mirrors/fort
1
0
Fork 0
mirror of https://github.com/tnodir/fort synced 2024-11-15 04:05:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Driver: Remove SvcHost checking

Browse Source
This commit is contained in:
Nodir Temirkhodjaev 2024-10-31 13:52:14 +05:00
parent 3df077707b
commit d50961165f
3 changed files with 10 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/driver/fortcout.c
View File

@ -365,18 +365,6 @@ inline static void fort_callout_ale_classify_action(PCFORT_CALLOUT_ARG ca,
} }
} }
inline static BOOL fort_callout_ale_fill_path_tag(
PCFORT_CALLOUT_ARG ca, PFORT_CALLOUT_ALE_EXTRA cx, BOOL isSvcHost)
{
if (!isSvcHost)
return FALSE;
// TODO
// PCWSTR tag = (PCWSTR) ca->inMetaValues->subProcessTag;
return FALSE;
}
inline static void fort_callout_ale_fill_path(PCFORT_CALLOUT_ARG ca, PFORT_CALLOUT_ALE_EXTRA cx) inline static void fort_callout_ale_fill_path(PCFORT_CALLOUT_ARG ca, PFORT_CALLOUT_ALE_EXTRA cx)
{ {
PFORT_APP_PATH real_path = &cx->real_path; PFORT_APP_PATH real_path = &cx->real_path;
@ -386,13 +374,9 @@ inline static void fort_callout_ale_fill_path(PCFORT_CALLOUT_ARG ca, PFORT_CALLO
real_path->buffer = (PCWSTR) ca->inMetaValues->processPath->data; real_path->buffer = (PCWSTR) ca->inMetaValues->processPath->data;
PFORT_APP_PATH path = &cx->path; PFORT_APP_PATH path = &cx->path;
BOOL isSvcHost = FALSE;
BOOL inherited = FALSE; BOOL inherited = FALSE;
if (fort_pstree_get_proc_name( if (fort_pstree_get_proc_name(&fort_device()->ps_tree, cx->process_id, path, &inherited)) {
&fort_device()->ps_tree, cx->process_id, path, &isSvcHost, &inherited)
|| fort_callout_ale_fill_path_tag(ca, cx, isSvcHost)) {
if (!inherited) { if (!inherited) {
*real_path = *path; *real_path = *path;
} }

15
src/driver/fortps.c
View File

@ -784,20 +784,19 @@ FORT_API void fort_pstree_enum_processes(PFORT_PSTREE ps_tree)
fort_mem_free(buffer, FORT_PSTREE_POOL_TAG); fort_mem_free(buffer, FORT_PSTREE_POOL_TAG);
} }
static BOOL fort_pstree_get_proc_name_locked(PFORT_PSTREE ps_tree, DWORD processId, static BOOL fort_pstree_get_proc_name_locked(
PFORT_APP_PATH path, BOOL *isSvcHost, BOOL *inherited) PFORT_PSTREE ps_tree, DWORD processId, PFORT_APP_PATH path, BOOL *inherited)
{ {
PFORT_PSNODE proc = fort_pstree_find_proc(ps_tree, processId); PFORT_PSNODE proc = fort_pstree_find_proc(ps_tree, processId);
if (proc == NULL) if (proc == NULL)
return FALSE; return FALSE;
const UINT16 procFlags = proc->flags;
*isSvcHost = (procFlags & FORT_PSNODE_IS_SVCHOST) != 0;
PFORT_PSNAME ps_name = proc->ps_name; PFORT_PSNAME ps_name = proc->ps_name;
if (ps_name == NULL) if (ps_name == NULL)
return FALSE; return FALSE;
const UINT16 procFlags = proc->flags;
if ((procFlags & (FORT_PSNODE_NAME_INHERIT | FORT_PSNODE_NAME_CUSTOM)) if ((procFlags & (FORT_PSNODE_NAME_INHERIT | FORT_PSNODE_NAME_CUSTOM))
== FORT_PSNODE_NAME_INHERIT) == FORT_PSNODE_NAME_INHERIT)
return FALSE; return FALSE;
@ -810,15 +809,15 @@ static BOOL fort_pstree_get_proc_name_locked(PFORT_PSTREE ps_tree, DWORD process
return TRUE; return TRUE;
} }
FORT_API BOOL fort_pstree_get_proc_name(PFORT_PSTREE ps_tree, DWORD processId, PFORT_APP_PATH path, FORT_API BOOL fort_pstree_get_proc_name(
BOOL *isSvcHost, BOOL *inherited) PFORT_PSTREE ps_tree, DWORD processId, PFORT_APP_PATH path, BOOL *inherited)
{ {
BOOL res; BOOL res;
KLOCK_QUEUE_HANDLE lock_queue; KLOCK_QUEUE_HANDLE lock_queue;
KeAcquireInStackQueuedSpinLock(&ps_tree->lock, &lock_queue); KeAcquireInStackQueuedSpinLock(&ps_tree->lock, &lock_queue);
{ {
res = fort_pstree_get_proc_name_locked(ps_tree, processId, path, isSvcHost, inherited); res = fort_pstree_get_proc_name_locked(ps_tree, processId, path, inherited);
} }
KeReleaseInStackQueuedSpinLock(&lock_queue); KeReleaseInStackQueuedSpinLock(&lock_queue);

4
src/driver/fortps.h
View File

@ -34,8 +34,8 @@ FORT_API void fort_pstree_close(PFORT_PSTREE ps_tree);
FORT_API void fort_pstree_enum_processes(PFORT_PSTREE ps_tree); FORT_API void fort_pstree_enum_processes(PFORT_PSTREE ps_tree);
FORT_API BOOL fort_pstree_get_proc_name(PFORT_PSTREE ps_tree, DWORD processId, PFORT_APP_PATH path, FORT_API BOOL fort_pstree_get_proc_name(
BOOL *isSvcHost, BOOL *inherited); PFORT_PSTREE ps_tree, DWORD processId, PFORT_APP_PATH path, BOOL *inherited);
FORT_API void fort_pstree_update_services( FORT_API void fort_pstree_update_services(
PFORT_PSTREE ps_tree, const PFORT_SERVICE_INFO_LIST services, ULONG data_len); PFORT_PSTREE ps_tree, const PFORT_SERVICE_INFO_LIST services, ULONG data_len);