==== KProcessHacker ====

== IMPORTANT ==
KProcessHacker has been developed from either reverse engineering of 
the Windows kernel or ReactOS code (http://www.reactos.org). The 
following files contain "ported" ReactOS code (with modifications):

 * mm.c
   * MiDoMappedCopy
   * MiDoPoolCopy (added smarter buffer management)
   * MiGetExceptionInfo
 * ps.c
   * KphOpenProcess
   * KphOpenThread
 * se.c
   * KphOpenProcessTokenEx

== CODE STRUCTURE ==
 * handle.c
   - Contains handle table code.
 * hook.c
   - Contains hooking code. Currently you may hook any kernel-mode 
     function and object type open procedures.
 * io.c
   - Contains I/O-related code, such as device and driver functions.
 * kph.c
   - Contains support routines.
 * kprocesshacker.c
   - Contains interfacing code, mainly consisting of the I/O control 
     handler.
 * mm.c
   - Contains memory-related code, such as reading and writing.
 * ob.c
   - Contains object-related code, such as handle duplication.
 * protect.c
   - Contains process protection code. Process protection is 
     achieved by hooking ObOpenObjectByPointer and some object type 
     OpenProcedures.
 * ps.c
   - Contains process- and thread-related code, such as opening and 
     terminating.
 * ref.c
   - Contains the KPH object manager.
 * se.c
   - Contains security-related code. Only function there is 
     KphOpenProcessTokenEx.
 * sync.c
   - Various synchronization functions.
 * sysservice.c
   - System service logging.
 * trace.c
   - Stack trace code.
 * version.c
   - Contains Windows-version-specific data.

== POOL TAGS ==
PhAB: System service logging argument block. sysservice.h
PhCH: Client handle table. kprocesshacker.h
PhCt: System service logging argument capture temporary buffer. sysservicep.h
PhCU: Captured Unicode string. kph.h
PhEB: System service logging event block. sysservice.h
PhOb: Object manager object. refp.h
PhPC: Pool-based virtual memory copying. mm.h
PhPr: Protection entry. protect.h
PhSc: System service call entry. sysservicedata.h
PhSD: Processor lock DPC storage. sync.h
PhSt: Stack back trace. ps.h
