| 25 | } |
| 26 | |
| 27 | void IScanner::OnScanThread(HANDLE hProcess, SYSTEM_EXTENDED_THREAD_INFORMATION * pCurrThread) |
| 28 | { |
| 29 | std::lock_guard <std::recursive_mutex> __lock(m_Mutex); |
| 30 | |
| 31 | // Process params |
| 32 | auto dwThreadId = pCurrThread ? reinterpret_cast<DWORD_PTR>(pCurrThread->ThreadInfo.ClientId.UniqueThread) : DWORD_PTR(0); |
| 33 | auto dwProcessId = g_winapiApiTable->GetProcessId(hProcess); |
| 34 | auto pThread = std::unique_ptr<CThread>(); |
| 35 | auto ntStatus = NTSTATUS(0x0); |
| 36 | auto ulReadBytes = 0UL; |
| 37 | |
| 38 | SCANNER_LOG(LL_SYS, "Thread scanner has been started! Target thread: %lld Target proc: %p(%u)", dwThreadId, hProcess, dwProcessId); |
| 39 | |
| 40 | // Check params |
| 41 | if (!IS_VALID_HANDLE(hProcess) || !g_nmApp->DynamicWinapiInstance()->IsValidHandle(hProcess)) |
| 42 | { |
| 43 | SCANNER_LOG(LL_ERR, "Thread owner process is NOT alive!"); |
| 44 | goto _Complete; |
| 45 | } |
| 46 | |
| 47 | if (!pCurrThread) |
| 48 | { |
| 49 | SCANNER_LOG(LL_ERR, "Thread param is NULL!"); |
| 50 | goto _Complete; |
| 51 | } |
| 52 | |
| 53 | // check already processed |
| 54 | if (IsScannedThread(dwThreadId)) |
| 55 | { |
| 56 | SCANNER_LOG(LL_SYS, "Thread already scanned!"); |
| 57 | goto _Complete; |
| 58 | } |
| 59 | |
| 60 | // Add to checked list |
| 61 | m_vScannedThreadIDs.push_back(dwThreadId); |
| 62 | |
| 63 | // Scan routine |
| 64 | |
| 65 | |
| 66 | _Complete: |
| 67 | return; |
| 68 | } |
| 69 | |
| 70 | bool IScanner::EnumerateThreads(HANDLE hProcess) |
| 71 | { |
nothing calls this directly
no test coverage detected