Initialize thread notify filters to detect manually mapped threads. @param DetectionLogic - Detection instance used to analyze untrusted operations. @param InitializeStatus - Status of initialization. */
| 15 | @param InitializeStatus - Status of initialization. |
| 16 | */ |
| 17 | ThreadFilter::ThreadFilter ( |
| 18 | _In_ PDETECTION_LOGIC DetectionLogic, |
| 19 | _Inout_ NTSTATUS* InitializeStatus |
| 20 | ) |
| 21 | { |
| 22 | ThreadFilter::Detector = DetectionLogic; |
| 23 | |
| 24 | // |
| 25 | // Create a thread notify routine. |
| 26 | // |
| 27 | *InitializeStatus = PsSetCreateThreadNotifyRoutine(ThreadFilter::ThreadNotifyRoutine); |
| 28 | if (NT_SUCCESS(*InitializeStatus) == FALSE) |
| 29 | { |
| 30 | DBGPRINT("ThreadFilter!ThreadFilter: Failed to create thread notify routine with status 0x%X.", *InitializeStatus); |
| 31 | } |
| 32 | } |
| 33 | |
| 34 | /** |
| 35 | Teardown dynamic components of the thread filter. |
nothing calls this directly
no outgoing calls
no test coverage detected