psnotify.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for psnotify.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
NTSTATUS NTAPI	PsSetCreateProcessNotifyRoutine (IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine, IN BOOLEAN Remove)
ULONG NTAPI	PsSetLegoNotifyRoutine (PVOID LegoNotifyRoutine)
NTSTATUS NTAPI	PsRemoveLoadImageNotifyRoutine (IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine)
NTSTATUS NTAPI	PsSetLoadImageNotifyRoutine (IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine)
NTSTATUS NTAPI	PsRemoveCreateThreadNotifyRoutine (IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine)
NTSTATUS NTAPI	PsSetCreateThreadNotifyRoutine (IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine)

Variables
BOOLEAN	PsImageNotifyEnabled = FALSE
ULONG	PspThreadNotifyRoutineCount
ULONG	PspProcessNotifyRoutineCount
ULONG	PspLoadImageNotifyRoutineCount
EX_CALLBACK	PspThreadNotifyRoutine [PSP_MAX_CREATE_THREAD_NOTIFY]
EX_CALLBACK	PspProcessNotifyRoutine [PSP_MAX_CREATE_PROCESS_NOTIFY]
EX_CALLBACK	PspLoadImageNotifyRoutine [PSP_MAX_LOAD_IMAGE_NOTIFY]
PLEGO_NOTIFY_ROUTINE	PspLegoNotifyRoutine

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 13 of file psnotify.c.

Function Documentation

PsRemoveCreateThreadNotifyRoutine()

NTSTATUS NTAPI PsRemoveCreateThreadNotifyRoutine

(

IN PCREATE_THREAD_NOTIFY_ROUTINE

NotifyRoutine

)

Definition at line 211 of file psnotify.c.

Referenced by TestCreateThreadNotify().

{
    ULONG i;
    PEX_CALLBACK_ROUTINE_BLOCK CallBack;
    PAGED_CODE();

    /* Loop all callbacks */
    for (i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i++)
    {
        /* Reference this slot */
        CallBack = ExReferenceCallBackBlock(&PspThreadNotifyRoutine[i]);
        if (CallBack)
        {
            /* Check for a match */
            if (ExGetCallBackBlockRoutine(CallBack) == (PVOID)NotifyRoutine)
            {
                /* Try removing it if it matches */
                if (ExCompareExchangeCallBack(&PspThreadNotifyRoutine[i],
                                              NULL,
                                              CallBack))
                {
                    /* We removed it, now dereference the block */
                    InterlockedDecrement((PLONG)&PspThreadNotifyRoutineCount);
                    ExDereferenceCallBackBlock(&PspThreadNotifyRoutine[i],
                                               CallBack);

                    /* Wait for active callbacks */
                    ExWaitForCallBacks(CallBack);

                    /* Free the callback and return */
                    ExFreeCallBack(CallBack);
                    return STATUS_SUCCESS;
                }
            }

            /* Dereference the callback */
            ExDereferenceCallBackBlock(&PspThreadNotifyRoutine[i], CallBack);
        }
    }

    /* Nothing found to remove */
    return STATUS_PROCEDURE_NOT_FOUND;
}

PsRemoveLoadImageNotifyRoutine()

NTSTATUS NTAPI PsRemoveLoadImageNotifyRoutine

(

IN PLOAD_IMAGE_NOTIFY_ROUTINE

NotifyRoutine

)

Definition at line 127 of file psnotify.c.

Referenced by TestLoadImageNotify().

{
    ULONG i;
    PEX_CALLBACK_ROUTINE_BLOCK CallBack;
    PAGED_CODE();

    /* Loop all callbacks */
    for (i = 0; i < PSP_MAX_LOAD_IMAGE_NOTIFY; i++)
    {
        /* Reference this slot */
        CallBack = ExReferenceCallBackBlock(&PspLoadImageNotifyRoutine[i]);
        if (CallBack)
        {
            /* Check for a match */
            if (ExGetCallBackBlockRoutine(CallBack) == (PVOID)NotifyRoutine)
            {
                /* Try removing it if it matches */
                if (ExCompareExchangeCallBack(&PspLoadImageNotifyRoutine[i],
                                              NULL,
                                              CallBack))
                {
                    /* We removed it, now dereference the block */
                    InterlockedDecrement((PLONG)&PspLoadImageNotifyRoutineCount);
                    ExDereferenceCallBackBlock(&PspLoadImageNotifyRoutine[i],
                                               CallBack);

