Method OnScanTerminatedProcess

Source/Client/NM_Engine/IProcessScanner.cpp:171–239

}

void IScanner::OnScanTerminatedProcess(HANDLE hProcess)
{
	std::lock_guard <std::recursive_mutex> __lock(m_Mutex);

	SCANNER_LOG(LL_SYS, "Terminated process scanner has been started!");

	if (!IS_VALID_HANDLE(hProcess) || !g_nmApp->DynamicWinapiInstance()->IsValidHandle(hProcess))
		return;

	auto dwProcessId = g_winapiApiTable->GetProcessId(hProcess);
	if (!dwProcessId)
		return;

	SCANNER_LOG(LL_SYS, "Target process id: %u", dwProcessId);

	if (IsScannedProcess(dwProcessId))
	{
		SCANNER_LOG(LL_SYS, "Process already scanned!");
		return;
	}

	// Add to checked list
	m_vScannedProcessIDs.push_back(dwProcessId);

	// Quick filter for system process
	if (dwProcessId <= 4)
	{
		SCANNER_LOG(LL_SYS, "System process scan passed!");
		return;
	}

	// Check target pid is it our pid
	if (g_winapiApiTable->GetCurrentProcessId() == dwProcessId)
	{
		SCANNER_LOG(LL_SYS, "Itself scan passed!");
		return;
	}

	// Check target pid is protected from ourself
	auto vLauncherProcesses = g_nmApp->InitMgrInstance()->m_vLaunchedProcesses;
	if (vLauncherProcesses.empty() == false)
	{
		for (const auto & pCurrProc : vLauncherProcesses)
		{
			if (IS_VALID_SMART_PTR(pCurrProc))
			{
				if (pCurrProc->dwProcessId == dwProcessId)
				{
					SCANNER_LOG(LL_SYS, "Target process is protected by ourself!");
					return;
				}
			}
		}
	}

	// Scan routine

	/// 1