to iterate processes. |
| 772 | // |
| 773 | FltAcquirePushLockShared(&ImageHistoryFilter::ProcessHistoryLock); |
| 774 | |
| 775 | if (ImageHistoryFilter::ProcessHistoryHead) |
| 776 | { |
| 777 | currentProcessHistory = RCAST<PPROCESS_HISTORY_ENTRY>(ImageHistoryFilter::ProcessHistoryHead->ListEntry.Blink); |
| 778 | while (currentProcessHistory && currentProcessHistory != ImageHistoryFilter::ProcessHistoryHead) |
| 779 | { |
| 780 | if (ProcessDetailedRequest->ProcessId == currentProcessHistory->ProcessId && |
| 781 | ProcessDetailedRequest->EpochExecutionTime == currentProcessHistory->EpochExecutionTime) |
| 782 | { |
| 783 | // |
| 784 | // Set basic fields. |
| 785 | // |
| 786 | ProcessDetailedRequest->Populated = TRUE; |
| 787 | ProcessDetailedRequest->CallerProcessId = currentProcessHistory->CallerId; |
| 788 | ProcessDetailedRequest->ParentProcessId = currentProcessHistory->ParentId; |
| 789 | |
| 790 | // |
| 791 | // Copy the stack history. |
| 792 | // |
| 793 | ProcessDetailedRequest->StackHistorySize = (ProcessDetailedRequest->StackHistorySize > currentProcessHistory->CallerStackHistorySize) ? currentProcessHistory->CallerStackHistorySize : ProcessDetailedRequest->StackHistorySize; |
| 794 | memcpy(ProcessDetailedRequest->StackHistory, currentProcessHistory->CallerStackHistory, ProcessDetailedRequest->StackHistorySize * sizeof(STACK_RETURN_INFO)); |
| 795 | |
| 796 | // |
| 797 | // Copy the paths. |
| 798 | // |
| 799 | if (currentProcessHistory->ProcessImageFileName) |
| 800 | { |
| 801 | status = RtlStringCbCopyUnicodeString(RCAST<NTSTRSAFE_PWSTR>(ProcessDetailedRequest->ProcessPath), MAX_PATH * sizeof(WCHAR), currentProcessHistory->ProcessImageFileName); |
| 802 | if (NT_SUCCESS(status) == FALSE) |
| 803 | { |
| 804 | DBGPRINT("ImageHistoryFilter!PopulateProcessDetailedRequest: Failed to copy the image file name of the process with status 0x%X.", status); |
| 805 | break; |
| 806 | } |
| 807 | } |
| 808 | if (currentProcessHistory->CallerImageFileName) |
| 809 | { |
| 810 | status = RtlStringCbCopyUnicodeString(RCAST<NTSTRSAFE_PWSTR>(ProcessDetailedRequest->CallerProcessPath), MAX_PATH * sizeof(WCHAR), currentProcessHistory->CallerImageFileName); |