                    /* Wait for active callbacks */
                    ExWaitForCallBacks(CallBack);

                    /* Free the callback and return */
                    ExFreeCallBack(CallBack);
                    return STATUS_SUCCESS;
                }
            }

            /* Dereference the callback */
            ExDereferenceCallBackBlock(&PspLoadImageNotifyRoutine[i], CallBack);
        }
    }

    /* Nothing found to remove */
    return STATUS_PROCEDURE_NOT_FOUND;
}

PsSetCreateProcessNotifyRoutine()

NTSTATUS NTAPI PsSetCreateProcessNotifyRoutine	(	IN PCREATE_PROCESS_NOTIFY_ROUTINE	NotifyRoutine,
		IN BOOLEAN	Remove
	)

Definition at line 33 of file psnotify.c.

Referenced by TestCreateProcessNotify().

{
    ULONG i;
    PEX_CALLBACK_ROUTINE_BLOCK CallBack;
    PAGED_CODE();

    /* Check if we're removing */
    if (Remove)
    {
        /* Loop all the routines */
        for (i = 0; i < PSP_MAX_CREATE_PROCESS_NOTIFY; i++)
        {
            /* Reference the callback block */
            CallBack = ExReferenceCallBackBlock(&PspProcessNotifyRoutine[i]);
            if (!CallBack) continue;

            /* Check it this is a matching block */
            if (ExGetCallBackBlockRoutine(CallBack) == (PVOID)NotifyRoutine)
            {
                /* Try removing it if it matches */
                if (ExCompareExchangeCallBack(&PspProcessNotifyRoutine[i],
                                              NULL,
                                              CallBack))
                {
                    /* Decrement the number of routines */
                    InterlockedDecrement((PLONG)&PspProcessNotifyRoutineCount);

                    /* Dereference the block */
                    ExDereferenceCallBackBlock(&PspProcessNotifyRoutine[i],
                                               CallBack);

                    /* Wait for active callbacks */
                    ExWaitForCallBacks(CallBack);

                    /* Free the callback and exit */
                    ExFreeCallBack(CallBack);
                    return STATUS_SUCCESS;
                }

                /* Dereference the block */
                ExDereferenceCallBackBlock(&PspProcessNotifyRoutine[i],
                                           CallBack);
            }
        }

        /* We didn't find any matching block */
        return STATUS_PROCEDURE_NOT_FOUND;
    }
    else
    {
        /* Allocate a callback */
        CallBack = ExAllocateCallBack((PVOID)NotifyRoutine, NULL);
        if (!CallBack) return STATUS_INSUFFICIENT_RESOURCES;

        /* Loop all callbacks */
        for (i = 0; i < PSP_MAX_CREATE_PROCESS_NOTIFY; i++)
        {
            /* Add this routine if it's an empty slot */
            if (ExCompareExchangeCallBack(&PspProcessNotifyRoutine[i],
                                          CallBack,
                                          NULL))
            {
                /* Found and inserted into an empty slot, return */
                InterlockedIncrement((PLONG)&PspProcessNotifyRoutineCount);
                return STATUS_SUCCESS;
            }
        }

        /* We didn't find a free slot, free the callback and fail */
        ExFreeCallBack(CallBack);
        return STATUS_INVALID_PARAMETER;
    }
}

PsSetCreateThreadNotifyRoutine()

NTSTATUS NTAPI PsSetCreateThreadNotifyRoutine

(

IN PCREATE_THREAD_NOTIFY_ROUTINE

NotifyRoutine

)

Definition at line 260 of file psnotify.c.

Referenced by TestCreateThreadNotify().

{
    ULONG i;
    PEX_CALLBACK_ROUTINE_BLOCK CallBack;
    PAGED_CODE();

    /* Allocate a callback */
    CallBack = ExAllocateCallBack((PVOID)NotifyRoutine, NULL);
    if (!CallBack) return STATUS_INSUFFICIENT_RESOURCES;

    /* Loop callbacks */
    for (i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i++)
    {
        /* Add this entry if the slot is empty */
        if (ExCompareExchangeCallBack(&PspThreadNotifyRoutine[i],
                                      CallBack,
                                      NULL))
        {
            /* Return success */
            InterlockedIncrement((PLONG)&PspThreadNotifyRoutineCount);
            return STATUS_SUCCESS;
        }
    }

    /* No free space found, fail */
    ExFreeCallBack(CallBack);
    return STATUS_INSUFFICIENT_RESOURCES;
}

PsSetLegoNotifyRoutine()

ULONG NTAPI PsSetLegoNotifyRoutine

(

PVOID

LegoNotifyRoutine

)

Definition at line 113 of file psnotify.c.

