Method ScanProcesses

Source/Client/NM_Engine/IProcessScanner.cpp:369–424

}

bool IScanner::ScanProcesses()
{
	SCANNER_LOG(LL_SYS, "Process scanner routine started!");

	// Check SystemExtendedProcessInformation and SystemProcessInformation and compare both of them
	auto vDifferentProcesses = GetDifferentProcessList();
	if (vDifferentProcesses.empty() == false)
	{
		SCANNER_LOG(LL_ERR, "Unknown process(es) found! Size: %u", vDifferentProcesses.size());

		for (const auto & pCurrProc : vDifferentProcesses)
		{
			SCANNER_LOG(LL_CRI, "Different process id: %u", pCurrProc->dwProcessId);
			// TODO: Send to quarentine
		}
	}

	// Scan alive processes
	auto vProcesses = ListProcessesM1();
	if (vProcesses.empty())
	{
		return false;
	}

	for (const auto & pCurrProc : vProcesses)
	{
		if (IS_VALID_SMART_PTR(pCurrProc))
		{
			OnScanProcess(pCurrProc->dwProcessId);
		}
	}

	// Check terminated processes with NtGetNextProcess
	auto processEnumerator = std::make_unique<CSafeProcessHandle>(PROCESS_QUERY_INFORMATION);
	if (!IS_VALID_SMART_PTR(processEnumerator))
	{
		return false;
	}

	auto vTerminatedProcesses = processEnumerator->EnumerateProcesses(false);
	if (vTerminatedProcesses.empty())
	{
		return false;
	}

	auto dwExitCode = 0UL;
	for (const auto & hCurrProc : vTerminatedProcesses)
	{
		if (g_winapiApiTable->GetExitCodeProcess(hCurrProc, &dwExitCode) && dwExitCode == STILL_ACTIVE)
			continue;

		OnScanTerminatedProcess(hCurrProc);
	}

	return true;
}

// ----------------------------------------------------------------------