mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
1533dd503d
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@6092 21ef857c-d57f-4fe0-8362-d861dc6d29cd
76 lines
1.6 KiB
C
76 lines
1.6 KiB
C
#ifndef PH_HIDNPROC_H
|
|
#define PH_HIDNPROC_H
|
|
|
|
typedef enum _PH_HIDDEN_PROCESS_METHOD
|
|
{
|
|
BruteForceScanMethod,
|
|
CsrHandlesScanMethod
|
|
} PH_HIDDEN_PROCESS_METHOD;
|
|
|
|
typedef enum _PH_HIDDEN_PROCESS_TYPE
|
|
{
|
|
UnknownProcess,
|
|
NormalProcess,
|
|
HiddenProcess,
|
|
TerminatedProcess
|
|
} PH_HIDDEN_PROCESS_TYPE;
|
|
|
|
typedef struct _PH_HIDDEN_PROCESS_ENTRY
|
|
{
|
|
HANDLE ProcessId;
|
|
PPH_STRING FileName;
|
|
PH_HIDDEN_PROCESS_TYPE Type;
|
|
} PH_HIDDEN_PROCESS_ENTRY, *PPH_HIDDEN_PROCESS_ENTRY;
|
|
|
|
typedef struct _PH_CSR_HANDLE_INFO
|
|
{
|
|
HANDLE CsrProcessHandle;
|
|
HANDLE Handle;
|
|
BOOLEAN IsThreadHandle;
|
|
|
|
HANDLE ProcessId;
|
|
} PH_CSR_HANDLE_INFO, *PPH_CSR_HANDLE_INFO;
|
|
|
|
typedef BOOLEAN (NTAPI *PPH_ENUM_HIDDEN_PROCESSES_CALLBACK)(
|
|
_In_ PPH_HIDDEN_PROCESS_ENTRY Process,
|
|
_In_opt_ PVOID Context
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
PhEnumHiddenProcesses(
|
|
_In_ PH_HIDDEN_PROCESS_METHOD Method,
|
|
_In_ PPH_ENUM_HIDDEN_PROCESSES_CALLBACK Callback,
|
|
_In_opt_ PVOID Context
|
|
);
|
|
|
|
typedef BOOLEAN (NTAPI *PPH_ENUM_CSR_PROCESS_HANDLES_CALLBACK)(
|
|
_In_ PPH_CSR_HANDLE_INFO Handle,
|
|
_In_opt_ PVOID Context
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
PhEnumCsrProcessHandles(
|
|
_In_ PPH_ENUM_CSR_PROCESS_HANDLES_CALLBACK Callback,
|
|
_In_opt_ PVOID Context
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
PhOpenProcessByCsrHandle(
|
|
_Out_ PHANDLE ProcessHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ PPH_CSR_HANDLE_INFO Handle
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
PhOpenProcessByCsrHandles(
|
|
_Out_ PHANDLE ProcessHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ HANDLE ProcessId
|
|
);
|
|
|
|
#endif
|