mirror of
https://github.com/donnaskiez/ac.git
synced 2024-11-21 22:24:08 +01:00
43 lines
No EOL
946 B
C
43 lines
No EOL
946 B
C
#ifndef THREAD_H
|
|
#define THREAD_H
|
|
|
|
#include <ntifs.h>
|
|
|
|
#include "common.h"
|
|
#include "callbacks.h"
|
|
|
|
typedef struct _HIDDEN_SYSTEM_THREAD_REPORT
|
|
{
|
|
INT report_code;
|
|
INT found_in_kthreadlist;
|
|
INT found_in_pspcidtable;
|
|
UINT64 thread_address;
|
|
LONG thread_id;
|
|
CHAR thread[4096];
|
|
|
|
} HIDDEN_SYSTEM_THREAD_REPORT, *PHIDDEN_SYSTEM_THREAD_REPORT;
|
|
|
|
typedef struct _ATTACH_PROCESS_REPORT
|
|
{
|
|
INT report_code;
|
|
UINT32 thread_id;
|
|
UINT64 thread_address;
|
|
|
|
} ATTACH_PROCESS_REPORT, *PATTACH_PROCESS_REPORT;
|
|
|
|
typedef struct _KPRCB_THREAD_VALIDATION_CTX
|
|
{
|
|
UINT64 thread;
|
|
BOOLEAN thread_found_in_pspcidtable;
|
|
// BOOLEAN thread_found_in_kthreadlist;
|
|
BOOLEAN finished;
|
|
|
|
} KPRCB_THREAD_VALIDATION_CTX, *PKPRCB_THREAD_VALIDATION_CTX;
|
|
|
|
BOOLEAN
|
|
ValidateThreadsPspCidTableEntry(_In_ PETHREAD Thread);
|
|
|
|
VOID
|
|
DetectThreadsAttachedToProtectedProcess();
|
|
|
|
#endif |