{
    /* Set the System-Wide Lego Routine */
    PspLegoNotifyRoutine = LegoNotifyRoutine;

    /* Return the location to the Lego Data */
    return FIELD_OFFSET(KTHREAD, LegoData);
}

PsSetLoadImageNotifyRoutine()

NTSTATUS NTAPI PsSetLoadImageNotifyRoutine

(

IN PLOAD_IMAGE_NOTIFY_ROUTINE

NotifyRoutine

)

Definition at line 176 of file psnotify.c.

Referenced by TestLoadImageNotify().

{
    ULONG i;
    PEX_CALLBACK_ROUTINE_BLOCK CallBack;
    PAGED_CODE();

    /* Allocate a callback */
    CallBack = ExAllocateCallBack((PVOID)NotifyRoutine, NULL);
    if (!CallBack) return STATUS_INSUFFICIENT_RESOURCES;

    /* Loop callbacks */
    for (i = 0; i < PSP_MAX_LOAD_IMAGE_NOTIFY; i++)
    {
        /* Add this entry if the slot is empty */
        if (ExCompareExchangeCallBack(&PspLoadImageNotifyRoutine[i],
                                      CallBack,
                                      NULL))
        {
            /* Return success */
            InterlockedIncrement((PLONG)&PspLoadImageNotifyRoutineCount);
            PsImageNotifyEnabled = TRUE;
            return STATUS_SUCCESS;
        }
    }

    /* No free space found, fail */
    ExFreeCallBack(CallBack);
    return STATUS_INSUFFICIENT_RESOURCES;
}

Variable Documentation

PsImageNotifyEnabled

BOOLEAN PsImageNotifyEnabled = FALSE

Definition at line 18 of file psnotify.c.

Referenced by DbgkCreateThread(), MmLoadSystemImage(), and PsSetLoadImageNotifyRoutine().

PspLegoNotifyRoutine

PLEGO_NOTIFY_ROUTINE PspLegoNotifyRoutine

Definition at line 24 of file psnotify.c.

Referenced by PspRunLegoRoutine(), and PsSetLegoNotifyRoutine().

PspLoadImageNotifyRoutine

EX_CALLBACK PspLoadImageNotifyRoutine[PSP_MAX_LOAD_IMAGE_NOTIFY]

Definition at line 23 of file psnotify.c.

Referenced by PspInitPhase0(), and PspRunLoadImageNotifyRoutines().

PspLoadImageNotifyRoutineCount

ULONG PspLoadImageNotifyRoutineCount

Definition at line 20 of file psnotify.c.

Referenced by PsRemoveLoadImageNotifyRoutine(), and PsSetLoadImageNotifyRoutine().

PspProcessNotifyRoutine

EX_CALLBACK PspProcessNotifyRoutine[PSP_MAX_CREATE_PROCESS_NOTIFY]

Definition at line 22 of file psnotify.c.

Referenced by PspInitPhase0(), and PspRunCreateProcessNotifyRoutines().

PspProcessNotifyRoutineCount

ULONG PspProcessNotifyRoutineCount

Definition at line 19 of file psnotify.c.

Referenced by PspRunCreateProcessNotifyRoutines(), and PsSetCreateProcessNotifyRoutine().

PspThreadNotifyRoutine

EX_CALLBACK PspThreadNotifyRoutine[PSP_MAX_CREATE_THREAD_NOTIFY]

Definition at line 21 of file psnotify.c.

Referenced by PspInitPhase0(), and PspRunCreateThreadNotifyRoutines().

PspThreadNotifyRoutineCount

ULONG PspThreadNotifyRoutineCount

Definition at line 19 of file psnotify.c.

Referenced by PspRunCreateThreadNotifyRoutines(), PsRemoveCreateThreadNotifyRoutine(), and PsSetCreateThreadNotifyRoutine().