Lines Matching defs:pNtStub
2860 * @param pNtStub The NT protection structure for the possible
2865 static bool supdrvNtProtectIsSpawningStubProcess(PSUPDRVNTPROTECT pNtStub, HANDLE hParentPid, HANDLE hChildPid)
2868 if (pNtStub->AvlCore.Key == hParentPid) /* paranoia */
2870 if (pNtStub->enmProcessKind == kSupDrvNtProtectKind_StubSpawning)
2903 * @param pNtStub The NT protect structure for the parent.
3039 * @param pNtStub The parent.
3045 static void supdrvNtProtectVerifyNewChildProtection(PSUPDRVNTPROTECT pNtStub, PSUPDRVNTPROTECT pNtVm, bool fCallerChecks)
3048 && pNtStub->enmProcessKind == kSupDrvNtProtectKind_StubParent
3050 && pNtVm->u.pParent == pNtStub
3051 && pNtStub->u.pChild == pNtVm)
3058 LogRel(("vboxdrv: Misdetected vm stub; hParentPid=%p hChildPid=%p\n", pNtStub->AvlCore.Key, pNtVm->AvlCore.Key));
3059 if (pNtStub->enmProcessKind != kSupDrvNtProtectKind_VmProcessConfirmed)
3081 PSUPDRVNTPROTECT pNtStub = supdrvNtProtectLookup(hParentPid);
3082 if (pNtStub)
3087 if (supdrvNtProtectIsSpawningStubProcess(pNtStub, hParentPid, hNewPid))
3088 supdrvNtProtectProtectNewStubChild(pNtStub, hNewPid);
3092 supdrvNtProtectVerifyNewChildProtection(pNtStub, pNtVm, true);
3095 supdrvNtProtectRelease(pNtStub);
3126 PSUPDRVNTPROTECT pNtStub = supdrvNtProtectLookup(pInfo->CreatingThreadId.UniqueProcess);
3135 if (pNtStub)
3143 if (supdrvNtProtectIsSpawningStubProcess(pNtStub, pInfo->ParentProcessId, hNewPid))
3144 supdrvNtProtectProtectNewStubChild(pNtStub, hNewPid);
3150 supdrvNtProtectVerifyNewChildProtection(pNtStub, pNtVm,
3154 supdrvNtProtectRelease(pNtStub);
3215 PSUPDRVNTPROTECT pNtStub = supdrvNtProtectLookup(hParentPid);
3216 if (pNtStub)
3218 if (supdrvNtProtectIsSpawningStubProcess(pNtStub, hParentPid, hObjPid))
3220 supdrvNtProtectProtectNewStubChild(pNtStub, hObjPid);
3223 supdrvNtProtectRelease(pNtStub);
3797 PSUPDRVNTPROTECT pNtStub = NULL;
3801 pNtStub = pNtProtect->u.pParent; /* weak reference. */
3802 if (pNtStub)
3804 enmStub = pNtStub->enmProcessKind;
3807 uint32_t cRefs = ASMAtomicIncU32(&pNtStub->cRefs);
3811 pNtStub = NULL;
3819 if (!pNtStub)
3827 NTSTATUS rcNt = PsLookupProcessByProcessId(pNtStub->AvlCore.Key, &pStubProcess);
3836 rcNt = PsLookupThreadByThreadId(pNtStub->hOpenTid, &pStubThread);
3857 pStubThread, pNtStub->hOpenTid, pNtStub->AvlCore.Key, rcNt);
3861 "Failed to locate thread %p in %p: %#x", pNtStub->hOpenTid, pNtStub->AvlCore.Key, rcNt);
3866 "Error opening stub process %p (pid %p): %#x", pStubProcess, pNtStub->AvlCore.Key, rcNt);
3871 "Failed to locate stub process %p: %#x", pNtStub->AvlCore.Key, rcNt);
3873 supdrvNtProtectRelease(pNtStub);