dobin-RedEdr/RedEdrDriver/hashcache.h

#pragma once

#include <ntddk.h>
#include <stdio.h>

// Increased from 128 to accommodate long paths (up to MAX_PATH=260) plus JSON escaping.
// Each backslash needs to be escaped, so worst case is ~520 chars, using 600 for safety.
#define PROC_NAME_LEN 600

typedef struct _PROCESS_INFO {
    HANDLE ProcessId;
    wchar_t name[PROC_NAME_LEN];

    HANDLE ppid;
    wchar_t parent_name[PROC_NAME_LEN];

    int observe;
    volatile LONG injected;
} PROCESS_INFO, * PPROCESS_INFO;


#define HASH_TABLE_SIZE 256

typedef struct _HASH_ENTRY {
    HANDLE ProcessId;
    PPROCESS_INFO ProcessInfo;
    struct _HASH_ENTRY* Next;
} HASH_ENTRY, * PHASH_ENTRY;


NTSTATUS InitializeHashTable();
NTSTATUS AddProcessInfo(HANDLE ProcessId, PPROCESS_INFO ProcessInfo);
PPROCESS_INFO LookupProcessInfo(HANDLE ProcessId);
NTSTATUS RemoveProcessInfo(HANDLE ProcessId);
VOID FreeHashTable();
ULONG HashFunction(HANDLE ProcessId);