Method OnScanProcess

Source/Client/NM_Engine/IProcessScanner.cpp:241–367

}

void IScanner::OnScanProcess(DWORD dwProcessId)
{
	std::lock_guard <std::recursive_mutex> __lock(m_Mutex);

	SCANNER_LOG(LL_SYS, "Process scanner has been started! Target process id: %u", dwProcessId);

	if (IsScannedProcess(dwProcessId))
	{
		SCANNER_LOG(LL_SYS, "Process already scanned!");
		return;
	}

	// Add to checked list
	m_vScannedProcessIDs.push_back(dwProcessId);

	// Quick filter for system process
	if (dwProcessId <= 4)
	{
		SCANNER_LOG(LL_SYS, "System process scan passed!");
		return;
	}

	// Check target pid is it our pid
	if (g_winapiApiTable->GetCurrentProcessId() == dwProcessId)
	{
		SCANNER_LOG(LL_SYS, "Itself scan passed!");
		return;
	}

	// Check target pid is protected from ourself
	auto vLauncherProcesses = g_nmApp->InitMgrInstance()->m_vLaunchedProcesses;
	if (vLauncherProcesses.empty() == false)
	{
		for (const auto & pCurrProc : vLauncherProcesses)
		{
			if (IS_VALID_SMART_PTR(pCurrProc))
			{
				if (pCurrProc->dwProcessId == dwProcessId)
				{
					SCANNER_LOG(LL_SYS, "Target process is protected by ourself!");
					return;
				}
			}
		}
	}

	 // todo: get handle from kernelside

	// Check quick alive status
	auto hProcessSync = g_nmApp->DynamicWinapiInstance()->NTHelper()->OpenProcess(SYNCHRONIZE, dwProcessId);
	if (!IS_VALID_HANDLE(hProcessSync))
	{
		SCANNER_LOG(LL_ERR, "Target process is not alive! Last error: %p", g_winapiApiTable->GetLastError());
		return;
	}
	g_nmApp->DynamicWinapiInstance()->SafeCloseHandle(hProcessSync);

	// Create handle access