MCPcopy Create free account
hub / github.com/IgorKorkin/MemoryRanger / DdimonpHandleZwCreateFile

Function DdimonpHandleZwCreateFile

MemRanger/DdiMon/ddi_mon.cpp:503–556  ·  view source on GitHub ↗

The hook handler for ZwCreateFile(). Logs if ZwCreateFile() is called from where not backed by any image.

Source from the content-addressed store, hash-verified

source not stored for this graph (policy: none)

Callers

nothing calls this directly

Calls 6

DdimonpFindOriginalFunction · 0.85
UtilPcToFileHeaderFunction · 0.85
RweIsInsideNewlyLoadedDriversRangeFunction · 0.85
get_objheaderbits_in_handle_table_entryFunction · 0.85
RweAddHandleTableEntryForNewlyLoadedDriverFunction · 0.85
RweApplyRangesFunction · 0.85

Tested by

no test coverage detected