Method TerminateProcessInHistory

PeaceMaker Kernel/ImageHistoryFilter.cpp:354–395

Set a process to terminated, still maintain the history. @param ProcessId - The process ID of the process being terminated. */

	@param ProcessId - The process ID of the process being terminated.
*/
VOID
ImageHistoryFilter::TerminateProcessInHistory (
	_In_ HANDLE ProcessId
	)
{
	PPROCESS_HISTORY_ENTRY currentProcessHistory;

	if (ImageHistoryFilter::destroying)
	{
		return;
	}

	//
	// Acquire a shared lock to iterate processes.
	//
	FltAcquirePushLockShared(&ImageHistoryFilter::ProcessHistoryLock);

	//
	// Iterate histories for a match.
	//
	if (ImageHistoryFilter::ProcessHistoryHead)
	{
		currentProcessHistory = ImageHistoryFilter::ProcessHistoryHead;
		do
		{
			//
			// Find the process history with the same PID and then set it to terminated.
			//
			if (currentProcessHistory->ProcessId == ProcessId)
			{
				currentProcessHistory->ProcessTerminated = TRUE;
				break;
			}
			currentProcessHistory = RCAST<PPROCESS_HISTORY_ENTRY>(currentProcessHistory->ListEntry.Blink);
		} while (currentProcessHistory && currentProcessHistory != ImageHistoryFilter::ProcessHistoryHead);
	}

	//
	// Release the lock.
	//
	FltReleasePushLock(&ImageHistoryFilter::ProcessHistoryLock);
}

/**
	Notify routine called on new process execution.