PsNotify.c File Reference

#include <kmt_test.h>
#include <debug.h>

Include dependency graph for PsNotify.c:

Go to the source code of this file.

Functions
static VOID NTAPI	CreateProcessNotifyRoutine (IN HANDLE ParentId, IN HANDLE ProcessId, IN BOOLEAN Create)
static VOID	TestCreateProcessNotify (VOID)
static VOID NTAPI	CreateThreadNotifyRoutine (IN HANDLE ProcessId, IN HANDLE ThreadId, IN BOOLEAN Create)
static VOID	TestCreateThreadNotify (VOID)
static VOID NTAPI	LoadImageNotifyRoutine (IN PUNICODE_STRING FullImageName OPTIONAL, IN HANDLE ProcessId, IN PIMAGE_INFO ImageInfo)
static VOID	TestLoadImageNotify (VOID)
	START_TEST (PsNotify)

Function Documentation

CreateProcessNotifyRoutine()

static VOID NTAPI CreateProcessNotifyRoutine ( IN HANDLE  ParentId, IN HANDLE  ProcessId, IN BOOLEAN  Create  )

static

Definition at line 16 of file PsNotify.c.

{
    ok_irql(PASSIVE_LEVEL);
    if (!Create)
        ok_eq_pointer(ProcessId, PsGetCurrentProcessId());
    else
        ok(ProcessId != PsGetCurrentProcessId(),
           "ProcessId %p equals current\n", ProcessId);
    DPRINT("%s(%p, %p, %d)\n", __FUNCTION__, ParentId, ProcessId, Create);
}

Referenced by TestCreateProcessNotify().

CreateThreadNotifyRoutine()

static VOID NTAPI CreateThreadNotifyRoutine ( IN HANDLE  ProcessId, IN HANDLE  ThreadId, IN BOOLEAN  Create  )

static

Definition at line 69 of file PsNotify.c.

{
    ok_irql(PASSIVE_LEVEL);
    if (!Create)
    {
        ok_eq_pointer(ProcessId, PsGetCurrentProcessId());
        ok_eq_pointer(ThreadId, PsGetCurrentThreadId());
    }
    else
    {
        ok(ThreadId != PsGetCurrentThreadId(),
           "ThreadId %p equals current\n", ThreadId);
    }
    DPRINT("%s(%p, %p, %d)\n", __FUNCTION__, ProcessId, ThreadId, Create);
}

Referenced by TestCreateThreadNotify().

LoadImageNotifyRoutine()

static VOID NTAPI LoadImageNotifyRoutine ( IN PUNICODE_STRING FullImageName  OPTIONAL, IN HANDLE  ProcessId, IN PIMAGE_INFO  ImageInfo  )

static

Definition at line 127 of file PsNotify.c.

{
    ok_irql(PASSIVE_LEVEL);
    DPRINT("%s('%wZ', %p, %p)\n", __FUNCTION__, FullImageName, ProcessId, ImageInfo);
}

Referenced by TestLoadImageNotify().

START_TEST()

START_TEST

(

PsNotify

)

Definition at line 172 of file PsNotify.c.

{
    TestCreateProcessNotify();
    TestCreateThreadNotify();
    TestLoadImageNotify();
}

TestCreateProcessNotify()

static VOID TestCreateProcessNotify ( VOID  )

static

Definition at line 32 of file PsNotify.c.

{
    NTSTATUS Status;
 
    Status = PsSetCreateProcessNotifyRoutine(NULL, TRUE);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetCreateProcessNotifyRoutine(NULL, FALSE);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsSetCreateProcessNotifyRoutine(NULL, TRUE);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsSetCreateProcessNotifyRoutine(NULL, TRUE);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, FALSE);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    /* TODO: test whether the callback is notified on process creation */
 
    Status = PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    /* TODO: register the same routine twice */
    /* TODO: register more than the maximum number of notifications */
}

Referenced by START_TEST().

TestCreateThreadNotify()

static VOID TestCreateThreadNotify ( VOID  )

static

Definition at line 90 of file PsNotify.c.

{
    NTSTATUS Status;
 
    Status = PsRemoveCreateThreadNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetCreateThreadNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsRemoveCreateThreadNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsRemoveCreateThreadNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsRemoveCreateThreadNotifyRoutine(CreateThreadNotifyRoutine);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetCreateThreadNotifyRoutine(CreateThreadNotifyRoutine);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    /* TODO: test whether the callback is notified on thread creation */
 
    Status = PsRemoveCreateThreadNotifyRoutine(CreateThreadNotifyRoutine);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsRemoveCreateThreadNotifyRoutine(CreateThreadNotifyRoutine);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    /* TODO: register the same routine twice */
    /* TODO: register more than the maximum number of notifications */
}

Referenced by START_TEST().

TestLoadImageNotify()

static VOID TestLoadImageNotify ( VOID  )

static

Definition at line 138 of file PsNotify.c.

{
    NTSTATUS Status;
 
    Status = PsRemoveLoadImageNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetLoadImageNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsRemoveLoadImageNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsRemoveLoadImageNotifyRoutine(NULL);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    Status = PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    /* TODO: test whether the callback is notified on image load */
 
    Status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
    ok_eq_hex(Status, STATUS_SUCCESS);
 
    Status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
    ok_eq_hex(Status, STATUS_PROCEDURE_NOT_FOUND);
 
    /* TODO: register the same routine twice */
    /* TODO: register more than the maximum number of notifications */
}

Referenced by START_TEST().