mirror-ac/driver/thread.h

#ifndef THREAD_H
#define THREAD_H

#include <ntifs.h>

#include  "common.h"

typedef struct _HIDDEN_SYSTEM_THREAD_REPORT
{
	INT report_code;
	INT found_in_kthreadlist;
	INT found_in_pspcidtable;
	UINT64 thread_address;
	LONG thread_id;
	CHAR thread[ 4096 ];

}HIDDEN_SYSTEM_THREAD_REPORT, *PHIDDEN_SYSTEM_THREAD_REPORT;

typedef struct _ATTACH_PROCESS_REPORT
{
	INT report_code;
    UINT32 thread_id;
    UINT64 thread_address;

}ATTACH_PROCESS_REPORT, *PATTACH_PROCESS_REPORT;

VOID ValidateKPCRBThreads(
	_In_ PIRP Irp
);

VOID DetectThreadsAttachedToProtectedProcess();

#endif