From 9f166823781ef5e44ef01ac8ee4ee17e475edb2e Mon Sep 17 00:00:00 2001
From: Dark Byte <dark_byte@hotmail.com>
Date: Mon, 22 Jul 2019 22:33:28 +0200
Subject: [PATCH] fix processwatcher

---
 DBKKernel/processlist.c | 67 +++++++++++++++++++++++------------------
 1 file changed, 37 insertions(+), 30 deletions(-)

diff --git a/DBKKernel/processlist.c b/DBKKernel/processlist.c
index 82ec67ff..29079e52 100644
--- a/DBKKernel/processlist.c
+++ b/DBKKernel/processlist.c
@@ -145,47 +145,54 @@ VOID CreateProcessNotifyRoutine(IN HANDLE  ParentId, IN HANDLE  ProcessId, IN BO
 		//aquire a spinlock
 		if (ExAcquireResourceExclusiveLite(&ProcesslistR, TRUE))
 		{
+
+			if (PsLookupProcessByProcessId((PVOID)ProcessId, &CurrentProcess) != STATUS_SUCCESS)
+			{
+				ExReleaseResourceLite(&ProcesslistR);
+				return;
+			}
+
 			if ((ProcessWatcherOpensHandles) && (WatcherProcess))
 			{
-				if (PsLookupProcessByProcessId((PVOID)ProcessId, &CurrentProcess) == STATUS_SUCCESS)
+				
+				
+				if (Create)
 				{
-					if (Create)
+					//Open a handle to this process
+
+					/*
+						
+					HANDLE ph = 0;
+					NTSTATUS r = ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ph);
+
+					DbgPrint("CreateProcessNotifyRoutine: ObOpenObjectByPointer=%x  ph=%x", r, ph);
+					r = ZwDuplicateObject(ZwCurrentProcess(), ph, WatcherHandle, &ProcessHandle, PROCESS_ALL_ACCESS, 0, DUPLICATE_CLOSE_SOURCE);
+
+					DbgPrint("CreateProcessNotifyRoutine: ZwDuplicateObject=%x (handle=%x)", r, ProcessHandle);
+					*/
+						
+					KAPC_STATE oldstate;
+
+						
+					KeStackAttachProcess((PKPROCESS)WatcherProcess, &oldstate);						
+					__try
 					{
-						//Open a handle to this process
-
-						/*
-						
-						HANDLE ph = 0;
-						NTSTATUS r = ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ph);
-
-						DbgPrint("CreateProcessNotifyRoutine: ObOpenObjectByPointer=%x  ph=%x", r, ph);
-						r = ZwDuplicateObject(ZwCurrentProcess(), ph, WatcherHandle, &ProcessHandle, PROCESS_ALL_ACCESS, 0, DUPLICATE_CLOSE_SOURCE);
-
-						DbgPrint("CreateProcessNotifyRoutine: ZwDuplicateObject=%x (handle=%x)", r, ProcessHandle);
-						*/
-						
-						KAPC_STATE oldstate;
-
-						
-						KeStackAttachProcess((PKPROCESS)WatcherProcess, &oldstate);						
 						__try
 						{
-							__try
-							{
-								ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ProcessHandle);
-							}
-							__except (1)
-							{
-								DbgPrint("Exception during ObOpenObjectByPointer");
-							}
+							ObOpenObjectByPointer(CurrentProcess, 0, NULL, PROCESS_ALL_ACCESS, *PsProcessType, KernelMode, &ProcessHandle);
 						}
-						__finally
+						__except (1)
 						{
-							KeUnstackDetachProcess(&oldstate);
+							DbgPrint("Exception during ObOpenObjectByPointer");
 						}
-					
 					}
+					__finally
+					{
+						KeUnstackDetachProcess(&oldstate);
+					}
+					
 				}
+				
 
 				if (InternalProcessList == NULL)
 				{