Lines Matching defs:pOpInfo
3200 supdrvNtProtectCallback_ProcessHandlePre(PVOID pvUser, POB_PRE_OPERATION_INFORMATION pOpInfo)
3203 Assert(pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE || pOpInfo->Operation == OB_OPERATION_HANDLE_DUPLICATE);
3204 Assert(pOpInfo->ObjectType == *PsProcessType);
3210 HANDLE hObjPid = PsGetProcessId((PEPROCESS)pOpInfo->Object);
3214 HANDLE hParentPid = PsGetProcessInheritedFromUniqueProcessId((PEPROCESS)pOpInfo->Object);
3226 pOpInfo->CallContext = pNtProtect; /* Just for reference. */
3235 if (pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE)
3238 if ((PEPROCESS)pOpInfo->Object == PsGetCurrentProcess())
3240 pOpInfo->CallContext = NULL; /* don't assert */
3244 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3245 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
3246 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
3253 pOpInfo->CallContext = NULL; /* don't assert */
3257 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3258 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
3259 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
3276 && pOpInfo->KernelHandle == 0
3280 if ( !pOpInfo->KernelHandle
3281 && pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == s_fCsrssStupidDesires)
3292 pOpInfo->CallContext = NULL; /* don't assert this. */
3305 && pOpInfo->KernelHandle == 0
3310 if (pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == s_fCsrssStupidDesires)
3319 pOpInfo->CallContext = NULL; /* don't assert this. */
3330 && pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == 0x1478 /* 6.1.7600.16385 (win7_rtm.090713-1255) */
3332 && pOpInfo->KernelHandle == 0
3338 pOpInfo->CallContext = NULL; /* don't assert this. */
3342 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3343 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
3344 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind, fAllowedRights,
3345 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess & fAllowedRights,
3348 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess &= fAllowedRights;
3354 if ( (PEPROCESS)pOpInfo->Object == PsGetCurrentProcess()
3355 && pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess == pOpInfo->Object)
3359 pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess,
3360 PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess),
3361 pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess,
3362 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess,
3363 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
3366 pOpInfo->CallContext = NULL; /* don't assert */
3375 && pOpInfo->KernelHandle == 0
3376 && pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess == s_fCsrssStupidDesires
3378 == PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess)
3379 && pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess == PsGetCurrentProcess()
3392 pOpInfo->CallContext = NULL; /* don't assert this. */
3397 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3398 pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess,
3399 PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess),
3400 pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess,
3401 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess,
3402 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
3405 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess &= fAllowedRights;
3416 supdrvNtProtectCallback_ProcessHandlePost(PVOID pvUser, POB_POST_OPERATION_INFORMATION pOpInfo)
3419 Assert(pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE || pOpInfo->Operation == OB_OPERATION_HANDLE_DUPLICATE);
3420 Assert(pOpInfo->ObjectType == *PsProcessType);
3422 if ( pOpInfo->CallContext
3423 && NT_SUCCESS(pOpInfo->ReturnStatus))
3425 ACCESS_MASK const fGrantedAccess = pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE
3426 ? pOpInfo->Parameters->CreateHandleInformation.GrantedAccess
3427 : pOpInfo->Parameters->DuplicateHandleInformation.GrantedAccess;
3432 || pOpInfo->KernelHandle,
3478 supdrvNtProtectCallback_ThreadHandlePre(PVOID pvUser, POB_PRE_OPERATION_INFORMATION pOpInfo)
3481 Assert(pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE || pOpInfo->Operation == OB_OPERATION_HANDLE_DUPLICATE);
3482 Assert(pOpInfo->ObjectType == *PsThreadType);
3484 PEPROCESS pProcess = IoThreadToProcess((PETHREAD)pOpInfo->Object);
3486 pOpInfo->CallContext = pNtProtect; /* Just for reference. */
3492 if (pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE)
3498 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3499 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
3500 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind));
3501 pOpInfo->CallContext = NULL; /* don't assert */
3509 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3510 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
3511 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
3513 pOpInfo->CallContext = NULL; /* don't assert */
3526 && pOpInfo->KernelHandle == 0
3530 if ( !pOpInfo->KernelHandle
3531 && pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == s_fCsrssStupidDesires)
3534 pOpInfo->CallContext = NULL; /* don't assert this. */
3549 && pOpInfo->KernelHandle == 0
3556 pOpInfo->CallContext = NULL; /* don't assert this. */
3560 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3561 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
3562 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind, fAllowedRights,
3563 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess & fAllowedRights,
3566 pOpInfo->Parameters->CreateHandleInformation.DesiredAccess &= fAllowedRights;
3573 && (PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess == pProcess)
3576 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3577 pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess,
3578 PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess),
3579 pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess,
3580 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess,
3581 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
3583 pOpInfo->CallContext = NULL; /* don't assert */
3593 && pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess == PsGetCurrentProcess()
3594 && pOpInfo->KernelHandle == 0
3601 pOpInfo->CallContext = NULL; /* don't assert this. */
3605 pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
3606 pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess,
3607 PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess),
3608 pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess,
3609 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess,
3610 pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind, fAllowedRights,
3611 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess & fAllowedRights,
3614 pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess &= fAllowedRights;
3626 supdrvNtProtectCallback_ThreadHandlePost(PVOID pvUser, POB_POST_OPERATION_INFORMATION pOpInfo)
3629 Assert(pOpInfo->Operation == OB_OPERATION_HANDLE_CREATE || pOpInfo->Operation == OB_OPERATION_HANDLE_DUPLICATE);
3630 Assert(pOpInfo->ObjectType == *PsThreadType);
3632 if ( pOpInfo->CallContext
3633 && NT_SUCCESS(pOpInfo->ReturnStatus))
3635 ACCESS_MASK const fGrantedAccess = pOpInfo->Parameters->CreateHandleInformation.GrantedAccess;
3640 || pOpInfo->KernelHandle,