denuvo-ref/cheat-engine
1
0
Fork 0
mirror of https://github.com/cheat-engine/cheat-engine synced 2026-08-15 02:26:08 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix processwatcher

Browse source
This commit is contained in:
Dark Byte 2019-07-22 22:33:28 +02:00
parent 8e90e40825
commit 9f16682378
1 changed files with 37 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

67
DBKKernel/processlist.c
View file

@ -145,47 +145,54 @@ VOID CreateProcessNotifyRoutine(IN HANDLE ParentId, IN HANDLE ProcessId, IN BO
//aquire a spinlock
if (ExAcquireResourceExclusiveLite(&ProcesslistR, TRUE))
{
if (PsLookupProcessByProcessId((PVOID)ProcessId, &CurrentProcess) != STATUS_SUCCESS)
{
ExReleaseResourceLite(&ProcesslistR);
return;
}
if ((ProcessWatcherOpensHandles) && (WatcherProcess))
{
if (PsLookupProcessByProcessId((PVOID)ProcessId, &CurrentProcess) == STATUS_SUCCESS)
if (Create)
{
if (Create)
//Open a handle to this process
/*
HANDLE ph = 0;
NTSTATUS r = ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ph);
DbgPrint("CreateProcessNotifyRoutine: ObOpenObjectByPointer=%x ph=%x", r, ph);
r = ZwDuplicateObject(ZwCurrentProcess(), ph, WatcherHandle, &ProcessHandle, PROCESS_ALL_ACCESS, 0, DUPLICATE_CLOSE_SOURCE);
DbgPrint("CreateProcessNotifyRoutine: ZwDuplicateObject=%x (handle=%x)", r, ProcessHandle);
*/
KAPC_STATE oldstate;
KeStackAttachProcess((PKPROCESS)WatcherProcess, &oldstate);
__try
{
//Open a handle to this process
/*
HANDLE ph = 0;
NTSTATUS r = ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ph);
DbgPrint("CreateProcessNotifyRoutine: ObOpenObjectByPointer=%x ph=%x", r, ph);
r = ZwDuplicateObject(ZwCurrentProcess(), ph, WatcherHandle, &ProcessHandle, PROCESS_ALL_ACCESS, 0, DUPLICATE_CLOSE_SOURCE);
DbgPrint("CreateProcessNotifyRoutine: ZwDuplicateObject=%x (handle=%x)", r, ProcessHandle);
*/
KAPC_STATE oldstate;
KeStackAttachProcess((PKPROCESS)WatcherProcess, &oldstate);
__try
{
__try
{
ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ProcessHandle);
}
__except (1)
{
DbgPrint("Exception during ObOpenObjectByPointer");
}
ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ProcessHandle);
}
__finally
__except (1)
{
KeUnstackDetachProcess(&oldstate);
DbgPrint("Exception during ObOpenObjectByPointer");
}
}
__finally
{
KeUnstackDetachProcess(&oldstate);
}
}
if (InternalProcessList == NULL)
{