Lines Matching defs:PSUPDRVNTPROTECT

249 typedef SUPDRVNTPROTECT *PSUPDRVNTPROTECT;
295 static int supdrvNtProtectCreate(PSUPDRVNTPROTECT *ppNtProtect, HANDLE hPid,
297 static void supdrvNtProtectRelease(PSUPDRVNTPROTECT pNtProtect);
298 static PSUPDRVNTPROTECT supdrvNtProtectLookup(HANDLE hPid);
299 static int supdrvNtProtectFindAssociatedCsrss(PSUPDRVNTPROTECT pNtProtect);
300 static int supdrvNtProtectVerifyProcess(PSUPDRVNTPROTECT pNtProtect);
782 PSUPDRVNTPROTECT pNtProtect = NULL;
808 PSUPDRVNTPROTECT pNtProtect = supdrvNtProtectLookup(PsGetProcessId(PsGetCurrentProcess()));
921 PSUPDRVNTPROTECT pNtProtect = (PSUPDRVNTPROTECT)pFileObj->FsContext;
963 PSUPDRVNTPROTECT pNtProtect = (PSUPDRVNTPROTECT)pFileObj->FsContext;
2540 static int supdrvNtProtectFindAssociatedCsrss(PSUPDRVNTPROTECT pNtProtect)
2752 static bool supdrvNtProtectIsAssociatedCsrss(PSUPDRVNTPROTECT pNtProtect, PEPROCESS pCsrss)
2775 static bool supdrvNtProtectIsFrigginThemesService(PSUPDRVNTPROTECT pNtProtect, PEPROCESS pAnnoyingProcess)
2865 static bool supdrvNtProtectIsSpawningStubProcess(PSUPDRVNTPROTECT pNtStub, HANDLE hParentPid, HANDLE hChildPid)
2906 static int supdrvNtProtectProtectNewStubChild(PSUPDRVNTPROTECT pNtParent, HANDLE hChildPid)
2911 PSUPDRVNTPROTECT pNtChild;
2966 PSUPDRVNTPROTECT pNtProtect = supdrvNtProtectLookup(hDeadPid);
2969 PSUPDRVNTPROTECT pNtChild = NULL;
2979 PSUPDRVNTPROTECT pNtParent = pNtProtect->u.pParent;
3045 static void supdrvNtProtectVerifyNewChildProtection(PSUPDRVNTPROTECT pNtStub, PSUPDRVNTPROTECT pNtVm, bool fCallerChecks)
3081 PSUPDRVNTPROTECT pNtStub = supdrvNtProtectLookup(hParentPid);
3084 PSUPDRVNTPROTECT pNtVm = supdrvNtProtectLookup(hNewPid);
3126 PSUPDRVNTPROTECT pNtStub = supdrvNtProtectLookup(pInfo->CreatingThreadId.UniqueProcess);
3137 PSUPDRVNTPROTECT pNtVm = supdrvNtProtectLookup(hNewPid);
3211 PSUPDRVNTPROTECT pNtProtect = supdrvNtProtectLookup(hObjPid);
3215 PSUPDRVNTPROTECT pNtStub = supdrvNtProtectLookup(hParentPid);
3485 PSUPDRVNTPROTECT pNtProtect = supdrvNtProtectLookup(PsGetProcessId(pProcess));
3661 static int supdrvNtProtectCreate(PSUPDRVNTPROTECT *ppNtProtect, HANDLE hPid, SUPDRVNTPROTECTKIND enmProcessKind, bool fLink)
3665 PSUPDRVNTPROTECT pNtProtect = (PSUPDRVNTPROTECT)RTMemAllocZ(sizeof(*pNtProtect));
3704 static void supdrvNtProtectRelease(PSUPDRVNTPROTECT pNtProtect)
3722 PSUPDRVNTPROTECT pRemoved = (PSUPDRVNTPROTECT)RTAvlPVRemove(&g_NtProtectTree, pNtProtect->AvlCore.Key);
3724 PSUPDRVNTPROTECT pRemovedChild = NULL;
3725 PSUPDRVNTPROTECT pChild = NULL;
3736 pRemovedChild = (PSUPDRVNTPROTECT)RTAvlPVRemove(&g_NtProtectTree, pChild->AvlCore.Key);
3768 static PSUPDRVNTPROTECT supdrvNtProtectLookup(HANDLE hPid)
3771 PSUPDRVNTPROTECT pFound = (PSUPDRVNTPROTECT)RTAvlPVGet(&g_NtProtectTree, hPid);
3791 static int supdrvNtProtectVerifyStubForVmProcess(PSUPDRVNTPROTECT pNtProtect, PRTERRINFO pErrInfo)
3797 PSUPDRVNTPROTECT pNtStub = NULL;
3887 static int supdrvNtProtectRestrictHandlesToProcessAndThread(PSUPDRVNTPROTECT pNtProtect, PRTERRINFO pErrInfo)
4071 static int supdrvNtProtectVerifyProcess(PSUPDRVNTPROTECT pNtProtect)
4118 PSUPDRVNTPROTECT pParent = pNtProtect->u.pParent;