Skip to content

Instantly share code, notes, and snippets.

@swwwolf
Created December 14, 2014 21:42
Show Gist options
  • Save swwwolf/6f9bb46b07054366e473 to your computer and use it in GitHub Desktop.
Save swwwolf/6f9bb46b07054366e473 to your computer and use it in GitHub Desktop.
VOID PspExitProcess(IN BOOLEAN LastThreadExit,
IN PEPROCESS Process) {
// ...
if (LastThreadExit) {
// ...
if (PspCreateProcessNotifyRoutineCount != 0) {
ULONG i;
PEX_CALLBACK_ROUTINE_BLOCK CallBack;
PCREATE_PROCESS_NOTIFY_ROUTINE Rtn;
for ( i = 0; i < PSP_MAX_CREATE_PROCESS_NOTIFY; i++ ) {
CallBack = ExReferenceCallBackBlock(&PspCreateProcessNotifyRoutine[i]);
if (CallBack != NULL) {
Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE)ExGetCallBackBlockRoutine(CallBack);
Rtn(Process->InheritedFromUniqueProcessId,
Process->UniqueProcessId,
FALSE);
ExDereferenceCallBackBlock(&PspCreateProcessNotifyRoutine[i],
CallBack);
}
}
}
}
// ...
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment