mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
5d9f71e8d4
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1327 21ef857c-d57f-4fe0-8362-d861dc6d29cd
45 lines
1.4 KiB
Plaintext
45 lines
1.4 KiB
Plaintext
==== KProcessHacker ====
|
|
|
|
== IMPORTANT ==
|
|
KProcessHacker has been developed from either reverse engineering of
|
|
the Windows kernel or ReactOS code (http://www.reactos.org). The
|
|
following files contain "ported" ReactOS code (with modifications):
|
|
|
|
* mm.c
|
|
* MiDoMappedCopy
|
|
* MiDoPoolCopy (added smarter buffer management)
|
|
* MiGetExceptionInfo
|
|
* ps.c
|
|
* KphOpenProcess
|
|
* KphOpenThread
|
|
* se.c
|
|
* KphOpenProcessTokenEx
|
|
|
|
== CODE STRUCTURE ==
|
|
* hook.c
|
|
- Contains hooking code. Currently you may hook any kernel-mode
|
|
function and object type open procedures.
|
|
* kph.c
|
|
- Contains support routines
|
|
* kprocesshacker.c
|
|
- Contains interfacing code, mainly consisting of the I/O control
|
|
handler.
|
|
* mm.c
|
|
- Contains memory-related code, such as reading and writing.
|
|
* ob.c
|
|
- Contains object-related code, such as handle duplication.
|
|
* protect.c
|
|
- Contains process protection code. Process protection is
|
|
achieved by hooking ObOpenObjectByPointer and some object type
|
|
OpenProcedures.
|
|
* ps.c
|
|
- Contains process- and thread-related code, such as opening and
|
|
terminating.
|
|
* se.c
|
|
- Contains security-related code. Only function there is
|
|
KphOpenProcessTokenEx.
|
|
* sync.c
|
|
- "Processor lock" code. Explained in the code comments.
|
|
* version.c
|
|
- Contains Windows-version-specific data.
|