noury/mirror-ac
1
0
Fork 0
mirror of https://github.com/donnaskiez/ac.git synced 2024-11-21 22:24:08 +01:00
Code Issues Projects Releases Packages Wiki Activity

eee

Browse source
This commit is contained in:
lhodges1 2023-08-21 14:45:33 +10:00
parent ced805cfba
commit c0a1bd4f75
6 changed files with 20 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
driver/callbacks.c
View file

@ -62,9 +62,8 @@ NTSTATUS HandlePeriodicCallbackReportQueue(
if ( report == NULL )
{
DEBUG_LOG( "callback report queue is empty, returning" );
KeReleaseGuardedMutex( &mutex );
Irp->IoStatus.Information = NULL;
return STATUS_SUCCESS;
Irp->IoStatus.Information = sizeof( OPEN_HANDLE_FAILURE_REPORT_HEADER );
goto end;
}
Irp->IoStatus.Information = sizeof( OPEN_HANDLE_FAILURE_REPORT ) * MAX_HANDLE_REPORTS_PER_IRP +

2
driver/queue.c
View file

@ -62,7 +62,7 @@ PVOID QueuePop(
if ( temp == NULL )
goto end;
Head->entries -= 1;
Head->entries = Head->entries - 1;
data = temp->data;
Head->start = temp->next;

12
user/km/driver.cpp
View file

@ -182,6 +182,9 @@ void kernelmode::Driver::QueryReportQueue()
if ( !header )
goto end;
if ( header->count == 0 )
goto end;
for ( int i = 0; i < header->count; i++ )
{
global::report_structures::OPEN_HANDLE_FAILURE_REPORT* report =
@ -198,6 +201,15 @@ end:
free( buffer );
}
void kernelmode::Driver::RunCallbackReportQueue()
{
while ( true )
{
this->QueryReportQueue();
std::this_thread::sleep_for( std::chrono::seconds( 10 ) );
}
}
void kernelmode::Driver::NotifyDriverOnProcessLaunch()
{
BOOLEAN status;

4
user/km/driver.h
View file

@ -21,13 +21,15 @@ namespace kernelmode
HANDLE driver_handle;
LPCWSTR driver_name;
std::shared_ptr<global::Report> report_interface;
void QueryReportQueue();
public:
Driver(LPCWSTR DriverName, std::shared_ptr<global::Report> ReportInterface );
void RunNmiCallbacks();
void VerifySystemModules();
void QueryReportQueue();
void RunCallbackReportQueue();
void NotifyDriverOnProcessLaunch();
void CompleteQueuedCallbackReports();
void EnableProcessLoadNotifyCallbacks();

2
user/km/kmanager.cpp
View file

@ -18,5 +18,5 @@ void kernelmode::KManager::VerifySystemModules()
void kernelmode::KManager::MonitorCallbackReports()
{
this->thread_pool->QueueJob( [ this ]() { this->driver_interface->QueryReportQueue(); } );
this->thread_pool->QueueJob( [ this ]() { this->driver_interface->RunCallbackReportQueue(); } );
}

7
user/main.cpp
View file

@ -28,15 +28,10 @@ DWORD WINAPI Init(HINSTANCE hinstDLL)
usermode::UManager umanager( thread_pool, report_interface );
kernelmode::KManager kmanager( driver_name, thread_pool, report_interface);
kmanager.MonitorCallbackReports();
//kmanager.RunNmiCallbacks();
//kmanager.VerifySystemModules();
while ( true )
{
kmanager.MonitorCallbackReports();
std::this_thread::sleep_for( std::chrono::seconds( 10 ) );
}
//umanager.ValidateProcessModules();
//umanager.ValidateProcessMemory();